Edit tour

Windows Analysis Report
https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz

Overview

General Information

Sample URL:	https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91
Analysis ID:	1676607
Infos:

Detection

Score:	20
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2328,i,5844405568809796047,17720815761895081039,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2380 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

String found in binary or memory: af=y(["https://sandbox.google.com/tools/feedback/"]),bf=y(["https://www.google.cn/tools/feedback/"]),cf=y(["https://help.youtube.com/tools/feedback/"]),df=y(["https://asx-frontend-staging.corp.google.com/inapp/"]),ef=y(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),ff=y(["https://localhost.corp.google.com/inapp/"]),gf=y(["https://localhost.proxy.googlers.com/inapp/"]),hf=S(Ke),jf=[S(Le),S(Me)],kf=[S(Ne),S(Oe),S(Pe),S(Qe),S(Re),S(Se),S(Te),S(Ue),S(Ve),S(We)],lf=[S(Xe),S(Ye)],mf= equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: us-west-2.protection.sophos.com
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: lh5.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: unknown

HTTP traffic detected: POST /forms/d/e/1FAIpQLSewo1ARbW_OMSGzqMRTRLLLMTI1kb-z5Uh_5saHr4IIUJr9Fw/naLogImpressions HTTP/1.1host: docs.google.comcontent-length: 5639x-client-deadline-ms: 20000sec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"content-type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0x-same-domain: 1accept: */*origin: https://docs.google.comx-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjA2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE=sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: emptyreferer: https://docs.google.com/forms/d/e/1FAIpQLSewo1ARbW_OMSGzqMRTRLLLMTI1kb-z5Uh_5saHr4IIUJr9Fw/viewform?usp=pp_urlaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: S=spreadsheet_forms=Waou9Rj2yWT17Su6INnsQnvywPrKwb59H9Gtdmxc-Ygcookie: COMPASS=spreadsheet_forms=CjIACWuJV18oDmzCRJwuISfArnX1zOeSruvOWXfT6lbQkBx3L2AoBHHaE5lk4DnN71GcBRCayb_ABho0AAlriVcwLzN8_0m3L_v8lk1MlOKwqOmsZXo-Ldf4Kz_h9dsNASuyiT0CTkQWYib-byu7bA==cookie: NID=523=pz6PJd526QDGhTRyiDyNmwleHHJV_1UH-piKCHsuqrfX401plnh6itUlvxM47wnfX69tZ6hfpsrZ1vEsN4P5R9HHd6oIy3lfAuiqA-0nSSWmgAOHdIfsBGdbE2aLxVl9pguMAQXDTDVX8qVTC9nTjUgQsdRGTSzWHez4ZOxbwED_BAwm4jGZxU3EjfH_njYfTDrvJ3spriority: u=1, i

Source: chromecache_150.4.dr	String found in binary or memory: http://localhost.corp.google.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: http://localhost.proxy.googlers.com/inapp/
Source: chromecache_107.4.dr	String found in binary or memory: https://angular.dev/license
Source: chromecache_150.4.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/;secured-pixel.com;Can
Source: chromecache_150.4.dr	String found in binary or memory: https://feedback-pa.clients6.google.com
Source: chromecache_150.4.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/annotator.css
Source: chromecache_150.4.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/render_frame2.html
Source: chromecache_150.4.dr	String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_150.4.dr	String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_150.4.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_150.4.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_175.4.dr, chromecache_106.4.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_180.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialiconsextended/v152/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvJ.woff
Source: chromecache_175.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVE9eOcEg.woff2)
Source: chromecache_175.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2)
Source: chromecache_175.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVFNeOcEg.woff2)
Source: chromecache_175.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVGdeOcEg.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_106.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_150.4.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_150.4.dr	String found in binary or memory: https://help.youtube.com/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://localhost.corp.google.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://localhost.proxy.googlers.com/inapp/
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://play.google.com
Source: chromecache_107.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_150.4.dr	String found in binary or memory: https://sandbox.google.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_150.4.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_150.4.dr	String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://ssl.gstatic.com/docs/forms/draft_responses_onboarding.png
Source: chromecache_150.4.dr	String found in binary or memory: https://stagingqual-feedback-pa-googleapis.sandbox.google.com
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://support.google.com
Source: chromecache_150.4.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_150.4.dr	String found in binary or memory: https://support.google.com/inapp/
Source: chromecache_150.4.dr	String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_150.4.dr	String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_107.4.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_150.4.dr	String found in binary or memory: https://www.google.cn/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://www.google.com
Source: chromecache_170.4.dr	String found in binary or memory: https://www.google.com/intl/
Source: chromecache_150.4.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_150.4.dr	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chromecache_150.4.dr	String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_150.4.dr	String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_170.4.dr	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_150.4.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_150.4.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://youtube.com/embed/
Source: chromecache_118.4.dr, chromecache_170.4.dr	String found in binary or memory: https://youtube.com/embed/?rel=0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.173.114:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.173.114:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.72.174:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.1:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.161:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.161:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.115.100:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.72.142:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.115.100:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.68.238:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: classification engine

Classification label: sus20.win@22/184@35/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2328,i,5844405568809796047,17720815761895081039,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2380 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2328,i,5844405568809796047,17720815761895081039,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2380 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: _.GM=function(a){Odb();return Ndb(_.Em(a))};_.Pdb=function(a,b,c){var d=function(){return a.apply(d,arguments)};c(b,d);return d};_.Qdb=function(a){Odb();return a==null?_.FM():_.GM(a)}; source: chromecache_118.4.dr, chromecache_170.4.dr
Source:	Binary string: 0;g<f.length;g++)c.push(new bY(e.o,f[g],e.j));return c};var MTb=function(){};_.B(MTb,_.E);MTb.prototype.j=function(a){return NTb(a)};var OTb=function(a,b){b.efa=!0};var cY=function(a,b){PTb();this.j=0;this.o=a;this.j=b},NTb,PTb;_.B(cY,_.E);NTb=function(a){return a.j==400?a.o:_.H(a.o)+";"+a.j};_.QTb=function(a){PTb();for(var b=[],c=0;c<a.length;c++){var d=a[c];var e=d;var f=400;d=_.FJ(d,";",0);d.length!=0&&(e=d[0]);if(d.length==2)try{var g=_.WX(d[1]);f=g!=0?g:400}catch(k){if(d=_.mj(k),!(d instanceof _.jk))throw d.Xb;}e=new cY(e,f);b.push(e)}return b};PTb=function(){PTb=function(){};_.Pdb(MTb.prototype.j,new MTb,OTb)};var RTb=function(a,b,c){_.Wn.call(this);this.o=a;this.j=b;this.H=c};_.B(RTb,_.Wn);RTb.prototype.fetch=function(a,b,c){a=STb(this.o,a,b,c);a=dTb(this.j,a);var d;a.o((d=this.H,function(e){d.N(e)}));return a};var TTb=function(a,b){this.o=a;this.j=_.cr(b)};_.B(TTb,_.E);var UTb=function(a,b){for(var c=0;c<b.length;c++)a.j[b[c]]=!0};var VTb=function(a){this.j=a};_.B(VTb,_.E);var XTb=function(){WTb()},YTb,ZTb,$Tb,aUb;_.B(XTb,_.E);var dUb=function(){for(var a=_.lp(),b=bUb,c=0;c<b.length;c++){var d=b[c];d==="Courier New"\|\|_.mp(a,d,null)}b=cUb;for(var e in b)for(c=b[e],d=0;d<c.length;d++)_.mp(a,c[d],null);_.mp(_.mp(_.mp(_.mp(_.mp(_.mp(a,"Arial",YTb),"Arial Black",ZTb),"Arial Narrow",$Tb),"Times New Roman",aUb),"Garamond",null),"Tahoma",null);_.np(a)},WTb=function(){WTb=function(){};YTb="Sans Serif";aUb="Serif";ZTb="Wide";$Tb="Narrow";dUb()};var bUb="Arial;Comic Sans MS;Courier New;Georgia;Impact;Times New Roman;Trebuchet MS;Verdana".split(";"),cUb={ar:"Arabic Typesetting;Sakkal Majalla;Simplified Arabic;Traditional Arabic;Al Bayan;Baghdad;DecoType Naskh;KufiStandardGK;Nadeem".split(";"),hi:["Aparajita","Kokila","Mangal","Utsaah","Devanagari MT"],iw:"Aharoni;David;FrankRuehl;Gisha;Levenim MT;Miriam;Narkisim;Rod;Arial Hebrew;Corsiva Hebrew;New Peninim MT;Raanana".split(";"),ja:"Meiryo;MS Gothic;MS Mincho;MS PGothic;MS PMincho;HiraMaruPro-W4;HiraMinPro-W3;HiraKakuPro-W3;HiraMaruProN-W4;HiraMinProN-W3;HiraKakuProN-W3".split(";"), source: chromecache_118.4.dr, chromecache_170.4.dr

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Extra Window Memory Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
docs.google.com	142.250.72.174	true	false	high
google.com	142.250.68.238	true	false	high
d2t07dpvw9bt1v.cloudfront.net	18.155.173.114	true	false	high
play.google.com	142.250.115.100	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.123.94	true	false	high
www.google.com	142.250.69.4	true	false	high
googlehosted.l.googleusercontent.com	142.250.176.1	true	false	high
us-west-2.protection.sophos.com	unknown	unknown	false	high
lh5.googleusercontent.com	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://docs.google.com/forms/d/e/1FAIpQLSewo1ARbW_OMSGzqMRTRLLLMTI1kb-z5Uh_5saHr4IIUJr9Fw/viewform	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://localhost.corp.google.com/inapp/	chromecache_150.4.dr	false	high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_150.4.dr	false	high
https://youtube.com/embed/?rel=0	chromecache_118.4.dr, chromecache_170.4.dr	false	high
https://apis.google.com/js/client.js	chromecache_150.4.dr	false	high
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_150.4.dr	false	high
https://support.google.com	chromecache_118.4.dr, chromecache_170.4.dr	false	high
https://play.google.com	chromecache_118.4.dr, chromecache_170.4.dr	false	high
https://youtube.com/embed/	chromecache_118.4.dr, chromecache_170.4.dr	false	high
http://localhost.proxy.googlers.com/inapp/	chromecache_150.4.dr	false	high
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_150.4.dr	false	high
https://support.google.com/inapp/%	chromecache_150.4.dr	false	high
https://asx-help-frontend-autopush.corp.youtube.com/inapp/	chromecache_150.4.dr	false	high
https://help.youtube.com/tools/feedback/	chromecache_150.4.dr	false	high
https://angular.dev/license	chromecache_107.4.dr	false	high
https://asx-frontend-staging.corp.google.com/tools/feedback/	chromecache_150.4.dr	false	high
https://support.google.com/	chromecache_150.4.dr	false	high
https://www.google.com	chromecache_118.4.dr, chromecache_170.4.dr	false	high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/;secured-pixel.com;Can	chromecache_118.4.dr, chromecache_170.4.dr	false	high
https://scone-pa.clients6.google.com	chromecache_150.4.dr	false	high
https://support.google.com/inapp/	chromecache_150.4.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_150.4.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_150.4.dr	false	high
https://asx-frontend-autopush.corp.google.com/tools/feedback/	chromecache_150.4.dr	false	high
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_150.4.dr	false	high
https://feedback2-test.corp.google.com/inapp/%	chromecache_150.4.dr	false	high
https://www.google.com/tools/feedback	chromecache_150.4.dr	false	high
https://sandbox.google.com/inapp/%	chromecache_150.4.dr	false	high
https://www.google.com/intl/	chromecache_170.4.dr	false	high
https://feedback2-test.corp.googleusercontent.com/inapp/%	chromecache_150.4.dr	false	high
https://localhost.proxy.googlers.com/inapp/	chromecache_150.4.dr	false	high
https://www.google.com/tools/feedback/	chromecache_150.4.dr	false	high
https://www.google.cn/tools/feedback/	chromecache_150.4.dr	false	high
https://asx-frontend-autopush.corp.google.de/inapp/	chromecache_150.4.dr	false	high
https://www.google.cn/tools/feedback/%	chromecache_150.4.dr	false	high
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_150.4.dr	false	high
https://www.google.com/tools/feedback/help_panel_binary.js	chromecache_150.4.dr	false	high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_107.4.dr	false	high
https://asx-frontend-autopush.corp.google.de/tools/feedback/	chromecache_150.4.dr	false	high
https://sandbox.google.com/inapp/	chromecache_150.4.dr	false	high
https://test-scone-pa-googleapis.sandbox.google.com	chromecache_150.4.dr	false	high
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_150.4.dr	false	high
https://play.google.com/log?format=json&hasfast=true	chromecache_107.4.dr	false	high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_150.4.dr	false	high
https://feedback.googleusercontent.com/resources/render_frame2.html	chromecache_150.4.dr	false	high
https://sandbox.google.com/tools/feedback/%	chromecache_150.4.dr	false	high
https://sandbox.google.com/tools/feedback/	chromecache_150.4.dr	false	high
https://localhost.corp.google.com/inapp/	chromecache_150.4.dr	false	high
https://asx-frontend-autopush.corp.youtube.com/inapp/	chromecache_150.4.dr	false	high
https://feedback-pa.clients6.google.com	chromecache_150.4.dr	false	high
https://asx-frontend-staging.corp.google.com/inapp/	chromecache_150.4.dr	false	high
https://www.google.com/tools/feedback/%	chromecache_150.4.dr	false	high
https://fonts.google.com/license/googlerestricted	chromecache_175.4.dr, chromecache_106.4.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
192.178.49.161	unknown	United States	15169	GOOGLEUS	false
142.250.176.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.68.238	google.com	United States	15169	GOOGLEUS	false
142.250.115.100	play.google.com	United States	15169	GOOGLEUS	false
142.250.72.142	unknown	United States	15169	GOOGLEUS	false
18.155.173.114	d2t07dpvw9bt1v.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.72.174	docs.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676607
Start date and time:	2025-04-28 21:25:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus20.win@22/184@35/9

