Edit tour

Windows Analysis Report
https://forms.gle/ocmuQas5VxXUCyAA7

Overview

General Information

Sample URL:	https://forms.gle/ocmuQas5VxXUCyAA7
Analysis ID:	1431288
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://forms.gle/ocmuQas5VxXUCyAA7 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1912,i,4038136451453237735,15527170060163237921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

String found in binary or memory: gf=u(["https://sandbox.google.com/tools/feedback/"]),hf=u(["https://www.google.cn/tools/feedback/"]),jf=u(["https://help.youtube.com/tools/feedback/"]),kf=u(["https://asx-frontend-staging.corp.google.com/inapp/"]),lf=u(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),mf=u(["https://localhost.corp.google.com/inapp/"]),nf=u(["https://localhost.proxy.googlers.com/inapp/"]),of=S(Qe),pf=[S(Re),S(Se)],qf=[S(Te),S(Ue),S(Ve),S(We),S(Xe),S(Ye),S(Ze),S($e),S(af),S(bf)],rf=[S(cf),S(df)],sf= equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: forms.gle
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: app.apollo.io

Source: unknown

HTTP traffic detected: POST /forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/naLogImpressions HTTP/1.1Host: docs.google.comConnection: keep-aliveContent-Length: 3101sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Same-Domain: 1Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform?usp=send_formAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=zdiKRCHJ3tyHo6aHNMqYF5w4r2sUFSTjH0JNG8V4pIA; COMPASS=spreadsheet_forms=CjIACWuJV2yfDDO4gBUVMbcficfzuNyXPLz3PQG6XtVMGoR6v9m-AzSKXHGKQX523kQQghD5oaWxBhpDAAlriVf_uEyL6ytzHZIkaS9RK0zJp7xFNfvESby3TfcQRIXOBVbKTa_M8hsfmtWlVIKXrtBAzkvCrgQ4KR0VoAjQmg==; NID=513=i8ExIPsOAm38AgKMPLpGado7xzNJCksWa4RxKFATTM17hWGz-wkVam66stJ1WLpQtzAgZ3jP4qAbQ3QpzJKUknhF_aYMqKG9xSZAnwMtZ6l4wH1oDg2wkc1F6H3mG0d-ESA9VkJTCIrg6dyacsM9ZkLy9W3Pj_n63wWvlk_S9Ls

Source: https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=sFHmyt4kVc9ZX4NceBA9cKwkM4C2RzPyF-AFFdPhmSpYN534K9kUflk1DxepUKHbztd8Nq4pXXlfiBUFyl17-Wz33yOCNKg2fd_g4Uisf_IK-CER-GZh7VgvaeW826p59ZDyJFaoVunxnNaKyui4oSO5jXKdLRXexyiEQe5WP69fkoiwqI6J32ImBtISjnU3JKQ7AFcQUOCvXQcAMfDDaXS3IUUS6uf_sT5UQM5O01Plv8Da810e1_qk9XQQ_CR4I1__SKYTJBf9jXypHE1CR4TlijXj1j4&cb=22uzsod8u5h0	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=sFHmyt4kVc9ZX4NceBA9cKwkM4C2RzPyF-AFFdPhmSpYN534K9kUflk1DxepUKHbztd8Nq4pXXlfiBUFyl17-Wz33yOCNKg2fd_g4Uisf_IK-CER-GZh7VgvaeW826p59ZDyJFaoVunxnNaKyui4oSO5jXKdLRXexyiEQe5WP69fkoiwqI6J32ImBtISjnU3JKQ7AFcQUOCvXQcAMfDDaXS3IUUS6uf_sT5UQM5O01Plv8Da810e1_qk9XQQ_CR4I1__SKYTJBf9jXypHE1CR4TlijXj1j4&cb=22uzsod8u5h0	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.16:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49819 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: chromecache_196.1.dr	String found in binary or memory: http://localhost.corp.google.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: http://localhost.proxy.googlers.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_184.1.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_184.1.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_184.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_184.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_184.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_196.1.dr	String found in binary or memory: https://feedback-pa.clients6.google.com
Source: chromecache_196.1.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/annotator.css
Source: chromecache_196.1.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/render_frame2.html
Source: chromecache_196.1.dr	String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_196.1.dr	String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_196.1.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_196.1.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_221.1.dr, chromecache_220.1.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_229.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialiconsextended/v151/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvJ.woff
Source: chromecache_221.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVE9eOcEg.woff2)
Source: chromecache_221.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2)
Source: chromecache_221.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVFNeOcEg.woff2)
Source: chromecache_221.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVGdeOcEg.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_220.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_196.1.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_196.1.dr	String found in binary or memory: https://help.youtube.com/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://localhost.corp.google.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://localhost.proxy.googlers.com/inapp/
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://play.google.com
Source: chromecache_123.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_184.1.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_196.1.dr	String found in binary or memory: https://sandbox.google.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_196.1.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_196.1.dr	String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://ssl.gstatic.com/docs/forms/draft_responses_onboarding.png
Source: chromecache_196.1.dr	String found in binary or memory: https://stagingqual-feedback-pa-googleapis.sandbox.google.com
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://support.google.com
Source: chromecache_196.1.dr, chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_196.1.dr	String found in binary or memory: https://support.google.com/inapp/
Source: chromecache_196.1.dr	String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_184.1.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_184.1.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_184.1.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_184.1.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_196.1.dr	String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_123.1.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_184.1.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_196.1.dr	String found in binary or memory: https://www.google.cn/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_170.1.dr, chromecache_184.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_196.1.dr, chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_196.1.dr	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chromecache_196.1.dr	String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_196.1.dr	String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_184.1.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__.