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.40.35, 192.178.49.174, 142.250.141.84, 142.250.217.142, 192.178.49.206, 199.232.214.172, 192.178.49.170, 192.178.49.195, 192.178.49.163, 142.250.68.227, 69.192.44.226, 184.29.183.29
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fonts.googleapis.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 64068, version 1.0
Category:	downloaded
Size (bytes):	64068
Entropy (8bit):	7.995942836449749
Encrypted:	true
SSDEEP:	1536:upRrvXnQdfmI5RP21QVVEIeKN8UhJhfEvCHal5j091ScR9b0XnK:u/rIdDkiVl8gfol5gnStnK
MD5:	EFD94F0EB81E50A5F75CFAC73257EFC2
SHA1:	E8C4E0A66E8BA85DE2BDACA59CBCC55CED60BBCA
SHA-256:	3A6C1001C36D7F2F8AD4DF369BAF38217AF3ADAAE94A5625651C05F4C3A38BD3
SHA-512:	215837C93B5FF3247D5912CEC24216CFF64C16DC6B07F620424E9DB101DC6FDDC792B546F42744D74FF08785D6CA2143A6D45F5C1D4B84E357DAB942456BA42D
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/amaticsc/v26/TUZyzwprpvBS1izr_vO0CA.woff2
Preview:	wOF2.......D......(@..............................>..l....`..d..$..m.....h..&.....6.$..X. ..x.....<[..q..].)..].....'0}@..2%~.s..<mE...n..,U.......d2........XV...Q..Hexa.f.lE.&...c1....T..4...e..Uj....{..qL2.p........ZG..(.YKz.-......M.=.5q.3.f..C_ ..Q..Y.F.p6..E..T..$...H..I3..g'/M..OE../.n..M/=.f.......G.r.h.......i)k....I.c...Y.`.{.O[WCe.]Um.F&Z.u`"..........S.W....Y..}"..i..T.....gl.......H.m..b..Jru.KH....$.PI.J.....+..q.$.p.m..ZY.U.g.@4..:VAV.N.ed.....\...~..s..........h.h.....d..A.....~..Q..O...v.;....l....,..KJHI.J..E.b`4.).}g.y....mz......!:GBu.).....>.`.....>W...Ad.,@.!.D............T.S.!..jf....N......WnU....X.9..t.....F..JNz0....x=..2.u.....!.....=....}.M.DY....b_R..W.<..?.l.!.[.m.6.T.X..B;h..^.B).u./g...].....$.l7....G,.ff.J..L........%..?..6a..G.........$......X.U.e.>....v3.m&Y...nX> .V0p.I^.Jw\.b[...=3..P..<...Av.k.......Ia.....x......Ja......jSH.......P.6>Qi.*..m..b%N+F.......O..{.s.O...XqR.j......P...)/i/..&.R..i6.......iw.

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.234.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q HTTP/1.1host: us-west-2.protection.sophos.comsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"upgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSewo1ARbW_OMSGzqMRTRLLLMTI1kb-z5Uh_5saHr4IIUJr9Fw/viewform?usp=pp_url HTTP/1.1host: docs.google.comupgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /-zSgKhGVdqdDKdZ0m2Yul_HaDql9QidcM192Xx3Ef90B09jc-g-KHYif9xIdW1EQJ709DPFWYCE6tMcgI_o9ak2TuFVMYF0KTEZAeeOdIvwY9WAifrsBePji-I2AEwOZGOxvfIGuUJs10RllQ5SpZ6QDV0M-p_7xZ-Voxqa9a6Q4GP2YbA=w1102?key=a2w0Ouflou9v6-QeITM0Tg HTTP/1.1host: lh5.googleusercontent.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjA2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE=sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://docs.google.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /-zSgKhGVdqdDKdZ0m2Yul_HaDql9QidcM192Xx3Ef90B09jc-g-KHYif9xIdW1EQJ709DPFWYCE6tMcgI_o9ak2TuFVMYF0KTEZAeeOdIvwY9WAifrsBePji-I2AEwOZGOxvfIGuUJs10RllQ5SpZ6QDV0M-p_7xZ-Voxqa9a6Q4GP2YbA=w1102?key=a2w0Ouflou9v6-QeITM0Tg HTTP/1.1host: lh5.googleusercontent.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0Bsec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=swR12YcUgTmTcBT&MD=rlOZ+pv1 HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /r67TJqIMUmFfgqyRt3O7jNnfghcL7o8b3EvTSsUc1u3Kw88aNcxPt8qBk1pHVBIVXVcgv2cLet-OTs-s6GSZR7FvvKOljG2-psavaPeVvVjBTfM6jky0KttZo94fWwEfWMl0jdH59mABu5t2OE2Eppj7F7Twik2i85uywOH1nWo7HH6PWw=w1468?key=a2w0Ouflou9v6-QeITM0Tg HTTP/1.1host: lh3.googleusercontent.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjA2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE=sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://docs.google.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /r67TJqIMUmFfgqyRt3O7jNnfghcL7o8b3EvTSsUc1u3Kw88aNcxPt8qBk1pHVBIVXVcgv2cLet-OTs-s6GSZR7FvvKOljG2-psavaPeVvVjBTfM6jky0KttZo94fWwEfWMl0jdH59mABu5t2OE2Eppj7F7Twik2i85uywOH1nWo7HH6PWw=w1468?key=a2w0Ouflou9v6-QeITM0Tg HTTP/1.1host: lh3.googleusercontent.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0Bsec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSewo1ARbW_OMSGzqMRTRLLLMTI1kb-z5Uh_5saHr4IIUJr9Fw/font/getmetadata HTTP/1.1host: docs.google.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0Bsec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: S=spreadsheet_forms=Waou9Rj2yWT17Su6INnsQnvywPrKwb59H9Gtdmxc-Ygcookie: COMPASS=spreadsheet_forms=CjIACWuJV18oDmzCRJwuISfArnX1zOeSruvOWXfT6lbQkBx3L2AoBHHaE5lk4DnN71GcBRCayb_ABho0AAlriVcwLzN8_0m3L_v8lk1MlOKwqOmsZXo-Ldf4Kz_h9dsNASuyiT0CTkQWYib-byu7bA==cookie: NID=523=pz6PJd526QDGhTRyiDyNmwleHHJV_1UH-piKCHsuqrfX401plnh6itUlvxM47wnfX69tZ6hfpsrZ1vEsN4P5R9HHd6oIy3lfAuiqA-0nSSWmgAOHdIfsBGdbE2aLxVl9pguMAQXDTDVX8qVTC9nTjUgQsdRGTSzWHez4ZOxbwED_BAwm4jGZxU3EjfH_njYfTDrvJ3spriority: u=1, i
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=swR12YcUgTmTcBT&MD=rlOZ+pv1 HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 21:26:58.605467081 CEST	53	50504	1.1.1.1	192.168.2.4
Apr 28, 2025 21:26:58.672637939 CEST	53	51397	1.1.1.1	192.168.2.4
Apr 28, 2025 21:26:59.787659883 CEST	53	50569	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:02.359436989 CEST	55007	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:02.359741926 CEST	65002	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:02.499833107 CEST	53	55007	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:02.500225067 CEST	53	65002	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:04.439749956 CEST	49609	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:04.440381050 CEST	51844	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:04.583528042 CEST	53	51844	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:04.587419987 CEST	53	49609	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:05.268207073 CEST	52120	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:05.268347979 CEST	53595	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:05.418261051 CEST	53	52120	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:05.420121908 CEST	53	53595	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:06.350018978 CEST	53	62866	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:06.352181911 CEST	53	51858	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:06.361933947 CEST	64439	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:06.362068892 CEST	57817	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:06.502238035 CEST	53	57817	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:06.502394915 CEST	53	64439	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:07.639198065 CEST	57446	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:07.639332056 CEST	53941	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:07.779521942 CEST	53	57446	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:07.791081905 CEST	53	53941	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:08.753587961 CEST	64325	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:08.753751993 CEST	54713	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:08.893950939 CEST	53	64325	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:08.893970966 CEST	53	54713	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:08.900975943 CEST	53	64448	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:08.904810905 CEST	53	64307	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:09.369950056 CEST	53	60452	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:09.875497103 CEST	56199	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:09.875566006 CEST	62766	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:10.015541077 CEST	53	56199	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:10.016001940 CEST	53	62766	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:10.206516027 CEST	52089	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:10.206660032 CEST	53532	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:10.347003937 CEST	53	52089	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:10.347017050 CEST	53	53532	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:10.743590117 CEST	59203	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:10.743590117 CEST	60923	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:10.884979010 CEST	53	60923	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:10.894208908 CEST	53	59203	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:11.477950096 CEST	65050	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:11.478101015 CEST	55371	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:27:11.618670940 CEST	53	65050	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:11.618918896 CEST	53	55371	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:16.874306917 CEST	53	57386	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:35.670655966 CEST	53	51703	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:53.254035950 CEST	138	138	192.168.2.4	192.168.2.255
Apr 28, 2025 21:27:58.142000914 CEST	53	52055	1.1.1.1	192.168.2.4
Apr 28, 2025 21:27:58.230493069 CEST	53	61840	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:07.626072884 CEST	50151	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:07.626288891 CEST	56689	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:07.766601086 CEST	53	56689	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:07.766624928 CEST	53	50151	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:08.637486935 CEST	53066	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:08.637619972 CEST	49678	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:08.777653933 CEST	53	53066	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:08.778232098 CEST	53	49678	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:10.626385927 CEST	60489	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:10.626523018 CEST	51072	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:10.669045925 CEST	57100	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:10.769113064 CEST	53	51072	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:10.780536890 CEST	53	60489	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:10.810960054 CEST	53	57100	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:11.637552023 CEST	61325	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:11.637726068 CEST	51895	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:11.668613911 CEST	57100	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:11.777966022 CEST	53	61325	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:11.778112888 CEST	53	51895	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:11.809022903 CEST	53	57100	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:12.684169054 CEST	57100	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:12.824541092 CEST	53	57100	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:13.625943899 CEST	57533	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:13.626184940 CEST	49724	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:13.766228914 CEST	53	57533	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:13.769694090 CEST	53	49724	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:14.699693918 CEST	57100	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:14.841639042 CEST	53	57100	1.1.1.1	192.168.2.4
Apr 28, 2025 21:28:18.715785027 CEST	57100	53	192.168.2.4	1.1.1.1
Apr 28, 2025 21:28:18.856427908 CEST	53	57100	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:05 UTC	1026	OUT	GET /?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q HTTP/1.1 host: us-west-2.protection.sophos.com sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-fetch-site: none sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: document accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=0, i
2025-04-28 19:27:05 UTC	689	IN	HTTP/1.1 302 Found content-type: text/html content-length: 0 location: https://docs.google.com/forms/d/e/1FAIpQLSewo1ARbW_OMSGzqMRTRLLLMTI1kb-z5Uh_5saHr4IIUJr9Fw/viewform?usp=pp_url date: Mon, 28 Apr 2025 19:27:05 GMT x-amzn-trace-id: Root=1-680fd689-58eef352727d42235a23542e;Parent=0ba52ea1a459e11f;Sampled=0;Lineage=1:b506645d:0 x-amzn-requestid: bb79935e-e363-4a7f-be94-a47453fa2a7f referrer-policy: no-referrer x-robots-tag: noindex, nofollow x-amz-apigw-id: Jv51eGr_vHcElVw= x-cache: Miss from cloudfront via: 1.1 291e5869d77d73ace45923113579d8d8.cloudfront.net (CloudFront) x-amz-cf-pop: PHX50-P1 x-amz-cf-id: hDQGEaybqhKUHomKf5e8JH06SQpnMhlN5OeUYO_16PrQ2yLkSyhoVA==

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:07 UTC	940	OUT	GET /-zSgKhGVdqdDKdZ0m2Yul_HaDql9QidcM192Xx3Ef90B09jc-g-KHYif9xIdW1EQJ709DPFWYCE6tMcgI_o9ak2TuFVMYF0KTEZAeeOdIvwY9WAifrsBePji-I2AEwOZGOxvfIGuUJs10RllQ5SpZ6QDV0M-p_7xZ-Voxqa9a6Q4GP2YbA=w1102?key=a2w0Ouflou9v6-QeITM0Tg HTTP/1.1 host: lh5.googleusercontent.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjA2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE= sec-fetch-site: cross-site sec-fetch-mode: no-cors sec-fetch-dest: image sec-fetch-storage-access: active referer: https://docs.google.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=2, i
2025-04-28 19:27:07 UTC	532	IN	HTTP/1.1 200 OK content-type: image/png vary: Origin access-control-allow-origin: * timing-allow-origin: * access-control-expose-headers: Content-Length etag: "v1" expires: Tue, 29 Apr 2025 19:27:07 GMT cache-control: public, max-age=86400, no-transform content-disposition: inline;filename="Screenshot 2024-05-07 at 11.50.09 AM.png" x-content-type-options: nosniff date: Mon, 28 Apr 2025 19:27:07 GMT server: fife content-length: 175617 x-xss-protection: 0 alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 4e 00 00 05 80 08 06 00 00 00 47 a9 03 fc 00 00 0a ad 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 97 07 50 53 59 17 c7 ef 7b e9 21 a1 25 84 0e a1 37 e9 2d 80 94 10 5a 00 05 e9 60 23 24 01 42 09 21 10 54 6c 88 88 2b b0 a2 a8 88 a0 22 e8 aa 88 82 6b 01 64 15 15 51 2c 2c 02 0a 76 17 64 51 50 d6 c5 82 0d 95 ef 01 43 d8 dd 6f be ef 9b ef cc 9c b9 bf 77 de b9 ff 7b ee 9d 77 67 ce 03 80 2c cf 11 89 52 60 79 00 52 85 99 e2 10 5f 4f 7a 54 74 0c 1d 37 0c 20 80 07 38 20 0f 18 1c 6e 86 88 19 1c 1c 08 10 9b 1d ff 6e 1f fa 90 6c c4 ee 98 4f 69 fd fb fb ff 6a 0a 3c 7e 06 17 00 28 18 e1 38 5e 06 37 15 e1 33 88 bf e4 8a c4 99 00 a0 0e 20 71 bd 15 99 a2 29 6e 43 98 2a 46 0a 44 f8 fe 14 27 cc f0 e8 14 Data Ascii: PNGIHDRNGiCCPICC ProfileHPSY{!%7-Z`#$B!Tl+"kdQ,,vdQPCow{wg,R`yR_OzTt7 8 nnlOij<~(8^73 q)nC*FD'
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: b6 51 b6 51 ad d1 63 63 b2 b1 bb 71 ba 71 b5 f1 5d 13 ac 09 c3 24 d9 64 9f 49 97 29 6c 6a 6f 9a 68 5a 61 7a db 0c 36 73 30 13 98 ed 33 eb 9e 87 99 e7 34 4f 38 af 7a de 3d 73 92 39 d3 3c cb bc d6 7c c0 82 66 11 68 91 6b d1 68 f1 da 52 df 32 c6 72 bb 65 bb e5 77 2b 7b ab 14 ab 43 56 8f ac 15 ad fd ad 73 ad 9b ad df da 98 da 70 6d 2a 6c ee da 92 6d 7d 6c d7 db 36 d9 be b1 33 b3 e3 db ed b7 bb 6f 4f b1 5f 60 bf d9 be d5 fe 9b 83 a3 83 d8 a1 ce 61 c4 51 df 31 d6 71 af e3 3d 06 95 11 cc 28 62 5c 77 c2 38 79 3a ad 77 3a ef f4 d9 d9 c1 39 d3 f9 94 f3 9f 2e e6 2e c9 2e c7 5c 86 e7 1b cd e7 cf 3f 34 7f d0 55 d7 95 e3 5a e5 da ef 46 77 8b 75 3b e0 d6 ef ae e3 ce 71 af 76 7f e6 a1 e7 c1 f3 38 ec f1 82 69 c2 4c 62 1e 67 be f6 b4 f2 14 7b 9e f5 fc c8 72 66 ad 65 5d f2 Data Ascii: QQccqq]$dI)ljohZaz6s034O8z=s9<\|fhkhR2rew+{CVspm*lm}l63oO_`aQ1q=(b\w8y:w:9...\?4UZFwu;qv8iLbg{rfe]
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: 73 68 6f 74 e4 83 85 26 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 01 d8 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 58 4d 50 20 43 6f 72 65 20 36 2e 30 2e 30 22 3e 0a 20 20 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3a 65 78 69 66 3d 22 68 74 74 70 3a Data Ascii: shot&pHYs%%IR$iTXtXML:com.adobe.xmp<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:exif="http:
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: 00 04 20 00 01 08 40 00 02 f9 41 00 e1 24 3f fa 99 56 42 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 0e 02 08 27 eb 80 c6 23 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 e4 07 01 84 93 fc e8 67 5a 09 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 c0 3a 08 20 9c ac 03 1a 8f 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 1f 04 10 4e f2 a3 9f 69 25 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 eb 20 10 85 93 be f1 85 0f 67 de bf 72 6b 4e 97 f6 97 99 65 32 19 6b 69 69 59 98 82 77 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 60 8f 13 40 38 d9 e3 1d 4c f3 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 58 3f 01 84 93 f5 b3 e3 49 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 Data Ascii: @A$?VB @ '# @ gZ@ @: @ @ Ni% @ @ grkNe2kiiYw @ @`@8L @ @X?I@ @
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: e9 a9 7d a5 66 99 4c c6 5a 5a 5a 96 cd 84 1b 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 60 2f 12 40 38 d9 8b bd 4a 9b 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 d8 14 02 cb 0b 27 6d 59 8f 93 12 3c 4e 36 85 34 99 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 eb 08 20 9c ec ba 2e a3 c2 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 dc 2b 02 08 27 f7 8a 34 e5 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 eb 08 ac 20 9c 74 24 c1 61 4b e6 08 0e bb eb ba 95 0a 43 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 19 04 72 c2 c9 54 66 41 76 99 8f db 12 e1 a4 06 e1 64 01 18 de 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 3f 04 a2 70 32 84 70 92 3f 9d 4e 4b 21 00 01 08 40 00 Data Ascii: }fLZZZ @ @`/@8J @ @'mY<N64@ @ . @ +'4@ @ t$aKC @ rTfAvd@ @ ?p2p?NK!@
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: c9 72 c4 65 05 2c 47 bc 80 0c 6f 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 c8 1b 02 08 27 79 d3 d5 34 14 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 81 b5 12 40 38 59 2b 31 d2 43 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 37 04 10 4e f2 a6 ab 69 28 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 6b 25 10 85 93 c9 b9 a2 05 8f 66 ae 66 63 9c 94 12 e3 64 01 18 de 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 3f 04 10 4e f2 a7 af 69 29 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 6b 24 90 13 4e 0c 8f 93 35 a2 23 39 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 7b 9d 40 14 4e a6 3e 29 9c 74 ce a9 f1 a5 05 33 96 c9 64 ac a5 a5 65 af b3 a0 7d 10 80 00 04 20 00 01 08 40 00 02 10 Data Ascii: re,Go @ @'y4 @ @8Y+1C @ 7Ni( @ @k%ffcd@ @ ?Ni) @ @k$N5#9 @ @{@N>)t3de} @
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: 3c 64 87 0f 36 db be 9a 6a 7f ca a7 ff a8 0f b2 ac d6 2d 46 64 f3 50 1d 62 3d 66 dd ab 67 d6 fb 5a 53 a4 92 eb aa a3 5f f3 3e 4c c4 16 9f 42 35 e9 fd 1a a6 43 4d 85 6b ea a0 90 36 37 2f 4a de 37 3e 5d c9 c5 15 09 2d da 2b 2b 2b c3 fb a5 ea 1a cb 56 3e f1 7e 3c ea 1a 1b 04 20 00 01 08 40 00 02 10 80 00 04 20 90 5f 04 72 c2 49 c1 c2 1f 6c 33 4c d5 c9 af 81 b0 d3 5b 9b 36 66 e7 dc 68 9e 73 2f 85 de fe 01 9f 62 d3 6d ef 7c 78 cd de 7c ef aa 7d 78 be c3 2e 5f eb b1 91 d1 49 8f 35 e2 d3 70 94 2e 68 02 fe a2 63 50 06 92 96 46 23 7f a7 b7 7b 3b ea 17 90 09 56 72 22 15 22 08 11 ae 60 38 f7 39 2b f3 d8 2b d5 15 25 76 ec 70 9d 3d 78 e6 a0 7d f6 53 a7 5c 4c 69 b5 fb 4e 1d 0d 5e 20 c5 c5 25 a1 da 41 6c 70 97 94 98 cd 82 b6 44 cd 66 c1 c5 85 6f d4 47 7a 3a 1c d3 2e 3f Data Ascii: <d6j-FdPb=fgZS_>LB5CMk67/J7>]-+++V>~< @ _rIl3L[6fhs/bm\|x\|}x._I5p.hcPF#{;Vr""`89++%vp=x}S\LiN^ %AlpDfoGz:.?
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: 97 e2 3d 68 07 9b 1b ac a9 b1 ce 85 91 4a f7 18 28 b7 d2 92 22 9f 86 e1 8b f8 16 14 26 55 55 95 93 0c e7 ab be 54 33 d2 69 e2 fd 15 ae 25 4b f1 ba 27 83 0b 2d e3 1e 10 f7 ce c0 a0 af 2e 74 c7 ae b4 75 d8 c5 2b b7 ec 83 f3 b7 ec b2 4f 69 ba d5 e1 f1 37 5c 50 99 90 e0 a3 1a 78 9e c2 98 f6 8c 98 af d8 d6 9f 89 a9 56 90 76 cd c0 2a 4a 0b ac ae ba d4 7e ff 1b 4f db d7 7f e9 71 3b 79 a2 d5 a7 b2 d4 e5 2a b1 d7 05 82 e0 55 92 12 8b d2 62 4a 5f 5f bf c7 4d 19 f2 69 6a a3 56 5b 5b eb 62 5c 4d 98 ea 53 5a 5a 1a bc 54 42 a0 dd a0 e4 79 97 66 8f 39 70 9c 40 00 02 10 80 00 04 20 00 01 08 40 00 02 5b 42 00 e1 64 4b b0 92 e9 4a 04 64 28 06 e3 d1 0d 3f 1d 2f 5f b9 6a 6f bf 77 d1 fe f6 bb ef d8 2f de 6d f7 5f e2 c7 6c d2 97 89 d5 96 2c 27 bc 52 6e 1b bf 17 a7 89 cc cd cc Data Ascii: =hJ("&UUT3i%K'-.tu+Oi7\PxVvJ~Oq;yUbJ__MijV[[b\MSZZTByf9p@ @[BdKJd(?/_jow/m_l,'Rn
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: ab 3e dd 63 c2 3c 9c 51 10 29 82 50 11 5e 12 46 c9 fb f9 be d7 f2 d0 9a de 23 f1 49 cb 29 17 f9 79 a1 1f 75 2e 4f 91 42 77 23 09 bb bf d7 b3 8a b7 a1 eb a5 be 7c 73 79 99 4f 81 f2 8b fa af ac b4 38 2c c9 9c 71 31 a7 b9 b1 c6 1e 7b e8 a8 3d f1 e8 59 7b f2 f1 07 5d 38 29 09 05 86 b2 e7 8b e6 6c 8d 04 e4 8d a2 b8 28 ea ef 9e 9e 9e 20 9c 9c 3c 79 32 4c e7 49 8f eb bd 30 be d7 88 86 e4 10 80 00 04 20 00 01 08 40 00 02 10 58 35 01 84 93 55 a3 22 e1 46 09 2c 16 4e 62 8c 93 bf fc 87 97 3d c6 c9 bb d6 de de 6b fd 3e 5d 27 e3 86 f9 9c 5b cc 4a bf d5 5b ce 99 c1 8b 2a 75 83 bf d2 0d fb 2f 3c 7d d2 9e fd cc 7d f6 fc e7 1f f1 25 88 8f b8 27 46 a9 57 23 63 33 2e b2 28 bd 8c f9 68 74 ee 56 83 73 7a 7a 26 c4 c8 18 1d 1b b3 91 11 8f 2b e3 c2 46 51 51 51 10 3f 24 80 84 f6 Data Ascii: >c<Q)P^F#I)yu.OBw#\|syO8,q1{=Y{]8)l( <y2LI0 @X5U"F,Nb=k>]'[J[*u/<}}%'FW#c3.(htVszz&+FQQQ?$
2025-04-28 19:27:07 UTC	1460	IN	Data Raw: c8 52 b7 af d2 bd 56 7c fa 90 3c 59 1a f7 d9 81 e6 3a 3f 26 42 4b a3 8b 2c 0d ee d1 52 e6 d3 87 4a 4a 4b 83 68 a3 2c b3 c5 24 85 44 61 c5 df a5 fb cc df b2 ed 31 02 f1 b3 ab 66 25 cb 19 f7 07 01 45 e2 9a 02 c9 ea 33 1c 37 44 b6 48 82 23 04 20 00 01 08 40 00 02 10 80 c0 5e 25 80 70 b2 57 7b 76 9b db 25 c3 4b 7b 7f 7f 7f 30 bc 14 cb a4 a4 a4 d4 0e 1f 3e e4 53 53 2a dc b8 77 13 3f 2b 96 2c 55 d5 60 b0 fb 8d 99 e9 29 9b 9c 98 b0 37 df fd d8 a7 ef 9c b7 1f fe ec 9c 7d 70 fe b6 0d 8e 4c da 94 bb 4c 48 44 91 84 22 21 25 df b7 9c e0 b2 98 6b e8 0b a7 a3 63 8c c9 22 51 24 a3 d5 83 0a ac a4 28 63 e5 e5 25 41 60 69 f4 69 42 cd 8d 49 5c 96 23 1e f8 f6 d8 11 f7 0a 6a ae 77 cf 95 7a ab ab ad f2 e0 b7 55 ee f9 52 ec 2b af f8 ca 47 f2 4c c9 42 0f de 2a 3a d7 09 db 9e 21 Data Ascii: RV\|<Y:?&BK,RJJKh,$Da1f%E37DH# @^%pW{v%K{0>SSw?+,U`)7}pLLHD"!%kc"Q$(c%A`iiBI\#jwzUR+GLB:!