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_170.1.dr, chromecache_128.1.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js
Source: chromecache_168.1.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_196.1.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://youtube.com/embed/
Source: chromecache_124.1.dr, chromecache_168.1.dr	String found in binary or memory: https://youtube.com/embed/?rel=0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://forms.gle/ocmuQas5VxXUCyAA7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1912,i,4038136451453237735,15527170060163237921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1912,i,4038136451453237735,15527170060163237921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
http://localhost.proxy.googlers.com/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	0%	URL Reputation	safe
https://localhost.proxy.googlers.com/inapp/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://www.gstatic.c..?/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__.	0%	URL Reputation	safe
about:blank	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
docs.google.com	74.125.137.100	true	false	high
play.google.com	142.250.101.138	true	false	high
forms.gle	199.36.158.100	true	false	unknown
www.google.com	142.250.141.106	true	false	high
app.apollo.io	172.67.2.155	true	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4mlYedU3Xaz4LfRPfFB1W0MgGq3omzSWm39cO-LLQIDTLPu-8aaFS7z3t50rgxbsW2gqdth8eY8r3f2mcD4nmCiqH6rzBu3zJ7CU_dqSPi8azaJ7OWak8shcegfcwUdFLpKViP0Lf8QaZz2uV2ss-WcQn4IIlsOIXUFDR1vY-bJJ3UkCWa2QSQ5645gjx-sYkI9a701IWbgv9B5qWiyBMCArbm3g&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&id=6c771df471dfd104	false		high
https://www.google.com/recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false		high
about:blank	false	Avira URL Cloud: safe	low
https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform?usp=send_form	false		high
https://www.google.com/js/bg/6JK7PkhQPjgGeBZqyHKCSWuJKD5ZJmF_kzmP9QlV1DY.js	false		high
https://www.google.com/recaptcha/api.js	false		high
https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=sFHmyt4kVc9ZX4NceBA9cKwkM4C2RzPyF-AFFdPhmSpYN534K9kUflk1DxepUKHbztd8Nq4pXXlfiBUFyl17-Wz33yOCNKg2fd_g4Uisf_IK-CER-GZh7VgvaeW826p59ZDyJFaoVunxnNaKyui4oSO5jXKdLRXexyiEQe5WP69fkoiwqI6J32ImBtISjnU3JKQ7AFcQUOCvXQcAMfDDaXS3IUUS6uf_sT5UQM5O01Plv8Da810e1_qk9XQQ_CR4I1__SKYTJBf9jXypHE1CR4TlijXj1j4&cb=22uzsod8u5h0	false		high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false		high
https://forms.gle/ocmuQas5VxXUCyAA7	false		unknown
https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/font/getmetadata	false		high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC	false		high
https://www.google.com/favicon.ico	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://www.google.com/recaptcha/api2/replaceimage?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false		high
https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/naLogImpressions	false		high
https://www.google.com/url?sa=j&url=https%3A%2F%2Fapp.apollo.io%2F%23%2Fmeet%2Fdonald_groh_c7d%2F15-min&uct=1713980137&usg=M2OXYtYAnjvKqhH67N8pxf0eov4.&source=editors	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.101.138	play.google.com	United States	15169	GOOGLEUS	false
74.125.137.100	docs.google.com	United States	15169	GOOGLEUS	false
142.250.101.100	unknown	United States	15169	GOOGLEUS	false
199.36.158.100	forms.gle	United States	15169	GOOGLEUS	false
74.125.137.139	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.2.155	app.apollo.io	United States	13335	CLOUDFLARENETUS	false
142.250.141.106	www.google.com	United States	15169	GOOGLEUS	false
142.250.141.147	unknown	United States	15169	GOOGLEUS	false
104.20.39.213	unknown	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431288
Start date and time:	2024-04-24 19:35:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://forms.gle/ocmuQas5VxXUCyAA7
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@15/234@18/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Name	Source	Malicious	Antivirus Detection	Reputation
http://localhost.corp.google.com/inapp/	chromecache_196.1.dr	false		high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_196.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_184.1.dr	false		high
https://youtube.com/embed/?rel=0	chromecache_124.1.dr, chromecache_168.1.dr	false		high
https://apis.google.com/js/client.js	chromecache_196.1.dr	false		high
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_196.1.dr	false		high
https://support.google.com	chromecache_124.1.dr, chromecache_168.1.dr	false		high
https://play.google.com	chromecache_124.1.dr, chromecache_168.1.dr	false		high
https://youtube.com/embed/	chromecache_124.1.dr, chromecache_168.1.dr	false		high
http://localhost.proxy.googlers.com/inapp/	chromecache_196.1.dr	false	URL Reputation: safe	unknown
https://support.google.com/recaptcha#6262736	chromecache_184.1.dr	false		high
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_196.1.dr	false		high
https://support.google.com/inapp/%	chromecache_196.1.dr	false		high
https://asx-help-frontend-autopush.corp.youtube.com/inapp/	chromecache_196.1.dr	false		high
https://help.youtube.com/tools/feedback/	chromecache_196.1.dr	false		high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_184.1.dr	false		high
https://cloud.google.com/contact	chromecache_184.1.dr	false		high
https://asx-frontend-staging.corp.google.com/tools/feedback/	chromecache_196.1.dr	false		high
https://support.google.com/	chromecache_196.1.dr, chromecache_124.1.dr, chromecache_168.1.dr	false		high
https://www.google.com	chromecache_124.1.dr, chromecache_168.1.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_184.1.dr	false		high
https://scone-pa.clients6.google.com	chromecache_196.1.dr	false		high
https://support.google.com/inapp/	chromecache_196.1.dr	false		high
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_196.1.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_196.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/api2/	chromecache_170.1.dr, chromecache_184.1.dr	false		high
https://asx-frontend-autopush.corp.google.com/tools/feedback/	chromecache_196.1.dr	false		high
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_196.1.dr	false		high
https://support.google.com/recaptcha	chromecache_184.1.dr	false		high
https://feedback2-test.corp.google.com/inapp/%	chromecache_196.1.dr	false		high
https://www.google.com/tools/feedback	chromecache_196.1.dr, chromecache_124.1.dr, chromecache_168.1.dr	false		high
https://sandbox.google.com/inapp/%	chromecache_196.1.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_184.1.dr	false		high
https://feedback2-test.corp.googleusercontent.com/inapp/%	chromecache_196.1.dr	false		high
https://localhost.proxy.googlers.com/inapp/	chromecache_196.1.dr	false	URL Reputation: safe	unknown
https://recaptcha.net	chromecache_184.1.dr	false	URL Reputation: safe	unknown
https://www.apache.org/licenses/	chromecache_184.1.dr	false		high