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:08 UTC	656	OUT	GET /-zSgKhGVdqdDKdZ0m2Yul_HaDql9QidcM192Xx3Ef90B09jc-g-KHYif9xIdW1EQJ709DPFWYCE6tMcgI_o9ak2TuFVMYF0KTEZAeeOdIvwY9WAifrsBePji-I2AEwOZGOxvfIGuUJs10RllQ5SpZ6QDV0M-p_7xZ-Voxqa9a6Q4GP2YbA=w1102?key=a2w0Ouflou9v6-QeITM0Tg HTTP/1.1 host: lh5.googleusercontent.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0B sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 19:27:08 UTC	532	IN	HTTP/1.1 200 OK content-type: image/png vary: Origin access-control-allow-origin: * timing-allow-origin: * access-control-expose-headers: Content-Length etag: "v1" expires: Tue, 29 Apr 2025 19:27:08 GMT cache-control: public, max-age=86400, no-transform content-disposition: inline;filename="Screenshot 2024-05-07 at 11.50.09 AM.png" x-content-type-options: nosniff date: Mon, 28 Apr 2025 19:27:08 GMT server: fife content-length: 175617 x-xss-protection: 0 alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 4e 00 00 05 80 08 06 00 00 00 47 a9 03 fc 00 00 0a ad 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 97 07 50 53 59 17 c7 ef 7b e9 21 a1 25 84 0e a1 37 e9 2d 80 94 10 5a 00 05 e9 60 23 24 01 42 09 21 10 54 6c 88 88 2b b0 a2 a8 88 a0 22 e8 aa 88 82 6b 01 64 15 15 51 2c 2c 02 0a 76 17 64 51 50 d6 c5 82 0d 95 ef 01 43 d8 dd 6f be ef 9b ef cc 9c b9 bf 77 de b9 ff 7b ee 9d 77 67 ce 03 80 2c cf 11 89 52 60 79 00 52 85 99 e2 10 5f 4f 7a 54 74 0c 1d 37 0c 20 80 07 38 20 0f 18 1c 6e 86 88 19 1c 1c 08 10 9b 1d ff 6e 1f fa 90 6c c4 ee 98 4f 69 fd fb fb ff 6a 0a 3c 7e 06 17 00 28 18 e1 38 5e 06 37 15 e1 33 88 bf e4 8a c4 99 00 a0 0e 20 71 bd 15 99 a2 29 6e 43 98 2a 46 0a 44 f8 fe 14 27 cc f0 e8 14 Data Ascii: PNGIHDRNGiCCPICC ProfileHPSY{!%7-Z`#$B!Tl+"kdQ,,vdQPCow{wg,R`yR_OzTt7 8 nnlOij<~(8^73 q)nC*FD'
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: b6 51 b6 51 ad d1 63 63 b2 b1 bb 71 ba 71 b5 f1 5d 13 ac 09 c3 24 d9 64 9f 49 97 29 6c 6a 6f 9a 68 5a 61 7a db 0c 36 73 30 13 98 ed 33 eb 9e 87 99 e7 34 4f 38 af 7a de 3d 73 92 39 d3 3c cb bc d6 7c c0 82 66 11 68 91 6b d1 68 f1 da 52 df 32 c6 72 bb 65 bb e5 77 2b 7b ab 14 ab 43 56 8f ac 15 ad fd ad 73 ad 9b ad df da 98 da 70 6d 2a 6c ee da 92 6d 7d 6c d7 db 36 d9 be b1 33 b3 e3 db ed b7 bb 6f 4f b1 5f 60 bf d9 be d5 fe 9b 83 a3 83 d8 a1 ce 61 c4 51 df 31 d6 71 af e3 3d 06 95 11 cc 28 62 5c 77 c2 38 79 3a ad 77 3a ef f4 d9 d9 c1 39 d3 f9 94 f3 9f 2e e6 2e c9 2e c7 5c 86 e7 1b cd e7 cf 3f 34 7f d0 55 d7 95 e3 5a e5 da ef 46 77 8b 75 3b e0 d6 ef ae e3 ce 71 af 76 7f e6 a1 e7 c1 f3 38 ec f1 82 69 c2 4c 62 1e 67 be f6 b4 f2 14 7b 9e f5 fc c8 72 66 ad 65 5d f2 Data Ascii: QQccqq]$dI)ljohZaz6s034O8z=s9<\|fhkhR2rew+{CVspm*lm}l63oO_`aQ1q=(b\w8y:w:9...\?4UZFwu;qv8iLbg{rfe]
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: 73 68 6f 74 e4 83 85 26 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 01 d8 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 58 4d 50 20 43 6f 72 65 20 36 2e 30 2e 30 22 3e 0a 20 20 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3a 65 78 69 66 3d 22 68 74 74 70 3a Data Ascii: shot&pHYs%%IR$iTXtXML:com.adobe.xmp<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:exif="http:
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: 00 04 20 00 01 08 40 00 02 f9 41 00 e1 24 3f fa 99 56 42 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 0e 02 08 27 eb 80 c6 23 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 e4 07 01 84 93 fc e8 67 5a 09 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 c0 3a 08 20 9c ac 03 1a 8f 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 1f 04 10 4e f2 a3 9f 69 25 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 eb 20 10 85 93 be f1 85 0f 67 de bf 72 6b 4e 97 f6 97 99 65 32 19 6b 69 69 59 98 82 77 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 60 8f 13 40 38 d9 e3 1d 4c f3 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 58 3f 01 84 93 f5 b3 e3 49 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 Data Ascii: @A$?VB @ '# @ gZ@ @: @ @ Ni% @ @ grkNe2kiiYw @ @`@8L @ @X?I@ @
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: e9 a9 7d a5 66 99 4c c6 5a 5a 5a 96 cd 84 1b 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 60 2f 12 40 38 d9 8b bd 4a 9b 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 d8 14 02 cb 0b 27 6d 59 8f 93 12 3c 4e 36 85 34 99 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 eb 08 20 9c ec ba 2e a3 c2 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 dc 2b 02 08 27 f7 8a 34 e5 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 eb 08 ac 20 9c 74 24 c1 61 4b e6 08 0e bb eb ba 95 0a 43 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 b0 19 04 72 c2 c9 54 66 41 76 99 8f db 12 e1 a4 06 e1 64 01 18 de 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 3f 04 a2 70 32 84 70 92 3f 9d 4e 4b 21 00 01 08 40 00 Data Ascii: }fLZZZ @ @`/@8J @ @'mY<N64@ @ . @ +'4@ @ t$aKC @ rTfAvd@ @ ?p2p?NK!@
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: c9 72 c4 65 05 2c 47 bc 80 0c 6f 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 c8 1b 02 08 27 79 d3 d5 34 14 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 00 81 b5 12 40 38 59 2b 31 d2 43 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 37 04 10 4e f2 a6 ab 69 28 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 6b 25 10 85 93 c9 b9 a2 05 8f 66 ae 66 63 9c 94 12 e3 64 01 18 de 40 00 02 10 80 00 04 20 00 01 08 40 00 02 10 80 00 04 20 90 3f 04 10 4e f2 a7 af 69 29 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 6b 24 90 13 4e 0c 8f 93 35 a2 23 39 04 20 00 01 08 40 00 02 10 80 00 04 20 00 01 08 40 00 02 7b 9d 40 14 4e a6 3e 29 9c 74 ce a9 f1 a5 05 33 96 c9 64 ac a5 a5 65 af b3 a0 7d 10 80 00 04 20 00 01 08 40 00 02 10 Data Ascii: re,Go @ @'y4 @ @8Y+1C @ 7Ni( @ @k%ffcd@ @ ?Ni) @ @k$N5#9 @ @{@N>)t3de} @
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: 3c 64 87 0f 36 db be 9a 6a 7f ca a7 ff a8 0f b2 ac d6 2d 46 64 f3 50 1d 62 3d 66 dd ab 67 d6 fb 5a 53 a4 92 eb aa a3 5f f3 3e 4c c4 16 9f 42 35 e9 fd 1a a6 43 4d 85 6b ea a0 90 36 37 2f 4a de 37 3e 5d c9 c5 15 09 2d da 2b 2b 2b c3 fb a5 ea 1a cb 56 3e f1 7e 3c ea 1a 1b 04 20 00 01 08 40 00 02 10 80 00 04 20 90 5f 04 72 c2 49 c1 c2 1f 6c 33 4c d5 c9 af 81 b0 d3 5b 9b 36 66 e7 dc 68 9e 73 2f 85 de fe 01 9f 62 d3 6d ef 7c 78 cd de 7c ef aa 7d 78 be c3 2e 5f eb b1 91 d1 49 8f 35 e2 d3 70 94 2e 68 02 fe a2 63 50 06 92 96 46 23 7f a7 b7 7b 3b ea 17 90 09 56 72 22 15 22 08 11 ae 60 38 f7 39 2b f3 d8 2b d5 15 25 76 ec 70 9d 3d 78 e6 a0 7d f6 53 a7 5c 4c 69 b5 fb 4e 1d 0d 5e 20 c5 c5 25 a1 da 41 6c 70 97 94 98 cd 82 b6 44 cd 66 c1 c5 85 6f d4 47 7a 3a 1c d3 2e 3f Data Ascii: <d6j-FdPb=fgZS_>LB5CMk67/J7>]-+++V>~< @ _rIl3L[6fhs/bm\|x\|}x._I5p.hcPF#{;Vr""`89++%vp=x}S\LiN^ %AlpDfoGz:.?
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: 97 e2 3d 68 07 9b 1b ac a9 b1 ce 85 91 4a f7 18 28 b7 d2 92 22 9f 86 e1 8b f8 16 14 26 55 55 95 93 0c e7 ab be 54 33 d2 69 e2 fd 15 ae 25 4b f1 ba 27 83 0b 2d e3 1e 10 f7 ce c0 a0 af 2e 74 c7 ae b4 75 d8 c5 2b b7 ec 83 f3 b7 ec b2 4f 69 ba d5 e1 f1 37 5c 50 99 90 e0 a3 1a 78 9e c2 98 f6 8c 98 af d8 d6 9f 89 a9 56 90 76 cd c0 2a 4a 0b ac ae ba d4 7e ff 1b 4f db d7 7f e9 71 3b 79 a2 d5 a7 b2 d4 e5 2a b1 d7 05 82 e0 55 92 12 8b d2 62 4a 5f 5f bf c7 4d 19 f2 69 6a a3 56 5b 5b eb 62 5c 4d 98 ea 53 5a 5a 1a bc 54 42 a0 dd a0 e4 79 97 66 8f 39 70 9c 40 00 02 10 80 00 04 20 00 01 08 40 00 02 5b 42 00 e1 64 4b b0 92 e9 4a 04 64 28 06 e3 d1 0d 3f 1d 2f 5f b9 6a 6f bf 77 d1 fe f6 bb ef d8 2f de 6d f7 5f e2 c7 6c d2 97 89 d5 96 2c 27 bc 52 6e 1b bf 17 a7 89 cc cd cc Data Ascii: =hJ("&UUT3i%K'-.tu+Oi7\PxVvJ~Oq;yUbJ__MijV[[b\MSZZTByf9p@ @[BdKJd(?/_jow/m_l,'Rn
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: ab 3e dd 63 c2 3c 9c 51 10 29 82 50 11 5e 12 46 c9 fb f9 be d7 f2 d0 9a de 23 f1 49 cb 29 17 f9 79 a1 1f 75 2e 4f 91 42 77 23 09 bb bf d7 b3 8a b7 a1 eb a5 be 7c 73 79 99 4f 81 f2 8b fa af ac b4 38 2c c9 9c 71 31 a7 b9 b1 c6 1e 7b e8 a8 3d f1 e8 59 7b f2 f1 07 5d 38 29 09 05 86 b2 e7 8b e6 6c 8d 04 e4 8d a2 b8 28 ea ef 9e 9e 9e 20 9c 9c 3c 79 32 4c e7 49 8f eb bd 30 be d7 88 86 e4 10 80 00 04 20 00 01 08 40 00 02 10 58 35 01 84 93 55 a3 22 e1 46 09 2c 16 4e 62 8c 93 bf fc 87 97 3d c6 c9 bb d6 de de 6b fd 3e 5d 27 e3 86 f9 9c 5b cc 4a bf d5 5b ce 99 c1 8b 2a 75 83 bf d2 0d fb 2f 3c 7d d2 9e fd cc 7d f6 fc e7 1f f1 25 88 8f b8 27 46 a9 57 23 63 33 2e b2 28 bd 8c f9 68 74 ee 56 83 73 7a 7a 26 c4 c8 18 1d 1b b3 91 11 8f 2b e3 c2 46 51 51 51 10 3f 24 80 84 f6 Data Ascii: >c<Q)P^F#I)yu.OBw#\|syO8,q1{=Y{]8)l( <y2LI0 @X5U"F,Nb=k>]'[J[*u/<}}%'FW#c3.(htVszz&+FQQQ?$
2025-04-28 19:27:08 UTC	1460	IN	Data Raw: c8 52 b7 af d2 bd 56 7c fa 90 3c 59 1a f7 d9 81 e6 3a 3f 26 42 4b a3 8b 2c 0d ee d1 52 e6 d3 87 4a 4a 4b 83 68 a3 2c b3 c5 24 85 44 61 c5 df a5 fb cc df b2 ed 31 02 f1 b3 ab 66 25 cb 19 f7 07 01 45 e2 9a 02 c9 ea 33 1c 37 44 b6 48 82 23 04 20 00 01 08 40 00 02 10 80 c0 5e 25 80 70 b2 57 7b 76 9b db 25 c3 4b 7b 7f 7f 7f 30 bc 14 cb a4 a4 a4 d4 0e 1f 3e e4 53 53 2a dc b8 77 13 3f 2b 96 2c 55 d5 60 b0 fb 8d 99 e9 29 9b 9c 98 b0 37 df fd d8 a7 ef 9c b7 1f fe ec 9c 7d 70 fe b6 0d 8e 4c da 94 bb 4c 48 44 91 84 22 21 25 df b7 9c e0 b2 98 6b e8 0b a7 a3 63 8c c9 22 51 24 a3 d5 83 0a ac a4 28 63 e5 e5 25 41 60 69 f4 69 42 cd 8d 49 5c 96 23 1e f8 f6 d8 11 f7 0a 6a ae 77 cf 95 7a ab ab ad f2 e0 b7 55 ee f9 52 ec 2b af f8 ca 47 f2 4c c9 42 0f de 2a 3a d7 09 db 9e 21 Data Ascii: RV\|<Y:?&BK,RJJKh,$Da1f%E37DH# @^%pW{v%K{0>SSw?+,U`)7}pLLHD"!%kc"Q$(c%A`iiBI\#jwzUR+GLB:!
2025-04-28 19:27:10 UTC	656	OUT	GET /r67TJqIMUmFfgqyRt3O7jNnfghcL7o8b3EvTSsUc1u3Kw88aNcxPt8qBk1pHVBIVXVcgv2cLet-OTs-s6GSZR7FvvKOljG2-psavaPeVvVjBTfM6jky0KttZo94fWwEfWMl0jdH59mABu5t2OE2Eppj7F7Twik2i85uywOH1nWo7HH6PWw=w1468?key=a2w0Ouflou9v6-QeITM0Tg HTTP/1.1 host: lh3.googleusercontent.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0B sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 19:27:10 UTC	558	IN	HTTP/1.1 200 OK access-control-allow-origin: * timing-allow-origin: * access-control-expose-headers: Content-Length content-disposition: inline;filename="AF1QipMe7e2_CSO6_zii92So8KzDdINDmc5F-nkRgAfn=w1472-h368.png" x-content-type-options: nosniff server: fife content-length: 85499 x-xss-protection: 0 date: Mon, 28 Apr 2025 19:27:09 GMT expires: Tue, 29 Apr 2025 19:27:09 GMT cache-control: public, max-age=86400, no-transform etag: "v1" content-type: image/png vary: Origin age: 1 alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:09 UTC	309	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=swR12YcUgTmTcBT&MD=rlOZ+pv1 HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-04-28 19:27:09 UTC	541	IN	HTTP/1.1 200 OK cache-control: no-cache pragma: no-cache content-type: application/octet-stream expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT etag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" ms-correlationid: 88b29bca-dd1a-419d-91b9-bb4c69845f63 ms-requestid: 2dce1797-e551-45c1-adab-4a699624fde7 ms-cv: BgjXllHwp0qlvcGy.0 x-microsoft-slsclientcache: 2880 content-disposition: attachment; filename=environment.cab x-content-type-options: nosniff date: Mon, 28 Apr 2025 19:27:08 GMT content-length: 24490
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: c7 c3 8f 06 b6 24 05 3c f9 2c cb e0 99 86 1a f8 03 ca b3 04 d8 16 f0 f9 32 7f 28 14 e1 08 d8 03 b6 5f ca 00 2c ca e8 4f 1f 06 4e 31 f0 2f 3c 0e 0b 50 12 26 c4 00 85 7e 42 c0 00 c8 0f fa 0d c7 c3 a0 90 23 e5 21 63 33 1e a7 e6 2a f9 c3 ee 4b 69 ce 94 9b 68 c7 7b df ba c7 eb c3 55 b3 50 05 c8 b4 a7 ea a2 5e 5e cd 3a a2 aa 75 43 4b 97 f4 bd 25 ec 55 81 8f 48 6a d4 2b fb 61 52 86 d0 3b 01 14 b0 69 f4 31 7a b6 35 59 f1 51 9b 07 06 22 e9 3b 54 1f 1c 09 53 6c 08 99 9d 74 59 32 ad 33 42 5a f5 2c 05 bf b7 e9 cf 8f 5d 2c 89 c9 8a 5f 6c 65 4c 0c 6d 6a 3f 83 6c b8 bf a3 10 39 92 ad fd bc d8 94 f7 ca 6b ef 90 4b eb 87 76 34 1d 50 f6 0b 7d 4a 62 19 4b 92 ae d4 3f 79 3c 37 e1 2d 6c bc f7 fc 95 94 bd 9c f5 56 86 da 39 b9 b3 67 4c 1a 17 d4 27 59 97 fa bb 03 e7 1b 32 9c 5f Data Ascii: $<,2(_,ON1/<P&~B#!c3*Kih{UP^^:uCK%UHj+aR;i1z5YQ";TSltY23BZ,],_leLmj?l9kKv4P}JbK?y<7-lV9gL'Y2_
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: 99 5f f0 57 d3 49 7b b2 e4 e5 c0 9e f2 e2 b5 17 92 26 2b c1 a3 c2 60 60 5d 36 2c de 60 61 ea e8 98 df 55 7a a8 91 e4 a9 84 e0 3b 6e 95 89 91 fc a7 0f 95 af 35 36 d1 a7 99 9e 88 5e 1c 90 6f 76 55 35 c9 a6 7b 9c 57 31 1c 7d 98 8c a5 d0 5c 66 01 23 08 79 a0 ac fd 28 e3 66 c4 5d bc 06 ed c2 ac 2e 85 85 1d 2c f9 63 f9 ae 62 0a e0 dc fd 65 e4 07 da 27 83 27 db 54 2f 30 4f ab 57 35 d0 e3 25 bc 3a 8a 0f 18 ab 06 65 1d c3 c6 d7 dc 20 e5 92 42 df 59 3a dd 99 b4 1e 33 04 f5 9c 31 69 0f ec 13 9b b8 7c 93 51 3a 5b 90 33 78 d9 c2 f9 a0 e5 54 1d b7 41 12 7c ea 48 f9 8b 32 9d cb 22 59 19 02 65 dd 61 fc 1e b6 2d 6d 85 1b 49 c9 9e 9d a6 e3 15 82 bd e8 4e 07 0a 96 41 09 6c 7a 91 fe 23 c6 ec 81 c3 34 b3 bc bd 6d 1b a2 f9 9d 9a 55 ad 27 0b b3 da 0d 82 7c 98 8d 2d 3b d6 c6 13 Data Ascii: _WI{&+``]6,`aUz;n56^ovU5{W1}\f#y(f].,cbe''T/0OW5%:e BY:31i\|Q:[3xTA\|H2"Yea-mINAlz#4mU'\|-;
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: 2d 5f d0 00 d0 07 f4 72 f6 e6 e8 44 69 fd 25 5f 10 dc 3f 70 f7 40 41 25 f8 69 80 38 20 27 0e a0 36 fd 40 ab 6d 7e e0 7e 60 1f a0 bb cd 0f 54 fd d7 fc c0 df e9 fb c7 c8 07 c3 96 47 48 09 90 7f f5 08 49 7f e5 05 82 72 c3 a4 de 98 91 55 c3 ea 10 ce a3 13 c3 f7 12 97 f6 c4 ce d7 c2 d9 28 f3 83 ce ec 99 14 4b d4 be 03 9e 48 26 e8 06 e4 1c e3 a4 41 09 dd e2 d3 84 db 86 e8 d2 f6 fb 0d f2 bb 63 cb fd 6b 48 cc 83 a9 85 16 0a 62 17 34 a2 dc b2 5c 8e 5a 11 11 25 46 bc 99 aa 15 3b c9 46 0f 5f 5e b9 9a fd a8 03 36 50 d9 0b 10 d7 86 2a ed 8c d3 6e 1f ed e9 f0 96 84 f7 3b dc 1d 9e 09 6e c5 df da 17 74 23 13 af d2 ac 85 dd 4d 74 ea 15 fd 52 cf 64 7f b7 fa f3 19 03 d1 3c 1d f9 9e 49 c6 ae 97 08 66 b1 ba 94 91 c7 2a c7 ee c7 ef 55 45 e4 5e a7 ed 2e 5d 46 59 44 0d 4b 8d 93 Data Ascii: -_rDi%_?p@A%i8 '6@m~~`TGHIrU(KH&AckHb4\Z%F;F_^6Pn;nt#MtRd<IfUE^.]FYDK
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: f4 d2 5b 0d c4 46 f4 08 0d 64 b7 dd 0e 23 c4 4a be c6 2c 08 e4 15 96 43 0e 90 12 6e 83 93 e4 22 73 bf 9c 43 a3 72 7e 18 32 1c 87 83 10 55 1d 3d 13 70 78 a0 df ea 3e bc 8f 9c f3 c9 cd b2 63 9f 56 68 27 2f ce f2 f7 d1 be 1e 37 ef db 07 4d 38 19 d3 72 07 4b 21 bd e4 5a 22 2f df 9c d9 42 cd 28 ce 46 7d 02 5e c0 3a 7d 59 8f ba 2b d9 8a 6a ee ee 00 2f 1d b9 28 fd 40 78 e3 bc e0 27 36 dd fd 43 d9 6a 3e 0d 73 ca 91 ee 0f 3d a6 1a b5 25 8c d1 15 8a d7 f8 93 2e 54 ac df 56 e1 7f ed 19 54 17 27 34 90 14 e3 70 8c 6c 7f ff 7e 4f 51 14 1e 4e 05 72 47 b2 4d 89 4e f9 67 77 f4 77 a9 eb f6 50 12 1e aa 0b b0 6d 8f 25 51 7d 17 52 f8 55 b8 68 f5 90 ab 07 5f 36 1f f1 e4 1e e5 fb f3 73 97 9a e6 1d ab bb ee b9 59 5a f2 3c e8 6d 9f be 51 7b 02 c0 7d d8 d6 01 4c 12 85 7b 05 e0 5e Data Ascii: [Fd#J,Cn"sCr~2U=px>cVh'/7M8rK!Z"/B(F}^:}Y+j/(@x'6Cj>s=%.TVT'4pl~OQNrGMNgwwPm%Q}RUh_6sYZ<mQ{}L{^
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: 17 7a 50 e3 3d 37 50 78 c6 9b 00 9e b1 6c 93 1f 64 fc 47 28 e5 6f 7b 2c 3f 66 9c 1b c0 91 91 7f f1 eb 59 11 28 38 61 06 ff bf 92 d0 14 5f 4d 0f e8 d9 e9 00 5a 30 6e 48 2f 23 03 13 4d 57 f0 f8 e5 8d 51 9b 88 0d f9 1d 57 58 98 cf e8 0b 8c f6 eb 9c da ff e4 4a 13 15 29 0c 69 75 94 79 e3 95 50 e5 48 e0 90 99 54 fe c5 90 26 13 97 27 85 89 ed 99 b4 32 69 b3 23 07 e3 9e fb e7 e2 e9 27 ff d9 3c 6e 78 48 c3 3d 4c b0 78 83 47 97 43 99 4b fa 65 6a 2b a5 20 16 23 d3 dd e2 46 1d 6b 79 16 e2 7b e7 3e e7 71 eb 7f c8 e3 4a 49 a0 64 7e e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 ff ab f3 b8 5d a3 0e 92 5e 1d d9 33 07 9d b4 5a 5b 1f 36 94 07 fb 31 44 46 72 24 1d af 77 ba 94 e6 6b df 96 Data Ascii: zP=7PxldG(o{,?fY(8a_MZ0nH/#MWQWXJ)iuyPHT&'2i#'<nxH=LxGCKej+ #Fky{>qJId~qqqqqqqqqqqqqqq]^3Z[61DFr$wk
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: 72 61 74 69 6f 6e 73 20 50 75 65 72 74 6f 20 52 69 63 6f 31 16 30 14 06 03 55 04 05 13 0d 32 33 30 38 32 39 2b 34 35 34 32 33 37 30 1f 06 03 55 1d 23 04 18 30 16 80 14 ad 94 76 8f 83 ad 0e 03 a3 e8 3b b0 d7 34 68 d4 79 3a 7d dc 30 60 06 03 55 1d 1f 04 59 30 57 30 55 a0 53 a0 51 86 4f 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 72 6c 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 70 64 61 74 65 25 32 30 53 69 67 6e 69 6e 67 25 32 30 43 41 25 32 30 32 2e 31 2e 63 72 6c 30 6d 06 08 2b 06 01 05 05 07 01 01 04 61 30 5f 30 5d 06 08 2b 06 01 05 05 07 30 02 86 51 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 65 72 74 73 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 Data Ascii: rations Puerto Rico10U230829+4542370U#0v;4hy:}0`UY0W0USQOhttp://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl0m+a0_0]+0Qhttp://www.microsoft.com/pkiops/certs/Microsoft%20U
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: 6c d5 21 c9 b8 50 68 05 c3 e4 09 c9 bd 51 c9 5f 6d 75 4f 8d 35 30 c5 8c c1 83 b2 1f 93 b5 72 6f d2 44 90 1d ed 7f 13 a9 7d 53 24 9c aa 46 c0 8f c5 c5 be bf c8 55 14 fe 87 35 fe cd d5 7e 02 d2 87 68 00 c9 b8 d7 44 cb 71 db a4 8b b3 e0 0e a6 0b ce 12 7d f6 68 dc c0 91 31 f8 59 2c 2c f5 d5 d1 2e 08 9d 2b 30 6a 6e aa ad 9e 16 4e 27 d0 ba 3b 1a 81 30 43 38 92 87 e1 6c 6f 43 3d 2d 4e 1f 0d 10 c1 f8 fa bc 84 c8 93 c3 9e 47 fc b6 fa d1 2f b6 af 39 3e 9c 3f 1c f1 4d a4 16 d3 0a e2 e7 4e f5 37 88 03 46 8e 1e cc 77 c1 47 d3 44 b7 e4 35 23 db eb 20 cb 2a f5 57 ae 2e 00 3b 6b e6 a3 6e 05 99 70 bb 76 3b d8 3c b4 76 f6 28 15 3a 25 d4 26 a4 08 9f d9 7e 7b 44 8a b7 15 8a c6 c5 78 2a 9d 32 c4 83 7b b9 6e 42 14 99 5d 49 7f 45 99 57 a7 33 77 44 1a ff 47 a3 71 b7 b0 b1 56 8a Data Ascii: l!PhQ_muO50roD}S$FU5~hDq}h1Y,,.+0jnN';0C8loC=-NG/9>?MN7FwGD5# W.;knpv;<v(:%&~{Dx2{nB]IEW3wDGqV
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: 42 06 0a 2b 06 01 04 01 82 37 02 01 0c 31 34 30 32 a0 14 80 12 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 a1 1a 80 18 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 04 82 01 00 3d cd 0e 0a 7b 43 82 69 14 76 9b c2 1b 25 6c 3f 01 d0 b8 bb 6f e9 4d 62 55 f3 7a 5b c4 05 04 2e 09 48 41 fd e9 13 24 1e f0 71 f0 79 9e 8e a7 ea d7 72 49 9f 71 e8 41 4c 0a 8e 69 71 3c 8f e9 56 c5 9d a0 e6 3c df 48 88 1c cf 7f eb a0 34 f3 ff 37 ca 6d 9f c7 86 eb 12 35 0a 45 a5 81 a8 f8 53 6d c6 11 4e ef 37 77 2a 73 bf 08 f9 ee ba 8d b8 48 1a 93 32 44 3a cd 7c 41 2d e3 20 7e 34 a2 7c 2b 93 92 2f 0a 5f 17 c8 65 98 79 74 bb e7 1c 1a e2 6c a4 15 db cf ae 5b 18 f9 9a 82 ab 98 f5 13 93 f3 0f 89 71 a4 2f c0 7e Data Ascii: B+71402Microsofthttp://www.microsoft.com0H={Civ%l?oMbUz[.HA$qyrIqALiq<V<H47m5ESmN7wsH2D:\|A- ~4\|+/_eytl[q/~
2025-04-28 19:27:09 UTC	1460	IN	Data Raw: a3 82 01 1b 30 82 01 17 30 1d 06 03 55 1d 0e 04 16 04 14 ec 97 76 68 29 fe 13 4f cd 74 c6 25 18 f2 00 7c da 7d d7 a7 30 1f 06 03 55 1d 23 04 18 30 16 80 14 d5 63 3a 5c 8a 31 90 f3 43 7b 7c 46 1b c5 33 68 5a 85 6d 55 30 56 06 03 55 1d 1f 04 4f 30 4d 30 4b a0 49 a0 47 86 45 68 74 74 70 3a 2f 2f 63 72 6c 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 72 6c 2f 70 72 6f 64 75 63 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 6c 30 5a 06 08 2b 06 01 05 05 07 01 01 04 4e 30 4c 30 4a 06 08 2b 06 01 05 05 07 30 02 86 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 65 72 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 74 30 0c 06 Data Ascii: 00Uvh)Ot%\|}0U#0c:\1C{\|F3hZmU0VUO0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:10 UTC	556	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 host: play.google.com accept: / access-control-request-method: POST access-control-request-headers: content-encoding,content-type,x-goog-authuser origin: https://docs.google.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-fetch-mode: cors sec-fetch-site: same-site sec-fetch-dest: empty referer: https://docs.google.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 19:27:10 UTC	527	IN	HTTP/1.1 200 OK access-control-allow-origin: https://docs.google.com access-control-allow-methods: GET, POST, OPTIONS access-control-max-age: 86400 access-control-allow-credentials: true access-control-allow-headers: X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin content-type: text/plain; charset=UTF-8 date: Mon, 28 Apr 2025 19:27:10 GMT server: Playlog content-length: 0 x-xss-protection: 0 x-frame-options: SAMEORIGIN alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:11 UTC	1010	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 host: play.google.com content-length: 1704 sec-ch-ua-platform: "Windows" content-encoding: gzip user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" content-type: application/binary x-goog-authuser: 0 sec-ch-ua-mobile: ?0 accept: / origin: https://docs.google.com x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjA2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE= sec-fetch-site: same-site sec-fetch-mode: cors sec-fetch-dest: empty referer: https://docs.google.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: NID=523=pz6PJd526QDGhTRyiDyNmwleHHJV_1UH-piKCHsuqrfX401plnh6itUlvxM47wnfX69tZ6hfpsrZ1vEsN4P5R9HHd6oIy3lfAuiqA-0nSSWmgAOHdIfsBGdbE2aLxVl9pguMAQXDTDVX8qVTC9nTjUgQsdRGTSzWHez4ZOxbwED_BAwm4jGZxU3EjfH_njYfTDrvJ3s priority: u=1, i
2025-04-28 19:27:11 UTC	1460	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a b5 d8 5b 4f 56 57 1a 00 e0 bf 42 b8 6a 93 0d be e7 43 7a 65 da 5a b1 a0 53 a1 c3 64 3e be 18 54 54 22 15 8a 3a 5a 7f fd e4 5d 07 a4 60 a7 9d 8b 86 84 f5 7c 6b bf eb bc 4f 6b af 56 b8 bc 79 7f 76 f6 97 ff ad be 94 b9 79 f2 66 f3 cb d1 b2 c0 7a bd 5e 08 58 97 d5 6a 13 5d 34 2c 84 92 04 bf 5c e4 5a ad ab d5 b5 d6 70 b9 5e 18 00 e0 56 63 ab 9b 11 eb 51 74 a4 8e 76 55 d7 7a bd ac 8e 36 bf dd 7b f4 de 9f ff 6a 5b f2 e1 bb 7b 8f 79 67 ff e5 dd e7 70 70 2e 3f bd 3c da bc dd de 55 86 01 04 87 2f 47 9b 77 bf bb f7 70 eb d9 bb 77 87 7b 3b be f7 fc e2 fb 07 f7 e9 f2 c1 7f 3e f2 f1 db 83 fc 25 3f be da db c2 bd f3 87 7b 87 a9 af 5f 3d f9 e7 3f de ff f6 bd ff fb c5 fe b3 9d 7f e5 23 e4 ad b3 fd dd 97 ef 9f 79 de db fb f4 db cb 9d a3 31 21 Data Ascii: [OVWBjCzeZSd>TT":Z]`\|kOkVyvyfz^Xj]4,\Zp^VcQtvUz6{j[{ygpp.?<U/Gwpw{;>%?{_=?#y1!
2025-04-28 19:27:11 UTC	244	OUT	Data Raw: ff 8e 36 4f ee e0 bd bb 3b 17 3f ed ee 9f 7c 38 c7 bb 8f 9f 1e 3e 79 b4 b7 ff c3 a7 5f f7 1e 1f 3c de dd dd dd 3b d8 c1 d7 4f b7 3e e9 cf af 9e e8 db e3 fb 97 b2 b3 f3 f3 83 cb bc f7 e1 68 b3 ef 7b 8f 2f 2e de 6e bd 38 bf fc e5 ed f6 8b cb 93 93 a7 a7 97 cf 9f 10 90 82 a0 6e 03 3d b9 c0 a3 cd f5 b2 c2 e5 68 b3 b6 99 f5 03 17 5a 3e 6f b0 b9 de c2 af 6f 89 2b 03 ff 67 86 b0 83 dc c8 a0 df 47 28 e9 9f 64 d4 7b f5 cd 08 bd 19 61 d7 33 b4 ae df df 65 88 03 de fe 7a d0 17 f2 66 ef 61 a1 c5 50 11 af ef 82 ff f2 5a 07 26 2d 72 6b 03 fd c7 9f 54 6e 7d 8c 81 da 6d cf 2d f8 4c 57 2b 58 df aa 74 75 b3 57 2b ac b2 7d 44 ed 15 16 c1 4c a9 3e 8b 5c d5 b7 5e af ff ec 2b 0c 8a fc c1 64 8d 53 7f bd dc f8 ac b3 fe 2f e6 fa 91 76 55 12 00 00 Data Ascii: 6O;?\|8>y_<;O>h{/.n8n=hZ>oo+gG(d{a3ezfaPZ&-rkTn}m-LW+XtuW+}DL>\^+dS/vU
2025-04-28 19:27:11 UTC	903	IN	HTTP/1.1 200 OK access-control-allow-origin: https://docs.google.com cross-origin-resource-policy: cross-origin access-control-allow-credentials: true access-control-allow-headers: X-Playlog-Web set-cookie: NID=523=O2U7WqtS1sUCCgScUoRKLRNIuBBGSRrxQXKqMHiKDoVXoAN8_fKeGNL_jO6qglmOuPwJOgSUpFndy2kwZmTXE_nmiME16z1Me0gpvSpay01K__Zh_Dl34vq8hQSD2lqeNNoNMxQwtTeZQxRiEZ--Li5iwJ8Yr_NmN_Krj_7GXQtFX9RnhRaX8I7suJN6-SKbYG6WUzo; expires=Tue, 28-Oct-2025 19:27:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info." content-type: text/plain; charset=UTF-8 content-encoding: gzip date: Mon, 28 Apr 2025 19:27:11 GMT server: Playlog content-length: 131 x-xss-protection: 0 x-frame-options: SAMEORIGIN alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires: Mon, 28 Apr 2025 19:27:11 GMT cache-control: private
2025-04-28 19:27:11 UTC	131	IN	Data Raw: 1f 8b 08 00 00 00 00 00 02 ff 3d 8a 31 0a c3 30 0c 45 ef a2 59 01 db b2 31 e9 a6 34 19 4a 69 52 6c 75 28 42 f8 02 21 5b a7 d2 bb 37 81 d2 37 7d de 7f 0a 9d 07 dc 5e eb 8a aa 0a 3c 8f 65 b9 8c 6d e0 f3 f5 71 07 74 86 0a 03 8b 4c e5 d9 aa b0 d4 9f ab 37 2e d2 ea 24 ff 4a ca 32 1f d3 b0 23 a2 98 29 a7 3e ba 10 fb ec 43 48 7b 61 f8 06 9f 53 a0 e3 82 93 7a b7 63 1f fb 02 0a fb aa a7 83 00 00 00 Data Ascii: =10EY14JiRlu(B![77}^<emqtL7.$J2#)>CH{aSzc
2025-04-28 19:27:13 UTC	1010	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 host: play.google.com content-length: 2039 sec-ch-ua-platform: "Windows" content-encoding: gzip user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" content-type: application/binary x-goog-authuser: 0 sec-ch-ua-mobile: ?0 accept: / origin: https://docs.google.com x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0BCL7VzgEIgNbOAQjA2M4BCMjczgEIiuDOAQiu5M4BCIvlzgE= sec-fetch-site: same-site sec-fetch-mode: cors sec-fetch-dest: empty referer: https://docs.google.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: NID=523=O2U7WqtS1sUCCgScUoRKLRNIuBBGSRrxQXKqMHiKDoVXoAN8_fKeGNL_jO6qglmOuPwJOgSUpFndy2kwZmTXE_nmiME16z1Me0gpvSpay01K__Zh_Dl34vq8hQSD2lqeNNoNMxQwtTeZQxRiEZ--Li5iwJ8Yr_NmN_Krj_7GXQtFX9RnhRaX8I7suJN6-SKbYG6WUzo priority: u=1, i
2025-04-28 19:27:13 UTC	1460	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a ed 99 59 6f 15 47 16 c7 bf 8a 75 9f 12 a9 6d ce be 4c 9e 98 24 24 4e 30 99 00 19 46 73 7d 85 58 0c 58 2c 26 06 06 c2 a7 1f 9d 5a 8c 31 10 70 34 c9 bc 20 4b ae 5f 57 9f a5 ea 5f d5 d5 55 7d d7 6b 5c 9e bc 78 f4 e8 93 ff ad df 57 b9 3a 78 b2 7a c7 70 bd 5e 7d fd e0 f8 e8 f1 e1 8b c7 ab 65 85 2c ab cd b2 5e 5d 39 7a fe b7 8b db 7f 3f be f5 e4 ee 6a 59 51 af fc ee e8 e8 fe a3 83 ad 66 7e 30 8d 37 0b 2c ab 1b 87 4f ee 1e bd 7c 56 75 b0 03 3b b0 5a 56 af c2 56 cb aa 5b ed c0 8e 65 c6 0e 5b c5 91 05 36 9b cd 42 c0 ba ac d7 2b 74 d1 b0 10 26 12 7a a7 7d 67 bb b0 5e af 65 68 41 cb 74 a5 24 0f 00 a8 de 20 05 2c 91 be 34 c8 90 6a e0 9b 00 1f d3 11 3e 49 5d 58 70 73 be 01 79 6f ae 3f 12 63 fd 87 32 af 61 b3 99 7d 5f af cf ea 36 22 ce c8 Data Ascii: YoGumL$$N0Fs}XX,&Z1p4 K_W_U}k\xW:xzp^}e,^]9z?jYQf~07,O\|Vu;ZVV[e[6B+t&z}g^ehAt$ ,4j>I]Xpsyo?c2a}_6"
2025-04-28 19:27:13 UTC	579	OUT	Data Raw: 14 cd d7 18 49 f1 84 5a 36 0b cb 9e ad 28 5a eb 6b 45 82 66 e7 5a 1f b3 8b 02 ea 7d 32 49 5a e4 c0 a8 d7 c9 a0 61 47 4c c1 93 b2 45 89 44 67 98 d4 7d 93 c8 ba ce 45 e4 83 6a cb 33 a9 65 cb 9a af 36 09 ab 1f 04 0c d6 fa db a8 f5 97 a0 ed 87 26 65 f5 83 90 b9 b6 5e 93 b2 d3 18 a3 46 6d 8c 08 45 11 7d 12 e9 a0 88 13 ca 6e a7 09 27 d4 15 22 34 54 f1 49 da 3d 6a 23 42 93 5a cf a9 35 ab 79 90 d4 da 36 89 9b 6f bd 6a 03 4e 28 1a 19 b8 e1 24 ef 76 01 3e ee 06 78 96 2e c4 2d f7 24 6a 0a b1 b0 f4 78 8d 9a 87 00 d5 83 de 29 a0 c5 ab b5 59 73 92 49 27 ef a3 d5 a9 f9 2a d6 56 66 92 50 27 af 9d d9 a4 16 45 45 bd 8f 4c 51 1f 19 43 cc 36 e6 8d da b3 40 86 ae 5d e7 22 e6 4e e1 16 93 bc 7b 38 d7 d2 58 14 2a 7d b4 1a 75 bb 04 33 38 a1 51 c7 6c 3a a9 b7 c0 5d ea 3d 38 a8 3d Data Ascii: IZ6(ZkEfZ}2IZaGLEDg}Ej3e6&e^FmE}n'"4TI=j#BZ5y6ojN($v>x.-$jx)YsI'VfP'EELQC6@]"N{8X}u38Ql:]=8=
2025-04-28 19:27:13 UTC	449	IN	HTTP/1.1 200 OK access-control-allow-origin: https://docs.google.com cross-origin-resource-policy: cross-origin access-control-allow-credentials: true access-control-allow-headers: X-Playlog-Web content-type: text/plain; charset=UTF-8 content-encoding: gzip date: Mon, 28 Apr 2025 19:27:13 GMT server: Playlog content-length: 131 x-xss-protection: 0 x-frame-options: SAMEORIGIN alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
2025-04-28 19:27:13 UTC	131	IN	Data Raw: 1f 8b 08 00 00 00 00 00 02 ff 3d 8a 31 0a c3 30 0c 45 ef a2 59 01 db b2 31 e9 a6 34 19 4a 69 52 6c 75 28 42 f8 02 21 5b a7 d2 bb 37 81 d2 37 7d de 7f 0a 9d 07 dc 5e eb 8a aa 0a 3c 8f 65 b9 8c 6d e0 f3 f5 71 07 74 86 0a 03 8b 4c e5 d9 aa b0 d4 9f ab 37 2e d2 ea 24 ff 4a ca 32 1f d3 b0 23 a2 98 29 a7 3e ba 10 fb ec 43 48 7b 61 f8 06 9f 53 a0 e3 82 93 7a b7 63 1f fb 02 0a fb aa a7 83 00 00 00 Data Ascii: =10EY14JiRlu(B![77}^<emqtL7.$J2#)>CH{aSzc