https://www.google.com/tools/feedback/	chromecache_196.1.dr	false		high
https://www.google.cn/tools/feedback/	chromecache_196.1.dr	false		high
https://asx-frontend-autopush.corp.google.de/inapp/	chromecache_196.1.dr	false		high
https://www.google.cn/tools/feedback/%	chromecache_196.1.dr	false		high
https://www.gstatic.c..?/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__.	chromecache_184.1.dr	false	URL Reputation: safe	low
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_196.1.dr	false		high
https://www.google.com/tools/feedback/help_panel_binary.js	chromecache_196.1.dr	false		high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_123.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_184.1.dr	false		high
https://asx-frontend-autopush.corp.google.de/tools/feedback/	chromecache_196.1.dr	false		high
https://sandbox.google.com/inapp/	chromecache_196.1.dr	false		high
https://test-scone-pa-googleapis.sandbox.google.com	chromecache_196.1.dr	false		high
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_196.1.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_123.1.dr	false		high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_196.1.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_184.1.dr	false		high
https://feedback.googleusercontent.com/resources/render_frame2.html	chromecache_196.1.dr	false		high
https://sandbox.google.com/tools/feedback/%	chromecache_196.1.dr	false		high
https://sandbox.google.com/tools/feedback/	chromecache_196.1.dr	false		high
https://localhost.corp.google.com/inapp/	chromecache_196.1.dr	false		high
https://asx-frontend-autopush.corp.youtube.com/inapp/	chromecache_196.1.dr	false		high
https://feedback-pa.clients6.google.com	chromecache_196.1.dr	false		high
https://asx-frontend-staging.corp.google.com/inapp/	chromecache_196.1.dr	false		high
https://www.google.com/tools/feedback/%	chromecache_196.1.dr	false		high
https://fonts.google.com/license/googlerestricted	chromecache_221.1.dr, chromecache_220.1.dr	false		high

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 16:35:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9849431812392764
Encrypted:	false
SSDEEP:	48:8TddsTQU0HRidAKZdA1FehwiZUklqehekJy+3:8Ifm/Yy
MD5:	901B8206C259C2B1416E8B75F297FBBD
SHA1:	B298D31C149759A50F5722F64901B07957ECA5E6
SHA-256:	B9920667D737DA7BEAFAACC2FDE479BFDF09106F6CB2E6CC6A0E321B01FEE881
SHA-512:	4CDCDF6CE33DFE3E8F61DE71AE7B8911083FFCA45F3FCD211EC706324597A20C39C6D5FF8C7D7087BA9ECAE5369DD3CE68400E52D479C6618982DB4E4C04181F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....{.].m...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xj.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xq.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xq.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xq............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xs............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........GB'@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 19:35:35.496247053 CEST	55960	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:35.496407032 CEST	63899	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:35.642340899 CEST	53	59815	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:35.650837898 CEST	53	55960	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:35.651561975 CEST	53	63899	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:35.727209091 CEST	53	65055	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:36.399828911 CEST	57240	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:36.400274992 CEST	62490	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:36.553073883 CEST	53	57240	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:36.553478003 CEST	53	62490	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:36.688185930 CEST	53	55566	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:37.686952114 CEST	53	61292	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:37.692233086 CEST	53	62089	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:38.584307909 CEST	53	63077	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:39.713886023 CEST	53	55385	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:40.293076992 CEST	62536	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:40.293402910 CEST	57009	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:40.307677984 CEST	53	50317	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:40.399118900 CEST	53	54685	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:40.446787119 CEST	53	57009	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:40.446811914 CEST	53	62536	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:41.274164915 CEST	53	54733	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:41.929301977 CEST	50658	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:41.929511070 CEST	64326	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:42.082683086 CEST	53	50658	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:42.082887888 CEST	53	64326	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:43.557473898 CEST	53115	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:43.557600975 CEST	60474	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:43.710792065 CEST	53	60474	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:43.710947990 CEST	53	53115	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:43.765903950 CEST	51336	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:43.766042948 CEST	49468	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:35:43.919888973 CEST	53	49468	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:43.920142889 CEST	53	51336	1.1.1.1	192.168.2.16
Apr 24, 2024 19:35:53.605146885 CEST	53	49367	1.1.1.1	192.168.2.16
Apr 24, 2024 19:36:12.565148115 CEST	53	60651	1.1.1.1	192.168.2.16
Apr 24, 2024 19:36:35.639161110 CEST	53	61561	1.1.1.1	192.168.2.16
Apr 24, 2024 19:36:35.639374971 CEST	53	58444	1.1.1.1	192.168.2.16
Apr 24, 2024 19:36:41.602509022 CEST	53	50578	1.1.1.1	192.168.2.16
Apr 24, 2024 19:36:42.483228922 CEST	53	51035	1.1.1.1	192.168.2.16
Apr 24, 2024 19:36:49.201915026 CEST	138	138	192.168.2.16	192.168.2.255
Apr 24, 2024 19:37:04.444933891 CEST	53	57416	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:08.476775885 CEST	62825	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:37:08.477035046 CEST	64363	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:37:08.561393976 CEST	57929	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:37:08.561552048 CEST	51974	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:37:08.630781889 CEST	53	62825	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:08.631165981 CEST	53	64363	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:08.715553045 CEST	53	51974	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:08.715580940 CEST	53	57929	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:11.456363916 CEST	53	51621	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:13.374509096 CEST	53	49870	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:15.197638035 CEST	53	60364	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:15.890912056 CEST	53	62829	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:17.456494093 CEST	63403	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:37:17.456629038 CEST	57172	53	192.168.2.16	1.1.1.1
Apr 24, 2024 19:37:17.610084057 CEST	53	63403	1.1.1.1	192.168.2.16
Apr 24, 2024 19:37:17.610112906 CEST	53	57172	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:35 UTC	669	OUT	GET /ocmuQas5VxXUCyAA7 HTTP/1.1 Host: forms.gle Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 17:35:36 UTC	1375	IN	HTTP/1.1 302 Found Connection: close Content-Length: 0 Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cache-Control: no-cache, no-store, max-age=0, must-revalidate Content-Security-Policy: script-src 'report-sample' 'nonce-uaEjzj-NxjQKnjFQdk-01Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport/allowlist,require-trusted-types-for 'script';report-uri /_/DurableDeepLinkUi/cspreport Content-Type: application/binary Cross-Origin-Opener-Policy: unsafe-none Cross-Origin-Resource-Policy: same-site Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform?usp=send_form Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=*
2024-04-24 17:35:36 UTC	354	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 34 20 41 70 72 20 32 30 32 34 20 31 37 3a 33 35 3a 33 36 20 47 4d 54 0d 0a 58 2d 53 65 72 76 65 64 2d 42 79 3a 20 63 61 63 68 65 2d 6c 61 78 2d 6b 77 68 70 31 39 34 30 30 38 33 2d 4c 41 58 0d 0a 58 2d 43 61 63 68 65 3a 20 4d 49 53 53 0d 0a 58 2d 43 61 63 68 65 2d 48 69 74 73 3a 20 30 0d 0a 58 2d 54 69 6d 65 72 3a 20 53 31 37 31 33 39 38 30 31 33 36 2e 32 33 32 32 30 39 2c 56 53 30 2c 56 45 38 35 0d 0a 56 61 72 79 3a 20 53 65 63 2d 46 65 74 63 68 2d 44 65 73 74 2c 20 53 65 63 2d 46 65 74 63 68 2d 4d 6f 64 65 2c 20 53 65 63 2d 46 65 74 63 68 2d 53 69 74 65 2c 20 78 2d 66 68 2d 72 65 71 75 65 73 74 65 64 Data Ascii: Pragma: no-cacheAccept-Ranges: bytesDate: Wed, 24 Apr 2024 17:35:36 GMTX-Served-By: cache-lax-kwhp1940083-LAXX-Cache: MISSX-Cache-Hits: 0X-Timer: S1713980136.232209,VS0,VE85Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, x-fh-requested

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:36 UTC	747	OUT	GET /forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform?usp=send_form HTTP/1.1 Host: docs.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 17:35:37 UTC	3130	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Apr 2024 17:35:37 GMT Content-Security-Policy-Report-Only: report-uri https://csp.withgoogle.com/csp/forms/prod;frame-ancestors 'none' P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-JQOpNYHsvvKYatvxzgWaYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Reporting-Endpoints: default="/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/web-reports?context=eJwNzmlI03EcBvCv3__33zw6TKHIQlAqOtDug9TNuc2pRRfZb4IGUYtONZNVdhhF2UFlRWX0Yo6KTumAikRBqIUKQQSV-SLKpLIknW45V209Lz6vnoeHJ7bDECBF7mhFDXGKhkYpuhavKDlBkXecorTxiqqmKJqZpuh8uqKy-YpqchTVwRuboi54v17RN4jZqGgC-HcoklJFiyoU2eFgpaIzsKlKkQs6Din6DqVHkcHi04ry4EOtoh4ovKjICeE6RaOvKKq4qugwHINLkPJS0RxofY0t-OFXFAJXAB14MNFBLRCT7KAJYAcFt9c56BmQy0Hx8Hv6Tw5DpNjHhhIfGzf7OBcanvv4MVw-P8BuiKob4Bjo-zzAQ1C4bJBLoLdwkP2ws3qQ90IkPcCGWQFumB3gx6AdDnAc-LYN8TDoWUEeBd3QC7vMQd4HXc4g_4Dqk0GugXDbMI9oH-ZTCSG-AMmeEE-F_nl_OQhxB_5xIrSsDnMrxFKEE6B7UoR74UxVhC-BOZ60fGgpJa0VVnWTVgQzvKzNhZuvWLsPJz6xdg52a5pWDZNqNG0yrOxbIg54NyZDPkJPdYb4oLYnQ-rgQiBDrkLn5Uzpgsi9TDE0ZEowJ0vIkiXTkowyG6bOM0o6jHYaZRwU6CZZDUazSXIhvcgkC2F5m0nWQvPWbPGC_062_IUTb7PlHBzPM0stHCkwyylYczdHiuG00SIX4Xa5RR7CCpdFFDRXWcQLMx5YZC5sf2uRSgilWIVTrdKfY8VXq9hbrLICmn5a5QU80m3SCNljbbISfqXYJAzenTZ5BUlum6TC62abdMD3rzbph5Q9uTIHLGftshTS6vNkAcQl5ksiDO7Nlz_QpBfIC8g0FIgVKp-69f3geu7WD4L5i1vPh_LP9foeKPHX605oj_LonWBK9Oh2aNzg0dth1QePXgRJnR49FQaeXtdDkDAyuufojYcj4m91e59EJUWv3eLcnVtWseM_aQdp-Q" Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: S=spreadsheet_forms=zdiKRCHJ3tyHo6aHNMqYF5w4r2sUFSTjH0JNG8V4pIA; Domain=.docs.google.com; Expires=Wed, 24-Apr-2024 18:35:37 GMT; Path=/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: COMPASS=spreadsheet_forms=CjIACWuJV2yfDDO4gBUVMbcficfzuNyXPLz3PQG6XtVMGoR6v9m-AzSKXHGKQX523kQQghD5oaWxBhpDAAlriVf_uEyL6ytzHZIkaS9RK0zJp7xFNfvESby3TfcQRIXOBVbKTa_M8hsfmtWlVIKXrtBAzkvCrgQ4KR0VoAjQmg==; Domain=.docs.google.com; Expires=Wed, 24-Apr-2024 18:35:37 GMT; Path=/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: NID=513=i8ExIPsOAm38AgKMPLpGado7xzNJCksWa4RxKFATTM17hWGz-wkVam66stJ1WLpQtzAgZ3jP4qAbQ3QpzJKUknhF_aYMqKG9xSZAnwMtZ6l4wH1oDg2wkc1F6H3mG0d-ESA9VkJTCIrg6dyacsM9ZkLy9W3Pj_n63wWvlk_S9Ls; expires=Thu, 24-Oct-2024 17:35:37 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 37 30 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 48 42 31 65 43 64 2d 55 4d 72 6e 6d 62 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 73 70 72 65 61 64 73 68 65 65 74 73 2f 66 6f 72 6d 73 2f 66 61 76 69 63 6f 6e 5f 71 70 32 2e 70 6e 67 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 69 63 6f 6e 3f 66 61 6d 69 6c 79 3d 4d 61 74 65 72 69 61 6c 2b 49 63 6f 6e 73 2b 45 78 74 65 6e 64 65 64 22 20 72 Data Ascii: 7006<!DOCTYPE html><html lang="en" class="HB1eCd-UMrnmb"><head><link rel="shortcut icon" sizes="16x16" href="https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png"><link href="https://fonts.googleapis.com/icon?family=Material+Icons+Extended" r
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 38 2c 20 31 38 33 29 3b 7d 2e 42 4a 48 41 50 2e 52 44 50 5a 45 3a 6e 6f 74 28 2e 4e 32 52 70 42 65 29 3a 6e 6f 74 28 2e 42 36 56 68 71 65 29 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 39 41 41 30 41 36 3b 7d 2e 64 61 38 62 6d 64 20 2e 42 4a 48 41 50 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 2c 20 2e 64 61 38 62 6d 64 20 2e 42 4a 48 41 50 2e 42 36 56 68 71 65 2e 52 44 50 5a 45 2c 20 2e 77 4d 55 41 76 64 20 2e 42 4a 48 41 50 2e 52 44 50 5a 45 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 35 46 36 33 36 38 3b 7d 2e 61 6f 6d 61 45 63 2e 4e 32 52 70 42 65 3a 6e 6f 74 28 2e 52 44 50 5a 45 29 20 2e 49 64 35 56 31 2c 20 2e 61 6f 6d 61 45 63 20 2e 6e 51 4f 72 45 62 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 Data Ascii: 8, 183);}.BJHAP.RDPZE:not(.N2RpBe):not(.B6Vhqe) {border-color: #9AA0A6;}.da8bmd .BJHAP.N2RpBe.RDPZE, .da8bmd .BJHAP.B6Vhqe.RDPZE, .wMUAvd .BJHAP.RDPZE {border-color: #5F6368;}.aomaEc.N2RpBe:not(.RDPZE) .Id5V1, .aomaEc .nQOrEb {border-color: rgb(103, 58, 1
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 20 61 63 74 69 76 65 29 20 7b 2e 49 71 32 78 50 62 20 2e 73 37 62 49 63 66 20 7b 6f 75 74 6c 69 6e 65 3a 20 31 70 78 20 73 6f 6c 69 64 20 48 69 67 68 6c 69 67 68 74 3b 7d 7d 2e 49 71 32 78 50 62 20 2e 6b 61 41 74 32 20 7b 63 6f 6c 6f 72 3a 20 23 33 43 34 30 34 33 3b 7d 2e 49 71 32 78 50 62 20 2e 6b 61 41 74 32 2e 4b 4b 6a 76 58 62 20 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 49 71 32 78 50 62 20 2e 6b 61 41 74 32 2e 52 44 50 5a 45 20 20 7b 63 6f 6c 6f 72 3a 20 23 37 30 37 35 37 61 3b 20 63 75 72 73 6f 72 3a 20 64 65 66 61 75 6c 74 3b 7d 2e 49 71 32 78 50 62 20 2e 52 44 50 5a 45 20 2b 20 2e 73 37 62 49 63 66 20 7b Data Ascii: @media screen and (forced-colors: active) {.Iq2xPb .s7bIcf {outline: 1px solid Highlight;}}.Iq2xPb .kaAt2 {color: #3C4043;}.Iq2xPb .kaAt2.KKjvXb {color: rgb(103, 58, 183);}.Iq2xPb .kaAt2.RDPZE {color: #70757a; cursor: default;}.Iq2xPb .RDPZE + .s7bIcf {