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:11 UTC	996	OUT	GET /forms/d/e/1FAIpQLSewo1ARbW_OMSGzqMRTRLLLMTI1kb-z5Uh_5saHr4IIUJr9Fw/font/getmetadata HTTP/1.1 host: docs.google.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / x-client-data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJKhywEInP7MAQiFoM0B sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: S=spreadsheet_forms=Waou9Rj2yWT17Su6INnsQnvywPrKwb59H9Gtdmxc-Yg cookie: COMPASS=spreadsheet_forms=CjIACWuJV18oDmzCRJwuISfArnX1zOeSruvOWXfT6lbQkBx3L2AoBHHaE5lk4DnN71GcBRCayb_ABho0AAlriVcwLzN8_0m3L_v8lk1MlOKwqOmsZXo-Ldf4Kz_h9dsNASuyiT0CTkQWYib-byu7bA== cookie: NID=523=pz6PJd526QDGhTRyiDyNmwleHHJV_1UH-piKCHsuqrfX401plnh6itUlvxM47wnfX69tZ6hfpsrZ1vEsN4P5R9HHd6oIy3lfAuiqA-0nSSWmgAOHdIfsBGdbE2aLxVl9pguMAQXDTDVX8qVTC9nTjUgQsdRGTSzWHez4ZOxbwED_BAwm4jGZxU3EjfH_njYfTDrvJ3s priority: u=1, i
2025-04-28 19:27:11 UTC	1166	IN	HTTP/1.1 400 Bad Request cache-control: no-cache, no-store, max-age=0, must-revalidate pragma: no-cache expires: Mon, 01 Jan 1990 00:00:00 GMT date: Mon, 28 Apr 2025 19:27:11 GMT content-type: text/html; charset=utf-8 x-chromium-appcache-fallback-override: disallow-fallback content-security-policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt content-security-policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-QuOSNRXhDOfYhZO6Rkdg6Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' origin-trial: AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0= referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-xss-protection: 1; mode=block server: GSE alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 accept-ranges: none vary: Accept-Encoding content-length: 3035
2025-04-28 19:27:11 UTC	1460	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 62 20 77 6f 72 64 20 70 72 6f 63 65 73 73 69 6e 67 2c 20 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 20 61 6e 64 20 73 70 72 65 61 64 73 68 65 65 74 73 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6c 69 6e 6b 20 Data Ascii: <!DOCTYPE html><html lang="en"><head><meta name="description" content="Web word processing, presentations and spreadsheets"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=0"><link
2025-04-28 19:27:11 UTC	1460	IN	Data Raw: 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 31 36 78 34 31 64 70 2e 70 6e 67 29 7d 7d 73 65 6e 74 69 6e 65 6c 7b 7d 3c 2f 73 74 79 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 36 71 41 63 67 78 68 49 54 47 74 37 44 69 31 6d 78 45 75 68 44 67 22 3e 62 6f 64 79 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 7d 61 2c 20 Data Ascii: /ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_116x41dp.png)}}sentinel{}</style><style type="text/css" nonce="6qAcgxhITGt7Di1mxEuhDg">body {background-color: #fff; font-family: Arial,sans-serif; font-size: 13px; margin: 0; padding: 0;}a,
2025-04-28 19:27:11 UTC	115	IN	Data Raw: 20 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 30 70 78 3b 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 34 30 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 74 6d 6c 3e Data Ascii: {margin-bottom: 20px; margin-left: 40px; margin-right: 40px; margin-top: 80px; position: relative;}</style></html>

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1586)
Category:	dropped
Size (bytes):	219159
Entropy (8bit):	5.574204583772786
Encrypted:	false
SSDEEP:	3072:kmk1EhiirJl4A1xixO0fEVmFFDtttLm+Tu8kN3Y14EtB:2iFJ1YdfEVmdttLm+Su4GB
MD5:	6869145D425D55DED1551E03B8446C8E
SHA1:	A9C80BF1F7778248C8334E003E6CB94742C00D15
SHA-256:	C9620FF579BA2FE981D3BBE11547F0AC5ED9FB1F0E928A27B29C24CFA4F8E2D0
SHA-512:	82A39010914A31374779F30AAA88DF9C6D03F618D085B47ED5EAB18C1294C1812078FA4791F89B982191CA201609A4DD8B9746B7D64CD405C45CF91402AFAC9A
Malicious:	false
Reputation:	low
Preview:	"use strict";this.default_v=this.default_v\|\|{};(function(_){var window=this;.try{._.qt(_.sz);.}catch(e){_._DumpException(e)}.try{._.q("vGOnYd");.var gXb=function(){this.type=1;this.view=null},tY=function(){_.Qu.call(this)};_.B(tY,_.Su);tY.ya=_.Su.ya;tY.prototype.j=function(){return _.Js()};tY.prototype.start=function(){return new gXb};tY.prototype.cancel=function(){};tY.prototype.render=function(){return _.Ks(Error("rf"))};_.Uu(_.PBa,tY);._.u();.}catch(e){_._DumpException(e)}.try{.var sKa;_.rKa=function(a,b){if(a!=null)if(typeof a==="string")a=a?new _.fc(a,_.Xh):_.Yh();else if(a.constructor!==_.fc)if(_.eb(a))a=a.length?new _.fc(new Uint8Array(a),_.Xh):_.Yh();else{if(!b)throw Error();a=void 0}return a};sKa=function(a){return _.rKa(a,!0)};_.tKa=function(a,b){return _.Bc(a.Ba,void 0,b,void 0,sKa)};_.HB=function(a,b){a=_.tKa(a,b);return a==null?_.Yh():a};_.uKa=function(a){this.Ba=_.n(a)};_.B(_.uKa,_.D);_.IB=[1];_.JB=function(a){this.Ba=_.n(a)};_.B(_.JB,_.D);_.JB.prototype.setBooleanValue=f