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 3a 20 23 32 30 32 31 32 34 3b 7d 2e 77 4d 55 41 76 64 20 2e 4c 79 67 4e 71 62 2e 52 44 50 5a 45 20 2e 73 6e 42 79 61 63 2c 20 2e 77 4d 55 41 76 64 20 2e 4c 79 67 4e 71 62 2e 52 44 50 5a 45 2e 4e 32 52 70 42 65 20 2e 73 6e 42 79 61 63 2c 20 2e 77 4d 55 41 76 64 20 2e 4c 79 67 4e 71 62 2e 52 44 50 5a 45 2e 42 36 56 68 71 65 20 2e 73 6e 42 79 61 63 20 7b 63 6f 6c 6f 72 3a 20 62 6c 61 63 6b 3b 7d 2e 4c 79 67 4e 71 62 2e 52 44 50 5a 45 20 2e 50 67 66 4f 5a 20 73 76 67 20 7b 66 69 6c 6c 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 35 34 29 3b 7d 2e 4c 79 67 4e 71 62 2e 52 44 50 5a 45 2e 4e 32 52 70 42 65 20 2e 50 67 66 4f 5a 2c 20 2e 4c 79 67 4e 71 62 2e 52 44 50 5a 45 2e 42 36 56 68 71 65 20 2e 50 67 66 4f 5a 20 73 76 67 20 7b 66 69 6c 6c 3a 20 72 67 62 Data Ascii: : #202124;}.wMUAvd .LygNqb.RDPZE .snByac, .wMUAvd .LygNqb.RDPZE.N2RpBe .snByac, .wMUAvd .LygNqb.RDPZE.B6Vhqe .snByac {color: black;}.LygNqb.RDPZE .PgfOZ svg {fill: rgba(0, 0, 0, .54);}.LygNqb.RDPZE.N2RpBe .PgfOZ, .LygNqb.RDPZE.B6Vhqe .PgfOZ svg {fill: rgb
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 66 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 67 66 64 77 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 67 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 69 63 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 69 64 77 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 6c 6e 73 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 6d 61 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 6e 70 64 77 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 6e 73 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 77 69 7a 2d 65 6e 64 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 6f 64 70 73 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 6f 64 77 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 70 70 64 6d 22 3a 74 72 Data Ascii: ":false,"docs-efwm":false,"docs-egfdwm":true,"docs-egdwm":false,"docs-eicdwm":false,"docs-eidw":true,"docs-elnswm":false,"docs-emadwm":false,"docs-enpdwm":true,"docs-ensdwm":false,"docs-wiz-endm":true,"docs-eodpswm":false,"docs-eodwm":true,"docs-eppdm":tr
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 37 36 38 2c 39 34 34 39 33 30 31 37 2c 37 31 35 34 34 38 38 32 2c 35 30 33 36 30 30 30 38 2c 37 31 33 34 36 39 34 30 2c 37 31 35 38 32 34 35 36 2c 35 37 31 38 36 38 30 2c 37 31 30 30 38 32 34 31 2c 34 39 34 35 31 36 37 39 2c 34 39 33 39 38 37 30 39 2c 35 37 30 37 34 36 31 2c 34 39 38 34 32 38 32 33 2c 37 31 36 31 34 35 34 33 2c 35 37 33 38 37 32 39 2c 35 37 30 31 38 37 37 2c 39 34 33 35 33 32 37 36 2c 39 34 34 32 39 35 36 30 2c 35 37 31 35 30 35 35 2c 37 31 36 37 39 34 34 38 2c 34 39 33 37 35 33 30 32 2c 34 39 36 32 33 32 32 31 2c 35 37 31 31 32 32 36 2c 37 31 36 33 35 32 38 30 2c 35 30 30 38 32 38 30 38 2c 39 34 34 34 32 33 31 31 2c 35 37 31 33 35 35 34 2c 37 31 31 39 37 39 37 34 2c 34 38 39 36 36 31 34 32 2c 34 39 36 34 34 30 34 33 2c 35 37 36 34 33 34 Data Ascii: 768,94493017,71544882,50360008,71346940,71582456,5718680,71008241,49451679,49398709,5707461,49842823,71614543,5738729,5701877,94353276,94429560,5715055,71679448,49375302,49623221,5711226,71635280,50082808,94442311,5713554,71197974,48966142,49644043,576434
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 72 69 76 65 5f 75 72 6c 22 3a 22 2f 2f 64 72 69 76 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 3f 75 73 70 5c 75 30 30 33 64 66 6f 72 6d 73 5f 77 65 62 22 2c 22 61 70 70 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 66 6f 72 6d 73 2f 3f 75 73 70 5c 75 30 30 33 64 66 6f 72 6d 73 5f 77 65 62 22 2c 22 64 6f 63 73 2d 69 74 72 66 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 67 73 6d 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 6f 72 6b 73 70 61 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 69 63 64 6d 74 22 3a 5b 5d 2c 22 64 6f 63 73 2d 6d 69 70 22 3a 32 35 30 30 30 30 30 30 2c 22 64 6f 63 73 2d 6d 69 66 22 3a 31 30 30 30 2c 22 64 6f 63 73 2d 6d 73 69 64 Data Ascii: /docs.google.com","drive_url":"//drive.google.com?usp\u003dforms_web","app_url":"https://docs.google.com/forms/?usp\u003dforms_web","docs-itrf":false,"docs-gsmd":"https://workspace.google.com","docs-icdmt":[],"docs-mip":25000000,"docs-mif":1000,"docs-msid
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 6f 63 73 2d 75 73 70 22 3a 22 66 6f 72 6d 73 5f 77 65 62 22 2c 22 64 6f 63 73 2d 69 73 62 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 61 67 64 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 6e 64 64 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 64 6e 64 6c 64 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 68 6e 61 70 22 3a 22 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 64 73 22 3a 22 68 74 74 70 73 22 2c 22 64 6f 63 73 2d 65 6d 6d 64 61 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 63 6c 69 62 73 22 3a 31 2c 22 64 6f 63 73 2d 63 69 72 74 73 22 3a 32 30 30 30 30 2c 22 64 6f 63 73 2d 63 70 65 68 74 22 3a 22 22 2c 22 64 6f 63 73 2d 63 69 64 65 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 63 6e 22 3a 22 22 2c 22 64 6f 63 73 2d 64 70 72 66 6f 22 Data Ascii: ocs-usp":"forms_web","docs-isb":true,"docs-agdc":false,"docs-anddc":false,"docs-adndldc":false,"docs-dhnap":"docs.google.com","docs-ds":"https","docs-emmda":false,"docs-clibs":1,"docs-cirts":20000,"docs-cpeht":"","docs-cide":true,"docs-cn":"","docs-dprfo"
2024-04-24 17:35:37 UTC	3130	IN	Data Raw: 2c 22 64 6f 63 73 2d 6e 61 64 22 3a 22 22 2c 22 64 6f 63 73 2d 65 70 63 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 63 63 77 74 22 3a 38 30 2c 22 64 6f 63 73 2d 75 74 22 3a 32 2c 22 64 6f 63 73 2d 73 6f 6c 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 76 73 22 3a 31 2c 22 64 6f 63 73 2d 64 61 63 22 3a 31 2c 22 64 6f 63 73 2d 69 6c 62 72 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 6c 70 65 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 69 72 6a 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 72 72 65 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 5f 6f 6d 6e 69 62 6f 78 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 63 76 6d 6f 22 3a 2d 31 2c 22 64 6f 63 73 2d 65 71 61 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 75 61 6f 6f 6c 22 3a 66 61 6c 73 65 2c 22 64 6f 63 Data Ascii: ,"docs-nad":"","docs-epcc":false,"docs-ccwt":80,"docs-ut":2,"docs-sol":false,"docs-dvs":1,"docs-dac":1,"docs-ilbrc":false,"docs-dlpe":false,"docs-eirj":false,"docs-erre":false,"enable_omnibox":true,"docs-cvmo":-1,"docs-eqam":false,"docs-euaool":false,"doc
2024-04-24 17:35:37 UTC	516	IN	Data Raw: 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 47 6f 6f 67 6c 65 20 44 6f 63 73 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 66 6f 72 6d 73 2f 64 2f 65 2f 31 46 41 49 70 51 4c 53 64 67 51 43 54 47 36 76 2d 73 4f 68 41 6e 51 52 66 6e 72 31 45 71 4c 6a 66 2d 58 68 38 44 7a 61 2d 51 50 62 39 50 30 47 38 75 36 68 72 7a 4a 77 2f 76 69 65 77 66 6f 72 6d 3f 75 73 70 3d 73 65 6e 64 5f 66 6f 72 6d 26 61 6d 70 3b 75 73 70 3d 65 6d 62 65 64 5f 66 61 63 65 62 6f 6f 6b 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 Data Ascii: ><meta property="og:site_name" content="Google Docs"><meta property="og:url" content="https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform?usp=send_form&usp=embed_facebook"><meta property="og:image" conte

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:42 UTC	1431	OUT	POST /forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 3101 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform?usp=send_form Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=zdiKRCHJ3tyHo6aHNMqYF5w4r2sUFSTjH0JNG8V4pIA; COMPASS=spreadsheet_forms=CjIACWuJV2yfDDO4gBUVMbcficfzuNyXPLz3PQG6XtVMGoR6v9m-AzSKXHGKQX523kQQghD5oaWxBhpDAAlriVf_uEyL6ytzHZIkaS9RK0zJp7xFNfvESby3TfcQRIXOBVbKTa_M8hsfmtWlVIKXrtBAzkvCrgQ4KR0VoAjQmg==; NID=513=i8ExIPsOAm38AgKMPLpGado7xzNJCksWa4RxKFATTM17hWGz-wkVam66stJ1WLpQtzAgZ3jP4qAbQ3QpzJKUknhF_aYMqKG9xSZAnwMtZ6l4wH1oDg2wkc1F6H3mG0d-ESA9VkJTCIrg6dyacsM9ZkLy9W3Pj_n63wWvlk_S9Ls
2024-04-24 17:35:42 UTC	3101	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 37 31 33 39 38 30 31 34 30 39 32 36 30 30 30 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 25 35 42 31 37 31 33 39 38 30 31 34 30 39 32 36 30 30 30 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 37 31 36 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 25 35 44 25 35 44 25 32 43 25 35 42 25 32 32 43 4d 2d 34 39 63 6d 78 32 34 55 44 46 57 62 63 53 67 41 64 41 77 51 4f 48 51 25 32 32 25 32 43 31 37 31 33 39 38 30 31 34 30 39 32 35 30 30 30 25 32 43 31 37 31 33 39 38 30 31 33 37 33 36 34 35 35 35 25 32 43 25 32 32 41 44 46 4e 2d 63 74 4d 32 6d 64 38 62 71 38 31 6f Data Ascii: impressionBatch=%5B%5B%5Bnull%2Cnull%2C1%2C1713980140926000%2Cnull%2Cnull%2Cnull%2C%5B%5B1713980140926000%5D%2Cnull%2C1%5D%2Cnull%2C716%2Cnull%2C1%2C1%5D%5D%2C%5B%22CM-49cmx24UDFWbcSgAdAwQOHQ%22%2C1713980140925000%2C1713980137364555%2C%22ADFN-ctM2md8bq81o
2024-04-24 17:35:42 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Apr 2024 17:35:42 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-q-b-NIaIY1D9ZSUoAS3Qug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:42 UTC	1416	OUT	POST /forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 246 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=zdiKRCHJ3tyHo6aHNMqYF5w4r2sUFSTjH0JNG8V4pIA; COMPASS=spreadsheet_forms=CjIACWuJV2yfDDO4gBUVMbcficfzuNyXPLz3PQG6XtVMGoR6v9m-AzSKXHGKQX523kQQghD5oaWxBhpDAAlriVf_uEyL6ytzHZIkaS9RK0zJp7xFNfvESby3TfcQRIXOBVbKTa_M8hsfmtWlVIKXrtBAzkvCrgQ4KR0VoAjQmg==; NID=513=i8ExIPsOAm38AgKMPLpGado7xzNJCksWa4RxKFATTM17hWGz-wkVam66stJ1WLpQtzAgZ3jP4qAbQ3QpzJKUknhF_aYMqKG9xSZAnwMtZ6l4wH1oDg2wkc1F6H3mG0d-ESA9VkJTCIrg6dyacsM9ZkLy9W3Pj_n63wWvlk_S9Ls
2024-04-24 17:35:42 UTC	246	OUT	Data Raw: 66 61 6d 69 6c 69 65 73 3d 41 6d 61 74 69 63 25 32 30 53 43 25 32 43 43 61 76 65 61 74 25 32 43 43 6f 6d 66 6f 72 74 61 61 25 32 43 45 42 25 32 30 47 61 72 61 6d 6f 6e 64 25 32 43 4c 65 78 65 6e 64 25 32 43 4c 6f 62 73 74 65 72 25 32 43 4c 6f 72 61 25 32 43 4d 65 72 72 69 77 65 61 74 68 65 72 25 32 43 4d 6f 6e 74 73 65 72 72 61 74 25 32 43 4e 75 6e 69 74 6f 25 32 43 4f 73 77 61 6c 64 25 32 43 50 61 63 69 66 69 63 6f 25 32 43 50 6c 61 79 66 61 69 72 25 32 30 44 69 73 70 6c 61 79 25 32 43 52 6f 62 6f 74 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 4d 6f 6e 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 53 65 72 69 66 25 32 43 53 70 65 63 74 72 61 6c 26 75 73 65 41 6c 6c 53 75 62 73 65 74 73 3d 74 72 75 65 26 66 6f 72 6d 61 74 3d 77 6f 66 66 32 Data Ascii: families=Amatic%20SC%2CCaveat%2CComfortaa%2CEB%20Garamond%2CLexend%2CLobster%2CLora%2CMerriweather%2CMontserrat%2CNunito%2COswald%2CPacifico%2CPlayfair%20Display%2CRoboto%2CRoboto%20Mono%2CRoboto%20Serif%2CSpectral&useAllSubsets=true&format=woff2
2024-04-24 17:35:42 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Apr 2024 17:35:42 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-24 17:35:42 UTC	583	IN	Data Raw: 37 30 30 36 0d 0a 29 5d 7d 27 0a 7b 22 66 6f 6e 74 4d 65 74 61 64 61 74 61 4d 61 70 22 3a 7b 22 43 61 76 65 61 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 66 6f 6e 74 46 61 63 65 73 22 3a 5b 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c Data Ascii: 7006)]}'{"fontMetadataMap":{"Caveat":{"documentFont":false,"fontFaces":[{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 6c 79 22 3a 22 43 61 76 65 61 74 20 52 65 67 75 6c 61 72 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 Data Ascii: ly":"Caveat Regular"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 Data Ascii: escender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 63 42 39 53 49 63 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 41 4c 4c 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 2a 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 Data Ascii: es":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjcB9SIc.woff2"}],"style":"normal","subset":"ALL","subsetValue":"*","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STypoAscende
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 22 63 79 72 69 6c 6c 69 63 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 Data Ascii: "cyrillic-ext","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePa
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 Data Ascii: false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gs
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 53 78 36 65 49 69 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 5f 45 58 54 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 Data Ascii: enuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjSx6eIipYQ.woff2"}],"style":"normal","subset":"CYRILLIC_EXT","subsetValue":"cyrillic-ext","weight":600,"weightedFontFamily":"Ca
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 4c 41 54 49 4e 5f 45 58 54 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 53 65 6d 69 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 Data Ascii: al","subset":"LATIN_EXT","subsetValue":"latin-ext","weight":600,"weightedFontFamily":"Caveat SemiBold"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"
2024-04-24 17:35:42 UTC	1255	IN	Data Raw: 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 36 30 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a Data Ascii: der":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":160,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:42 UTC	541	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://docs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 17:35:42 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Apr 2024 17:35:42 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:43 UTC	1010	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 2584 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=i8ExIPsOAm38AgKMPLpGado7xzNJCksWa4RxKFATTM17hWGz-wkVam66stJ1WLpQtzAgZ3jP4qAbQ3QpzJKUknhF_aYMqKG9xSZAnwMtZ6l4wH1oDg2wkc1F6H3mG0d-ESA9VkJTCIrg6dyacsM9ZkLy9W3Pj_n63wWvlk_S9Ls
2024-04-24 17:35:43 UTC	2584	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 31 33 39 38 30 31 34 30 39 32 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 31 37 31 33 39 38 30 31 34 30 39 32 36 30 30 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 31 37 31 33 39 38 30 31 34 30 39 32 36 30 30 30 5d 2c 6e 75 6c 6c 2c 31 5d 2c 6e 75 6c 6c 2c 37 31 36 2c 6e 75 6c 6c 2c 31 2c 31 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,null,[4,0,0,0,0]]],2035,[["1713980140928",null,null,null,null,null,null,"[[[null,null,1,1713980140926000,null,null,null,[[1713980140926000],null,1],null,716,null,1,1
2024-04-24 17:35:43 UTC	921	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c; expires=Thu, 24-Oct-2024 17:35:43 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Apr 2024 17:35:43 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 24 Apr 2024 17:35:43 GMT Connection: close Transfer-Encoding: chunked
2024-04-24 17:35:43 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-24 17:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:44 UTC	660	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c
2024-04-24 17:35:44 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Wed, 24 Apr 2024 17:35:44 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 17:35:44 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-24 17:35:44 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://forms.gle/ocmuQas5VxXUCyAA7

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Windows Analysis Report
https://forms.gle/ocmuQas5VxXUCyAA7

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:45 UTC	1417	OUT	POST /forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 8687 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSdgQCTG6v-sOhAnQRfnr1EqLjf-Xh8Dza-QPb9P0G8u6hrzJw/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=zdiKRCHJ3tyHo6aHNMqYF5w4r2sUFSTjH0JNG8V4pIA; COMPASS=spreadsheet_forms=CjIACWuJV2yfDDO4gBUVMbcficfzuNyXPLz3PQG6XtVMGoR6v9m-AzSKXHGKQX523kQQghD5oaWxBhpDAAlriVf_uEyL6ytzHZIkaS9RK0zJp7xFNfvESby3TfcQRIXOBVbKTa_M8hsfmtWlVIKXrtBAzkvCrgQ4KR0VoAjQmg==; NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c
2024-04-24 17:35:45 UTC	8687	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 34 31 25 32 43 6e 75 6c 6c 25 32 43 32 25 32 43 31 37 31 33 39 38 30 31 34 30 39 38 33 30 30 30 25 32 43 25 35 42 25 35 42 25 35 42 31 32 38 30 25 32 43 39 30 37 25 32 43 31 32 38 30 25 32 43 39 38 34 25 35 44 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 66 61 6c 73 65 25 32 43 74 72 75 65 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c Data Ascii: impressionBatch=%5B%5B%5B41%2Cnull%2C2%2C1713980140983000%2C%5B%5B%5B1280%2C907%2C1280%2C984%5D%2Cfalse%2Cnull%2Cnull%2C1%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cfalse%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5Bfalse%2Ctrue%5D%2Cnull%2Cnull
2024-04-24 17:35:45 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Apr 2024 17:35:45 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-Z34MLTAHeW1lJFlraKPHDg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:46 UTC	660	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c
2024-04-24 17:35:46 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Wed, 24 Apr 2024 17:35:46 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 17:35:46 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-24 17:35:46 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:50 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fegsLUo7tVF7xdr&MD=9hLEP1lf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-24 17:35:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 65ff9989-a540-4dd6-b3bc-eed6d55d6505 MS-RequestId: d32c9508-cf99-4233-8370-cdd6c110af1f MS-CV: auoHq8HqG0eXrWX3.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Apr 2024 17:35:50 GMT Connection: close Content-Length: 24490
2024-04-24 17:35:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-24 17:35:51 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:51 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 17:35:51 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=221248 Date: Wed, 24 Apr 2024 17:35:51 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:35:52 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 17:35:52 UTC	521	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: CC1186E36C704BA5AF8177F229D6CC87 Ref B: PAOEDGE0621 Ref C: 2023-04-04T13:32:33Z Cache-Control: public, max-age=221199 Date: Wed, 24 Apr 2024 17:35:52 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-24 17:35:52 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:36:28 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fegsLUo7tVF7xdr&MD=9hLEP1lf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-24 17:36:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 9ab3911d-f983-42d4-bd2d-4e5ebbd06e29 MS-RequestId: edf98e06-8473-4c64-a045-c122c2347b30 MS-CV: abOAlBXwEU2YTXdM.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Apr 2024 17:36:28 GMT Connection: close Content-Length: 25457
2024-04-24 17:36:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-24 17:36:29 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:37:08 UTC	1186	OUT	GET /url?sa=j&url=https%3A%2F%2Fapp.apollo.io%2F%23%2Fmeet%2Fdonald_groh_c7d%2F15-min&uct=1713980137&usg=M2OXYtYAnjvKqhH67N8pxf0eov4.&source=editors HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c
2024-04-24 17:37:09 UTC	1519	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIxYalsQYQnenRzQISBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-pCCtDQivxYKjvKNtOr3SeQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Wed, 24 Apr 2024 17:37:09 GMT Server: gws Content-Length: 577 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 17:37:09 UTC	577	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 72 6c 25 33 46 73 61 25 33 44 6a 25 32 36 75 72 6c 25 33 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:37:10 UTC	1396	OUT	GET /sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c
2024-04-24 17:37:10 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 17:37:10 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3532 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 17:37:10 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 72 6c 3f 73 61 3d 6a 26 61 6d 70 3b 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/url?sa=j&url=https%3A%2F%2Fap
2024-04-24 17:37:10 UTC	1255	IN	Data Raw: 20 6f 6e 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 Data Ascii: on your web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g
2024-04-24 17:37:10 UTC	1255	IN	Data Raw: 6d 61 6c 69 63 69 6f 75 73 20 62 65 68 61 76 69 6f 72 2e 20 54 68 69 73 20 70 61 67 65 20 63 68 65 63 6b 73 20 74 6f 20 73 65 65 20 69 66 20 69 74 27 73 20 72 65 61 6c 6c 79 20 61 20 68 75 6d 61 6e 20 73 65 6e 64 69 6e 67 20 74 68 65 20 72 65 71 75 65 73 74 73 20 61 6e 64 20 6e 6f 74 20 61 20 72 6f 62 6f 74 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 74 68 69 73 20 6e 65 74 77 6f 72 6b 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 30 20 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a Data Ascii: malicious behavior. This page checks to see if it's really a human sending the requests and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0 15px 0; line-height:1.4em;">
2024-04-24 17:37:10 UTC	123	IN	Data Raw: 5f 63 37 64 25 32 46 31 35 2d 6d 69 6e 26 61 6d 70 3b 75 63 74 3d 31 37 31 33 39 38 30 31 33 37 26 61 6d 70 3b 75 73 67 3d 4d 32 4f 58 59 74 59 41 6e 6a 76 4b 71 68 48 36 37 4e 38 70 78 66 30 65 6f 76 34 2e 26 61 6d 70 3b 73 6f 75 72 63 65 3d 65 64 69 74 6f 72 73 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: _c7d%2F15-min&uct=1713980137&usg=M2OXYtYAnjvKqhH67N8pxf0eov4.&source=editors<br></div></div></body></html>

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:37:10 UTC	1228	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c
2024-04-24 17:37:11 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 24 Apr 2024 17:37:11 GMT Date: Wed, 24 Apr 2024 17:37:11 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-24 17:37:11 UTC	727	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-04-24 17:37:11 UTC	502	IN	Data Raw: 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 41 32 33 36 4a 2f 5a 55 67 55 2b 30 2f 4f 36 62 2f Data Ascii: cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-A236J/ZUgU+0/O6b/
2024-04-24 17:37:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-24 17:37:13 UTC	1835	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=sFHmyt4kVc9ZX4NceBA9cKwkM4C2RzPyF-AFFdPhmSpYN534K9kUflk1DxepUKHbztd8Nq4pXXlfiBUFyl17-Wz33yOCNKg2fd_g4Uisf_IK-CER-GZh7VgvaeW826p59ZDyJFaoVunxnNaKyui4oSO5jXKdLRXexyiEQe5WP69fkoiwqI6J32ImBtISjnU3JKQ7AFcQUOCvXQcAMfDDaXS3IUUS6uf_sT5UQM5O01Plv8Da810e1_qk9XQQ_CR4I1__SKYTJBf9jXypHE1CR4TlijXj1j4&cb=22uzsod8u5h0 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/url%3Fsa%3Dj%26url%3Dhttps%253A%252F%252Fapp.apollo.io%252F%2523%252Fmeet%252Fdonald_groh_c7d%252F15-min%26uct%3D1713980137%26usg%3DM2OXYtYAnjvKqhH67N8pxf0eov4.%26source%3Deditors&q=EgSaEGkkGMWGpbEGIjC1yLfVYFAOAJsat_ndya-GeqghouyFfJ9gMl_SqWH8-xsyCLdPK5YPx61ewzBV3tcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=hkwwlew1-nehKourTvGGQjHCEESnzQRIArxySm5DnRFsRtmxicoDnUGxTaq1OHluqfcJuWlASKy-mRr-OvNfvZl_F0ymnfHN8KiD6l-Ijv6r3yHDeYeBRVcqJhvNIrMzx2UX6-zu7_0RJCJul_Ri21jP6pW171tdRR0tfvBBV5c
2024-04-24 17:37:13 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Apr 2024 17:37:13 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-aQInhrYno_CNT8fkvRsilA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-24 17:37:13 UTC	364	IN	Data Raw: 32 61 64 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2ad8<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 Data Ascii: 18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//font
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 Data Ascii: +04B0-04B1, U+2116;}/* greek-ext /@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/ greek
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 Data Ascii: e { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: ic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 51 6f 75 6b 48 35 6a 53 4f 33 73 4b 46 7a 56 45 41 37 56 63 38 56 67 43 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 61 51 49 6e 68 72 59 6e 6f 5f 43 4e 54 38 66 6b 76 52 73 69 6c 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d Data Ascii: </style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/styles__ltr.css"><script nonce="aQInhrYno_CNT8fkvRsilA" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 6d 54 30 43 47 74 2d 39 31 43 74 2d 52 6b 77 78 4a 74 61 49 4b 43 58 68 4b 6a 4f 35 37 2d 63 5a 30 33 42 59 61 45 44 44 70 76 74 36 4c 36 43 61 62 73 51 51 67 57 7a 2d 49 5f 58 4c 71 33 51 2d 6b 32 43 32 30 7a 4b 69 54 6f 6e 78 30 65 71 70 75 34 48 78 73 4e 33 79 63 78 34 75 71 43 56 30 48 49 72 45 56 42 41 46 46 48 52 48 37 4e 48 41 48 74 42 57 78 35 44 57 41 47 6f 53 46 37 36 4b 37 49 54 72 5f 68 68 50 38 54 34 75 57 5f 62 5f 33 51 50 70 33 72 69 4c 69 69 47 59 41 57 55 42 62 4a 33 69 49 64 43 41 4e 7a 44 6a 70 74 69 6d 44 77 78 69 6c 70 61 4e 30 54 73 57 77 76 53 50 56 63 5f 4b 68 32 34 4f 34 6e 5f 6e 6b 73 51 51 43 5a 4c 6f 6b 69 5a 7a 31 7a 38 54 69 59 52 4d 6f 68 6e 52 6b 36 4f 55 45 47 7a 55 6f 58 54 4d 36 46 5f 56 4f 41 50 72 4e 47 48 74 6c 44 65 Data Ascii: mT0CGt-91Ct-RkwxJtaIKCXhKjO57-cZ03BYaEDDpvt6L6CabsQQgWz-I_XLq3Q-k2C20zKiTonx0eqpu4HxsN3ycx4uqCV0HIrEVBAFFHRH7NHAHtBWx5DWAGoSF76K7ITr_hhP8T4uW_b_3QPp3riLiiGYAWUBbJ3iIdCANzDjptimDwxilpaN0TsWwvSPVc_Kh24O4n_nksQQCZLokiZz1z8TiYRMohnRk6OUEGzUoXTM6F_VOAPrNGHtlDe
2024-04-24 17:37:13 UTC	1255	IN	Data Raw: 49 30 54 53 4c 52 6f 67 6f 72 39 64 75 6a 68 63 2d 4f 35 31 33 41 45 77 49 30 6b 64 69 6a 5f 35 4c 65 77 51 39 77 53 6f 57 77 71 2d 6b 68 59 56 61 5a 4f 46 56 45 79 42 76 38 49 72 4b 6c 63 35 44 65 46 58 33 4c 6b 6c 37 46 31 50 56 4e 39 45 5f 44 50 33 32 4f 76 6b 4b 69 68 42 64 79 2d 61 39 6f 5f 5a 67 48 6a 77 79 6c 75 66 33 43 77 43 71 6b 67 69 73 50 61 35 77 53 30 37 4d 46 31 4e 5a 39 68 54 63 46 61 79 36 35 56 53 58 68 7a 5f 54 44 5f 38 6d 58 66 76 6c 62 46 63 30 76 6e 30 69 76 63 58 58 77 42 31 68 4e 6e 4b 36 45 75 38 6b 78 46 67 35 65 55 63 4b 67 51 74 37 62 5a 56 61 57 4a 5a 44 77 79 63 73 55 31 5a 79 6f 72 79 49 47 66 78 69 79 41 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d Data Ascii: I0TSLRogor9dujhc-O513AEwI0kdij_5LewQ9wSoWwq-khYVaZOFVEyBv8IrKlc5DeFX3Lkl7F1PVN9E_DP32OvkKihBdy-a9o_ZgHjwyluf3CwCqkgisPa5wS07MF1NZ9hTcFay65VSXhz_TD_8mXfvlbFc0vn0ivcXXwB1hNnK6Eu8kxFg5eUcKgQt7bZVaWJZDwycsU1ZyoryIGfxiyA"><script type="text/javascript" nonce=
2024-04-24 17:37:13 UTC	572	IN	Data Raw: 74 6c 51 30 74 68 54 6e 68 79 52 32 4e 43 56 55 56 6e 61 58 56 53 55 6d 4d 72 63 6b 68 58 62 6b 4a 34 55 33 6b 35 4d 69 74 75 62 46 5a 36 55 57 46 34 5a 31 6c 46 54 55 78 71 53 7a 6c 54 63 6b 78 7a 64 6e 70 6f 64 47 55 77 65 6c 64 30 4d 32 68 56 54 54 68 68 4d 30 78 6a 51 55 6b 72 56 58 64 68 4e 32 74 79 56 55 31 54 62 44 63 33 56 33 70 47 4d 6c 5a 6c 63 45 70 43 57 6e 68 43 4f 57 56 6e 61 54 52 6a 4c 33 6c 6a 62 55 4a 4f 63 6b 35 53 4d 48 52 76 61 6e 45 33 4d 6b 35 73 64 6b 68 42 63 47 73 35 64 6a 6b 79 51 32 6c 42 56 45 78 4f 4b 32 73 35 57 58 70 57 5a 46 4e 53 4e 79 74 71 53 46 49 77 56 31 42 75 4d 6a 4e 42 52 56 6b 72 55 54 68 71 5a 32 46 46 61 32 4e 4c 61 54 6b 72 51 6b 5a 30 53 33 6c 75 5a 31 55 35 65 47 52 53 59 57 5a 4f 59 6b 39 74 65 48 46 45 51 Data Ascii: tlQ0thTnhyR2NCVUVnaXVSUmMrckhXbkJ4U3k5MitubFZ6UWF4Z1lFTUxqSzlTckxzdnpodGUweld0M2hVTThhM0xjQUkrVXdhN2tyVU1TbDc3V3pGMlZlcEpCWnhCOWVnaTRjL3ljbUJOck5SMHRvanE3Mk5sdkhBcGs5djkyQ2lBVExOK2s5WXpWZFNSNytqSFIwV1BuMjNBRVkrUThqZ2FFa2NLaTkrQkZ0S3luZ1U5eGRSYWZOYk9teHFEQ