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	29649
Entropy (8bit):	5.545452104367033
Encrypted:	false
SSDEEP:	768:V/hSTO+MerX/+QBUHNieLZD4EFRPRYHBCu4utyiVVl:V/kTf
MD5:	2241684F5D8066C120792F3514BE8163
SHA1:	5FE694D0737BEB7C2661848FFEA58170952CDECF
SHA-256:	4B13C0BDCD4FEECF3B5CB1084A565C6800A7BCB38AAF6B2C8CAA9125E0635E89
SHA-512:	59F9430FDB880DD1748D8DDBAC515833C1C1E71AD3A3CD11092D85A72E1926700EF5867C9413E36CE8EC85046F707D781FD0BC4AA44EBD6FB3D96E9DE78A4BE1
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Google+Sans_old:400,500\|Roboto_old:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (527)
Category:	downloaded
Size (bytes):	564443
Entropy (8bit):	5.562286183656068
Encrypted:	false
SSDEEP:	6144:RzIesVKgWKiMrVhiFl0xBIkWTJQIKF9CR7w:N2KfWWuCC
MD5:	24B29A060FED208B769916070AC62AE2
SHA1:	657F308E4528EDDFF8F1559E22AEF0248CF3A5CD
SHA-256:	C75FDAF9C258F599608FC0D811ADEC767D85B005F47B9D2631B3B1DEB5158002
SHA-512:	8156D341BD3CBE3B7FE0E00134E146C3BCB81355FF20F40ABFDAAB68C3C75312CFD5F86FEBB28FF0401B8E8B1CCEC30A1148E78C092BE912F36488657648076C
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/_/freebird/_/js/k=freebird.v.en.csXQcWpgWIA.O/am=ABg/d=1/rs=AMjVe6gryZPNvRtiLBHf9dKgm9c7xkP50g/m=viewer_base
Preview:	"use strict";this.default_v=this.default_v\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x1800, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC All Rights Reserved... Use of this source code is governed by an MIT-style license that can be. found in the LICENSE file at https://angular.dev/license././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aaa,qa,ta,caa,daa,eaa,faa,ya,gaa,jaa,kaa,naa,taa,gb,vaa,yaa,zaa,Daa,Eaa,ub,Iaa,Laa,Faa,Gaa,Oaa,Paa,Fb,Raa,Taa,Uaa,Vaa,Qaa,Waa,cba,dba,eba,fba,gba,hba,Ub,iba,$aa,jba,Sb,aba,bba,lba,oba,rba,ec,tba,vba,wba,xba,Aba,yba,

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:27:47 UTC	309	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=swR12YcUgTmTcBT&MD=rlOZ+pv1 HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-04-28 19:27:47 UTC	541	IN	HTTP/1.1 200 OK cache-control: no-cache pragma: no-cache content-type: application/octet-stream expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT etag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" ms-correlationid: 5f65cfd1-1a34-4ade-9062-1325640c57b4 ms-requestid: bfbad2fa-92ed-41df-99a4-0b555dbaed4e ms-cv: otbaeRVL/UaR9PZp.0 x-microsoft-slsclientcache: 1440 content-disposition: attachment; filename=environment.cab x-content-type-options: nosniff date: Mon, 28 Apr 2025 19:27:46 GMT content-length: 30005
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 25 dc 93 6a 9f d2 e0 c1 ea a0 79 31 c4 ab 34 9c e1 43 a8 b3 7e 55 3a 43 6e 5b 8c bc 1c ac b5 c5 db f6 d5 6b 9a 98 b7 61 91 ec 20 ed 8b 6b 6b 17 65 25 d4 6a aa b6 ca 84 bd 36 98 48 0e 5e cd 7c b0 80 4f 8a 29 1a bd 79 0a 95 15 94 2c 8d 46 d3 90 66 2a a1 20 71 50 9b 63 14 ba 66 53 25 93 57 c9 de 70 e3 0a f9 95 e5 f6 30 46 8b 99 e7 52 08 31 34 2a fb 7b 19 1f 7d d2 b0 1d 12 db 90 d7 13 2b 94 d3 2c 24 3c da 5c c7 eb 72 6a b9 b9 58 16 5c 90 d7 e5 cd 92 95 32 0d 6b cf 04 8d 4e 78 08 6b 05 10 2b 3f 35 f1 9b 05 cf 25 b3 f8 b8 80 45 47 a6 3f 98 fb 9d 6d bb 59 60 bf 35 2a 6a 71 da 05 32 46 9c 40 06 81 a2 d0 24 13 09 4e 44 ad c8 6d e0 34 6a 19 a9 18 60 e4 00 e9 b7 1d ae 08 07 c3 31 50 c7 68 68 e8 50 28 40 75 d8 01 17 46 0a 23 66 bd 70 60 ba 6d fe d2 9a c3 39 9c fb a0 Data Ascii: %jy14C~U:Cn[ka kke%j6H^\|O)y,Ff* qPcfS%Wp0FR14{}+,$<\rjX\2kNxk+?5%EG?mY`5jq2F@$NDm4j`1PhhP(@uF#fp`m9
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 88 13 d2 ca b4 06 b4 39 d4 f9 dc 75 86 ec f8 71 28 61 7c 4c c7 63 c8 ea 15 e7 75 7d 6d 29 70 2a 71 c0 e4 ec e9 97 37 59 2c ef da 63 ae b1 f3 e5 0b 3b cf df 39 d7 39 fa 82 03 6e ce 5d df 9a 7e b1 21 8c f5 e5 b9 a1 86 fb 42 cd 8f 80 65 85 b7 9b da 6d 66 ca ea e3 34 46 3b 0d 3a b7 43 5e 3d 7a 57 67 f5 fc 5c 06 83 b4 c2 d8 63 75 21 29 ed dd c1 86 8d 5d 43 f3 49 fd 3d 76 02 f5 6a 5c 57 4b 0c 0f 16 4c dc ae 2c 6b d6 f7 77 f2 a8 5d 45 e3 67 7b 15 83 04 9a 73 32 62 e8 67 d8 7e c1 4c 27 14 66 da 01 f8 70 cc af 50 49 02 86 a1 cc 11 74 0c 24 7f 15 ad 28 be 9d 40 0c 81 9d a0 c6 02 69 80 3c 40 a6 20 29 90 04 80 7d 78 26 1e ec 70 98 20 80 f0 1b 08 60 00 70 d4 d7 e1 d0 c7 a1 d0 95 43 18 82 b8 25 55 45 8c a6 3c b1 98 db 86 78 7d 26 94 17 d0 3b 82 42 0d 40 0d 50 49 53 4a Data Ascii: 9uq(a\|Lcu}m)p*q7Y,c;99n]~!Bemf4F;:C^=zWg\cu!)]CI=vj\WKL,kw]Eg{s2bg~L'fpPIt$(@i<@ )}x&p `pC%UE<x}&;B@PISJ
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 9e 4c 48 88 5f 1b 99 a2 79 07 02 1f 96 7e 0e 91 7d ff 94 85 f8 7a 67 50 22 aa 5f 9d b1 ea a1 e7 40 3d e0 af d4 09 80 e0 46 08 01 02 dc 7c 87 51 31 df 61 b4 fc b5 f8 5f f9 9c 7e 37 d4 2e 33 2b bb ab b5 2d 61 e9 d4 86 25 79 97 ff 9e 60 01 ae e6 85 4f 0d 70 27 cb 1c ca cd c6 bb 4c ee e3 f1 e7 bd 04 1a c4 ed 5f ae e6 74 15 34 ce df 79 d8 bc c2 5b 3a 92 70 aa 60 87 34 ac 37 4f 07 1b c3 55 5a 75 15 93 ac 8f 49 e2 e4 eb 89 76 36 16 f0 83 b7 d5 bb 9f 67 2f 58 2c 57 77 4a 51 b7 7d ea c5 74 6c 12 68 7c 96 77 f7 76 81 a8 ad 31 99 b2 9b a5 fe 82 2e a8 87 5d 00 c3 8c c5 2b de 55 90 4a db 4b 20 93 f0 89 59 6d 27 da 83 c9 06 97 5b cf e2 8c 3a da b1 f1 9f 15 df ae f8 48 9f 72 16 a2 76 86 7d ce 3a 98 57 9f df 1b d0 21 92 e5 7e 21 70 a6 89 08 f9 40 7b 4f 81 e4 ad 37 f1 88 Data Ascii: LH_y~}zgP"_@=F\|Q1a_~7.3+-a%y`Op'L_t4y[:p`47OUZuIv6g/X,WwJQ}tlh\|wv1.]+UJK Ym'[:Hrv}:W!~!p@{O7
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: ec 5b ba a1 ad f4 7e b4 36 22 6b 2a 3a ea b1 10 bb 5a d2 82 b3 0d ce 73 7e 0e e7 48 44 3b 1f 73 dd 54 69 30 7d cb f8 b3 28 bf 32 cd a8 91 6d 34 ad bb 0e d6 22 89 e7 eb 96 b3 8a bc 59 04 0a 5e bc 0b 94 99 3b ef f8 9c bb b7 31 08 30 50 61 9f 34 7d fc aa 6a 32 22 64 fa 76 01 58 be a6 de 25 8f 4c df ca 78 6c 2b 26 9a 9a 4a 74 8f a6 d3 ed aa 44 e2 79 8f 57 ad 97 78 47 09 43 fb f6 b2 69 ae fa ed 0e a6 c8 bc 2d 77 e5 1a be 7a c9 bf 7a 38 df 8f 7f 89 5f 71 93 cd f1 3e a1 da 7c 03 1a 34 f3 b5 5b 8e 92 80 7b dc 29 5e 24 de 2a fe 87 0a 59 f2 e5 dc f9 04 df 73 8a c3 c5 46 cd eb bd 03 6e a2 52 ca 4d 3c 42 8a 91 90 5a 49 6b 4e fc c5 eb 6a e7 27 5f d7 d9 92 eb 99 80 dd 9e 5b 65 18 f5 33 5f 86 4c f2 90 bb f6 e7 d2 ac 36 6f 13 62 f5 9b 39 9d 78 c6 6f 1e a6 9f 96 13 48 6b Data Ascii: [~6"k:Zs~HD;sTi0}(2m4"Y^;10Pa4}j2"dvX%Lxl+&JtDyWxGCi-wzz8_q>\|4[{)^$YsFnRM<BZIkNj'_[e3_L6ob9xoHk
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: e0 22 b7 3c 63 7a e6 a3 86 23 e7 30 2c a5 42 31 a2 ae 1d 00 01 77 ff 02 a6 f0 eb 0b 87 ba f9 f4 b0 9c 8b e6 cf 6e 16 c7 b8 4c f1 8c b4 47 9e 54 c6 be 45 47 91 4e 78 c0 25 c3 da 17 f4 70 5a ff 27 b0 83 21 21 a0 e4 ae fa e7 11 5b d1 a2 1b 58 46 ba 4f bb ee 07 59 6e f4 ab 0a 81 03 c1 db 6d e1 39 50 02 d9 13 3a ab 49 21 bc e7 4b f7 77 6a 95 6b 49 fb ce 2e 4c aa 8c 55 4e a9 ed f2 4b ba 33 65 99 89 da 5f 69 11 cd d0 da 26 9d ba bf 75 33 7c 68 ce 52 23 f7 6e bc 71 bd c0 f4 4c 0b 5d 99 f0 e8 ca 66 97 be 7a a9 35 72 a3 de 49 98 95 65 3a c9 e6 ee 0c cd 45 69 a7 49 e7 1e fb 4f 4f 15 f7 a3 06 9f 47 bd ab 57 ad de 78 c8 98 dc 16 dc f3 dc dc 55 83 32 68 7c fe e1 8e ea 62 90 73 ac a2 96 77 af 48 45 bf 78 17 b3 09 a7 a0 ca 83 66 1e 5a d1 e5 90 4f 7e a6 0b 01 21 3a 95 a5 Data Ascii: "<cz#0,B1wnLGTEGNx%pZ'!![XFOYnm9P:I!KwjkI.LUNK3e_i&u3\|hR#nqL]fz5rIe:EiIOOGWxU2h\|bswHExfZO~!:
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 32 1b 0a 18 02 7a 78 07 ff b7 e4 2c d8 df 5c 0f 2a b6 bb 00 9c 87 d0 82 ba 63 31 84 2a c7 46 98 eb 69 7b ca ce 9c e6 4a 57 82 55 9d 16 93 e4 b5 57 d0 fa 9c 13 8a fb e0 26 aa cb 42 66 b1 8c b9 47 81 8f 78 e3 fb 48 3f d3 f1 e2 b2 3b da 37 b9 e7 72 09 2f 28 74 c5 3e 08 59 00 a5 23 c9 e2 00 24 d9 ad 9f 24 21 fe a8 3a df 1f 25 21 0e a8 2a 9b 7f 22 09 51 ff 59 12 22 01 43 82 45 51 0d 42 bf 2f 09 89 de 9f 4c c9 db 61 c0 ef 3e d3 70 fe f1 53 0b 5c 79 ac ed 1b 14 3c 55 e6 4d a6 39 95 45 ed 70 7c 08 dc 92 bb c1 42 6b e0 27 49 08 37 a7 00 02 f1 4d 12 f2 3a 2b a0 03 08 78 f1 a7 6c c7 af 6c 11 f6 71 b6 48 c2 c1 c2 15 65 9e c7 e2 24 04 13 c0 70 d4 8d da 51 c3 da c6 c2 de fc 1b fb 24 28 0d 00 1c 00 9f 0c c0 21 2d c4 2b f0 af 6b 41 16 01 24 3a 0d 80 44 c3 38 a6 05 59 7f Data Ascii: 2zx,\c1Fi{JWUW&BfGxH?;7r/(t>Y#$$!:%!*"QY"CEQB/La>pS\y<UM9Ep\|Bk'I7M:+xllqHe$pQ$(!-+kA$:D8Y
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 7c 24 f8 a0 ce fd 7a 40 64 78 d4 ba d0 e2 f2 bf a4 fc f8 e2 50 c0 60 d0 a5 93 cd 3c de 94 69 0f 58 bd 36 18 c4 18 88 b1 82 8a 48 29 e9 2a 82 cf 65 09 86 26 8b dc 0b 7d bc be 1c f4 58 aa f5 29 c8 ea 5a 78 49 52 be 34 5b fd 1e 8f 4e 87 e0 ce 85 57 93 e2 f3 cf 81 d3 11 8f a5 b2 a4 79 d3 68 e4 07 e8 4e 36 bd 4c 8d 0d 77 9b 0b de f5 6b e4 6f e1 7f cd 83 97 50 96 71 e7 35 a7 8f 91 df 93 06 62 9c c9 b1 75 aa 1e 01 c3 a0 d1 c7 1f 72 06 82 e0 58 00 02 d7 0a cd a4 eb a5 3e 5d c7 86 55 ab e9 22 f1 63 09 2d 9d 13 3e 49 38 57 5c d8 83 67 c1 75 c5 48 f3 65 71 9a a2 b0 a6 47 e8 32 13 f5 41 d5 cc 6d 22 a3 c4 bb 85 55 d2 db 8a a2 79 30 ce 1e a7 f3 90 19 ec 12 95 c4 54 46 a6 8f 96 54 04 f3 6d 0c 27 c7 22 b3 1e f0 47 da b5 bb ec 28 a7 bb 79 3e 7f 40 cc 97 48 c3 94 f8 d8 df Data Ascii: \|$z@dxP`<iX6H)*e&}X)ZxIR4[NWyhN6LwkoPq5burX>]U"c->I8W\guHeqG2Am"Uy0TFTm'"G(y>@H
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 a9 9d 26 b6 7a 21 ff 73 7a 7d 44 18 6d a3 7f b8 a4 78 23 38 6f 6b cd 97 ef 3f 75 99 b5 f5 2a e7 7c f9 a2 de ed d8 f1 6e 7b d7 b0 43 9c ac ff 11 e2 94 7d 61 09 b5 51 4e 0f 1b 03 13 b4 e1 92 7e 9e 6b d5 a1 e0 c3 e3 f1 92 12 81 23 1d 9e 5b 8c 83 b9 a6 f2 ce fc 34 44 06 ee 97 6a 1a ad 7a 2a 89 47 bd 67 a2 d1 1b 21 b0 95 e8 29 23 38 98 10 56 c4 12 82 e9 48 03 14 04 7f bf 70 42 b6 d9 b6 04 1b 03 9c 67 15 67 02 d2 9d 6a ae 97 5b 7d 39 7e 4d a2 c1 ac 9f 7c 54 6e 51 8b bf 3d a5 80 c1 91 a9 64 bb 20 52 b5 85 97 b4 95 50 0a 41 6e 51 f1 ca cb 97 e4 bf 2a 74 93 cf a7 ba 48 88 0c 5f 19 af 70 7d 15 f1 9f 24 d6 9c 85 c7 06 de 82 3c 2b c3 8b fc 4e 4e e9 0e fa 79 68 26 98 fa e0 d5 Data Ascii: "0H0&z!sz}Dmx#8ok?u\|n{C}aQN~k#[4DjzGg!)#8VHpBggj[}9~M\|TnQ=d RPAnQtH_p}$<+NNyh&
2025-04-28 19:27:47 UTC	1460	IN	Data Raw: 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 55 70 64 61 74 65 20 53 69 67 6e 69 6e 67 20 43 41 20 32 2e 33 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ac 39 80 cb 34 50 ca 26 3f 5d 76 26 ca d3 8c c1 1d 5c eb 30 97 c6 66 86 26 a6 d5 5d 5f 4f cd 80 4c 0f 67 ec 25 0c bb 39 11 3b 6e 86 fd c7 21 27 60 fc 80 7c 01 89 ad e8 6e cd bd d0 47 5f 58 6d 00 3b 46 57 99 7d 16 b3 76 12 8b ca 9d 86 6c 1d 70 9a 69 d4 45 fe ce 72 ea ca ca 94 60 9d 7c 73 Data Ascii: 10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Update Signing CA 2.30"0*H094P&?]v&\0f&]_OLg%9;n!'`\|nG_Xm;FW}vlpiEr`\|s

Timestamp	Bytes transferred	Direction	Data
2025-04-28 19:28:14 UTC	332	OUT	POST /domainreliability/upload HTTP/1.1 host: google.com content-length: 521 content-type: application/json; charset=utf-8 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-04-28 19:28:14 UTC	521	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 68 74 74 70 5f 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 34 30 30 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 53 50 44 59 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 36 32 31 34 37 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 31 37 31 36 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 39 32 2e 31 37 38 2e 34 39 2e 32 30 36 3a 34 34 33 22 2c 22 73 74 61 74 75 73 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6c 61 79 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 2c 22 77 61 73 5f 70 72 6f 78 69 65 64 22 3a 66 61 6c 73 65 7d Data Ascii: {"entries":[{"http_response_code":400,"network_changed":false,"protocol":"SPDY","request_age_ms":62147,"request_elapsed_ms":1716,"sample_rate":1.0,"server_ip":"192.178.49.206:443","status":"http.error","url":"https://play.google.com/","was_proxied":false}
2025-04-28 19:28:14 UTC	787	IN	HTTP/1.1 200 OK report-to: {"group":"ntbdioescrec:47:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ntbdioescrec:47:0"}],} nel: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} content-type: application/javascript; charset=utf-8 content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ntbdioescrec:47:0 cross-origin-opener-policy-report-only: same-origin; report-to=ntbdioescrec:47:0 date: Mon, 28 Apr 2025 19:28:14 GMT server: Domain Reliability Server content-length: 0 x-xss-protection: 0 x-frame-options: SAMEORIGIN alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Target ID:	1
Start time:	15:26:51
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	15:26:56
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2328,i,5844405568809796047,17720815761895081039,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2380 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	16
Start time:	15:27:03
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZm9ybXMvZC9lLzFGQUlwUUxTZXdvMUFSYldfT01TR3pxTVJUUkxMTE1USTFrYi16NVVoXzVzYUhyNElJVUpyOUZ3L3ZpZXdmb3JtP3VzcD1wcF91cmw=&i=NjBlY2ZhYmU3ZWQ0NWQwZWU0ZWQ0MDcy&t=K0JvQXFqTGN1NDJJdHo4Zld6VG10T2dVS1JHajIvSGg5YjJYeWJFeS9laz0=&h=84d0086a27f44d8297298aa3ec390096&s=AVNPUEhUT0NFTkNSWVBUSVbA3h08au4a3EC2NwRp5wFcMG85qrYhtqqc__Y254CD2Q"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre