Edit tour

Windows Analysis Report
https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuX

Overview

General Information

Sample URL:	https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW
Analysis ID:	1310752
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

chrome.exe (PID: 512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1808,i,10018836059509693255,16172007586500317314,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.102Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi HTTP/1.1Host: us-west-2.protection.sophos.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d/forum/customer-service5297nivc HTTP/1.1Host: groups.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E
Source: global traffic	HTTP traffic detected: GET /g/customer-service5297nivc HTTP/1.1Host: groups.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "104.0.5112.102"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "8.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.vIVemAYlBvo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_eZqauDOH0vAaumGJQwp71CTPx9g/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.102"sec-ch-ua-platform-version: "8.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://groups.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.vIVemAYlBvo.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_eZqauDOH0vAaumGJQwp71CTPx9g/cb=gapi.loaded_1 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.102"sec-ch-ua-platform-version: "8.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://groups.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /js/googleapis.proxy.js?onload=startup HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://content-people-pa.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /_/GroupsFrontendUi/data/batchexecute?rpcids=FEQDwf&source-path=%2Fg%2Fcustomer-service5297nivc&f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=52241&rt=c HTTP/1.1Host: groups.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.vIVemAYlBvo.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_eZqauDOH0vAaumGJQwp71CTPx9g/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://content-people-pa.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /_/GroupsFrontendUi/manifest.json HTTP/1.1Host: groups.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "104.0.5112.102"sec-ch-ua-platform-version: "8.0.0"sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://groups.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
Source: global traffic	HTTP traffic detected: GET /_/GroupsFrontendUi/browserinfo?f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=152241&rt=j HTTP/1.1Host: groups.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk; OTZ=7213711_48_52_123900_48_436380
Source: global traffic	HTTP traffic detected: GET /_/GroupsFrontendUi/browserinfo?f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=252241&rt=j HTTP/1.1Host: groups.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk; OTZ=7213711_48_52_123900_48_436380

Source: unknown

DNS traffic detected: queries for: us-west-2.protection.sophos.com

Source: chromecache_84.2.dr

String found in binary or memory: disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""}, equals www.youtube.com (Youtube)

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: chromecache_85.2.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_102.2.dr	String found in binary or memory: http://localhost.corp.google.com/inapp/%
Source: chromecache_102.2.dr	String found in binary or memory: http://localhost.proxy.googlers.com/inapp/%
Source: chromecache_83.2.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_83.2.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_83.2.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_83.2.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_79.2.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_85.2.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_85.2.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_84.2.dr, chromecache_92.2.dr, chromecache_79.2.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_91.2.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_102.2.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_84.2.dr	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js
Source: chromecache_105.2.dr	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js?onload=startup
Source: chromecache_102.2.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/%
Source: chromecache_102.2.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/%
Source: chromecache_84.2.dr	String found in binary or memory: https://classroom.google.com/sharewidget?usegapi=1
Source: chromecache_84.2.dr	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1
Source: chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr, chromecache_85.2.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_85.2.dr	String found in binary or memory: https://console.developers.google.com/
Source: chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr, chromecache_85.2.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_85.2.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_97.2.dr, chromecache_92.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_84.2.dr	String found in binary or memory: https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1
Source: chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/
Source: chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/api-client-library/javascript/reference/referencedocs
Source: chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/gis-migration)
Source: chromecache_85.2.dr	String found in binary or memory: https://developers.googleblog.com/2018/03/discontinuing-support-for-json-rpc-and.html
Source: chromecache_97.2.dr, chromecache_92.2.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_84.2.dr	String found in binary or memory: https://drive.google.com/savetodrivebutton?usegapi=1
Source: chromecache_84.2.dr	String found in binary or memory: https://families.google.com/webcreation?usegapi=1&usegapi=1
Source: chromecache_102.2.dr	String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_102.2.dr	String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_102.2.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_102.2.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_79.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_79.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_79.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_79.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_102.2.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_102.2.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/%
Source: chromecache_102.2.dr	String found in binary or memory: https://localhost.corp.google.com/inapp/%
Source: chromecache_102.2.dr	String found in binary or memory: https://localhost.proxy.googlers.com/inapp/%
Source: chromecache_84.2.dr	String found in binary or memory: https://pay.google.com/gp/v/widget/save
Source: chromecache_79.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_84.2.dr	String found in binary or memory: https://play.google.com/work/embedded/search?usegapi=1&usegapi=1
Source: chromecache_92.2.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_83.2.dr	String found in binary or memory: https://policies.google.com/privacy?hl=
Source: chromecache_83.2.dr	String found in binary or memory: https://policies.google.com/terms?hl=
Source: chromecache_102.2.dr	String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_102.2.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_102.2.dr	String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_85.2.dr	String found in binary or memory: https://ssl.gstatic.com/gb/js/
Source: chromecache_102.2.dr	String found in binary or memory: https://ssl.gstatic.com/guidedhelp/runtime/guided_help.js
Source: chromecache_102.2.dr	String found in binary or memory: https://ssl.gstatic.com/guidedhelp/runtime_staging/guided_help.js
Source: chromecache_84.2.dr	String found in binary or memory: https://ssl.gstatic.com/microscope/embed/
Source: chromecache_102.2.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_83.2.dr	String found in binary or memory: https://support.google.com/a/answer/9821037
Source: chromecache_83.2.dr	String found in binary or memory: https://support.google.com/groups
Source: chromecache_102.2.dr	String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_84.2.dr	String found in binary or memory: https://talkgadget.google.com/:session_prefix:talkgadget/_/widget
Source: chromecache_102.2.dr	String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_91.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_102.2.dr	String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_83.2.dr, chromecache_91.2.dr, chromecache_79.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_84.2.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/badge?usegapi=1
Source: chromecache_84.2.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/optin?usegapi=1
Source: chromecache_102.2.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_102.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_102.2.dr	String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_85.2.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.login
Source: chromecache_92.2.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_92.2.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_83.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_79.2.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_79.2.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_79.2.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chromecache_84.2.dr	String found in binary or memory: https://www.gstatic.com/partners/badge/templates/badge.html?usegapi=1
Source: chromecache_102.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_102.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: chromecache_102.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/%
Source: chromecache_84.2.dr	String found in binary or memory: https://www.youtube.com/subscribe_embed?usegapi=1

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9

Source: classification engine

Classification label: clean0.win@19/34@24/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1808,i,10018836059509693255,16172007586500317314,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1808,i,10018836059509693255,16172007586500317314,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://www.broofa.com	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/lcreport/	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
http://polymer.github.io/LICENSE.txt	0%	URL Reputation	safe
http://polymer.github.io/LICENSE.txt	0%	URL Reputation	safe
https://localhost.proxy.googlers.com/inapp/%	0%	Avira URL Cloud	safe
http://localhost.proxy.googlers.com/inapp/%	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
beacons3.gvt2.com	142.251.40.131	true	false	unknown
groups-alv.google.com	216.239.38.177	true	false	high
google.com	142.251.40.206	true	false	high
accounts.google.com	142.250.176.205	true	false	high
d2t07dpvw9bt1v.cloudfront.net	13.226.34.90	true	false	high
plus.l.google.com	142.250.81.238	true	false	high
play.google.com	142.251.35.174	true	false	high
beacons-handoff.gcp.gvt2.com	108.177.122.94	true	false	unknown
www.google.com	142.250.80.36	true	false	high
clients.l.google.com	142.250.65.238	true	false	high
us-west-2.protection.sophos.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
groups.google.com	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://apis.google.com/js/googleapis.proxy.js?onload=startup	false	high
https://groups.google.com/_/GroupsFrontendUi/browserinfo?f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=252241&rt=j	false	high
https://groups.google.com/_/GroupsFrontendUi/data/batchexecute?rpcids=FEQDwf&source-path=%2Fg%2Fcustomer-service5297nivc&f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=52241&rt=c	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.vIVemAYlBvo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_eZqauDOH0vAaumGJQwp71CTPx9g/cb=gapi.loaded_0	false	high
https://groups.google.com/g/customer-service5297nivc	false	high
https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi	false	high
https://groups.google.com/g/customer-service5297nivc	false	high
https://groups.google.com/d/forum/customer-service5297nivc	false	high
https://groups.google.com/_/GroupsFrontendUi/browserinfo?f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=152241&rt=j	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.vIVemAYlBvo.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_eZqauDOH0vAaumGJQwp71CTPx9g/cb=gapi.loaded_0?le=scs	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://google.com/domainreliability/upload	false	high
https://groups.google.com/_/GroupsFrontendUi/manifest.json	false	high
https://play.google.com/log?hasfast=true&authuser=0&format=json	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.vIVemAYlBvo.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_eZqauDOH0vAaumGJQwp71CTPx9g/cb=gapi.loaded_1	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.broofa.com	chromecache_79.2.dr	false	URL Reputation: safe	unknown
https://apis.google.com/js/client.js	chromecache_102.2.dr	false		high
http://localhost.corp.google.com/inapp/%	chromecache_102.2.dr	false		high
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_102.2.dr	false		high
https://accounts.google.com/o/oauth2/iframe	chromecache_85.2.dr	false		high
https://apis.google.com/js/googleapis.proxy.js	chromecache_84.2.dr	false		high
https://policies.google.com/terms?hl=	chromecache_83.2.dr	false		high
https://www.google.com/log?format=json&hasfast=true	chromecache_83.2.dr, chromecache_91.2.dr, chromecache_79.2.dr	false		high
https://console.developers.google.com/	chromecache_85.2.dr	false		high
https://support.google.com/inapp/%	chromecache_102.2.dr	false		high
https://accounts.google.com/o/oauth2/postmessageRelay	chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr	false		high
https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1	chromecache_84.2.dr	false		high
https://asx-frontend-staging.corp.google.com/inapp/%	chromecache_102.2.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr	false		high
https://support.google.com/a/answer/9821037	chromecache_83.2.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_83.2.dr	false	URL Reputation: safe	unknown
https://support.google.com/	chromecache_102.2.dr	false		high
https://www.google.com/shopping/customerreviews/badge?usegapi=1	chromecache_84.2.dr	false		high
https://csp.withgoogle.com/csp/lcreport/	chromecache_97.2.dr, chromecache_92.2.dr	false	URL Reputation: safe	unknown
https://pay.google.com/gp/v/widget/save	chromecache_84.2.dr	false		high
https://drive.google.com/savetodrivebutton?usegapi=1	chromecache_84.2.dr	false		high
https://scone-pa.clients6.google.com	chromecache_102.2.dr	false		high
https://accounts.google.com/o/oauth2/auth	chromecache_85.2.dr	false		high
https://www.google.com/shopping/customerreviews/optin?usegapi=1	chromecache_84.2.dr	false		high
https://developers.google.com/api-client-library/javascript/reference/referencedocs	chromecache_85.2.dr	false		high
https://localhost.proxy.googlers.com/inapp/%	chromecache_102.2.dr	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_84.2.dr, chromecache_92.2.dr, chromecache_79.2.dr	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_83.2.dr	false	URL Reputation: safe	unknown
https://developers.google.com/	chromecache_85.2.dr	false		high
https://domains.google.com/suggest/flow	chromecache_97.2.dr, chromecache_92.2.dr	false		high
https://developers.google.com/identity/gsi/web/guides/gis-migration)	chromecache_85.2.dr	false		high
https://feedback2-test.corp.google.com/inapp/%	chromecache_102.2.dr	false		high
https://www.google.com/tools/feedback	chromecache_102.2.dr	false		high
https://sandbox.google.com/inapp/%	chromecache_102.2.dr	false		high
https://classroom.google.com/sharewidget?usegapi=1	chromecache_84.2.dr	false		high
https://apis.google.com/js/api.js	chromecache_91.2.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_83.2.dr	false	URL Reputation: safe	unknown
https://developers.googleblog.com/2018/03/discontinuing-support-for-json-rpc-and.html	chromecache_85.2.dr	false		high
https://feedback2-test.corp.googleusercontent.com/inapp/%	chromecache_102.2.dr	false		high
https://www.youtube.com/subscribe_embed?usegapi=1	chromecache_84.2.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_83.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.google.cn/tools/feedback/%	chromecache_102.2.dr	false		high
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_102.2.dr	false		high
https://www.google.com/tools/feedback/help_panel_binary.js	chromecache_102.2.dr	false		high
https://localhost.corp.google.com/inapp/%	chromecache_102.2.dr	false		high
https://plus.google.com	chromecache_92.2.dr	false		high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_91.2.dr	false		high
https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1	chromecache_84.2.dr	false		high
https://test-scone-pa-googleapis.sandbox.google.com	chromecache_102.2.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_79.2.dr	false		high
http://localhost.proxy.googlers.com/inapp/%	chromecache_102.2.dr	false	Avira URL Cloud: safe	unknown
https://sandbox.google.com/tools/feedback/%	chromecache_102.2.dr	false		high
https://asx-frontend-staging.corp.google.com/tools/feedback/%	chromecache_102.2.dr	false		high
https://talkgadget.google.com/:session_prefix:talkgadget/_/widget	chromecache_84.2.dr	false		high
https://play.google.com/work/embedded/search?usegapi=1&usegapi=1	chromecache_84.2.dr	false		high
https://policies.google.com/privacy?hl=	chromecache_83.2.dr	false		high
https://support.google.com/groups	chromecache_83.2.dr	false		high
https://www.google.com/tools/feedback/%	chromecache_102.2.dr	false		high
https://families.google.com/webcreation?usegapi=1&usegapi=1	chromecache_84.2.dr	false		high
https://clients6.google.com	chromecache_97.2.dr, chromecache_84.2.dr, chromecache_92.2.dr, chromecache_85.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.176.196	unknown	United States	15169	GOOGLEUS	false
142.251.40.206	google.com	United States	15169	GOOGLEUS	false
142.250.176.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.81.238	plus.l.google.com	United States	15169	GOOGLEUS	false
13.226.34.90	d2t07dpvw9bt1v.cloudfront.net	United States	16509	AMAZON-02US	false
216.239.38.177	groups-alv.google.com	United States	15169	GOOGLEUS	false
142.250.65.238	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.35.174	play.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1310752
Start date and time:	2023-09-19 14:30:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@19/34@24/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.65.195, 34.104.35.123, 142.250.80.74, 142.251.40.106, 142.250.65.202, 142.250.64.74, 142.250.176.202, 142.250.65.234, 142.251.41.10, 142.251.40.234, 142.251.40.138, 142.250.81.234, 142.251.40.202, 142.251.32.106, 142.251.35.170, 142.250.80.106, 142.250.65.170, 142.251.40.170, 142.250.80.42, 172.217.165.138, 142.250.72.99, 142.250.80.35
Excluded domains from analysis (whitelisted): ssl.gstatic.com, fs.microsoft.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.gstatic.com, content-people-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	798
Entropy (8bit):	7.661611811101125
Encrypted:	false
SSDEEP:	12:6v/7WNtpMtxQtIp16cFS3CmTDlHwZWwyeF/L8iXj4l4Ef3MbIZ3cEwpkOzGLQ0XX:9DMn51xW5TBIWP+jDXSKAMzi4SQYYXC
MD5:	FDCE4221371AFE33E5D27E42783DC20D
SHA1:	BD712404EDCB6CA5F271EF0A227A556603714877
SHA-256:	568F6F61B573A37582704C66891F123C9AE3E2D0BCA46ED562539D7CDEA238DB
SHA-512:	1BB6CEA6BC9844FE35CA56C36E84278F538B3858BDB285983DE055AABBC050139E91DE01E54323AB3FEE43F53ACBE07F923F867E02AF0A30694B7B1645BA58AF
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/i/productlogos/groups/v9/web-48dp/logo_groups_color_1x_web_48dp.png
Preview:	.PNG........IHDR...0...0.....W.......IDATx..X...A..m..El..,b.R.Jq.R.m.?v.\|....>f....^..^.Of.....-...b4.).6.`Y.E..-j.......z..EB.]VJI3.@SO..P..E...K../B....-..r......:...b..^.._B=...t..,&..A..Q5...z.-f..:,&..C.z..4r...P..(ZL4.H5..0A..K..B..G.=.`.9l.."...+.....J..:9.SX...Z...h.3...m%..j.B:?B....9..<.....4.GP..T;W..@Iw7..# .fGQ#G(.<.......;I.5V...=...i..vI#U....$mp..ij.......".....Q%.[..2b...t.O08+...x......!....D...N.3y..]..l..7.B.n.M....:...}.......i.Tu?.0....E..u.19..^.S....k.%&>....d....v.....\|^..i.`.......T..<.W..:.9.woU.....Q....y.tw......F....<.(=.q$w..Le.p..\U..{.Xl.=..:..,..<M.-v8.....u..`.`q^.^....D.h..h.......9.........2.N...e&?v..0.a.x...Q......co..7...?Yb..M....a%..yx.O........y@.......B..y.....E5.h....w.>.....9F..a..WH@..k.......IEND.B`.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 19, 2023 14:30:35.293636084 CEST	58393	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:35.293692112 CEST	52328	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:35.315289974 CEST	55839	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:35.388089895 CEST	53	52328	1.1.1.1	192.168.2.3
Sep 19, 2023 14:30:35.395678043 CEST	53	58393	1.1.1.1	192.168.2.3
Sep 19, 2023 14:30:35.406526089 CEST	53	55839	1.1.1.1	192.168.2.3
Sep 19, 2023 14:30:36.631218910 CEST	50842	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:36.723056078 CEST	53	50842	1.1.1.1	192.168.2.3
Sep 19, 2023 14:30:39.563133001 CEST	57631	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:39.654577971 CEST	53	57631	1.1.1.1	192.168.2.3
Sep 19, 2023 14:30:39.746104956 CEST	49920	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:39.838541031 CEST	53	49920	1.1.1.1	192.168.2.3
Sep 19, 2023 14:30:39.847027063 CEST	51850	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:39.940080881 CEST	53	51850	1.1.1.1	192.168.2.3
Sep 19, 2023 14:30:40.873043060 CEST	53558	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:30:40.964832067 CEST	53	53558	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:42.153413057 CEST	49601	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:42.245311022 CEST	53	49601	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:43.161171913 CEST	49601	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:43.259200096 CEST	53	49601	9.9.9.9	192.168.2.3
Sep 19, 2023 14:31:43.796875954 CEST	63656	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:43.898235083 CEST	53	63656	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:44.154788017 CEST	63356	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:44.163748026 CEST	49601	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:44.245934963 CEST	53	63356	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:44.261127949 CEST	53	49601	9.9.9.9	192.168.2.3
Sep 19, 2023 14:31:44.777348042 CEST	60569	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:44.868550062 CEST	53	60569	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:45.784266949 CEST	60569	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:45.882173061 CEST	53	60569	9.9.9.9	192.168.2.3
Sep 19, 2023 14:31:46.174192905 CEST	49601	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:46.174249887 CEST	49601	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:46.266232967 CEST	53	49601	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:46.272241116 CEST	53	49601	9.9.9.9	192.168.2.3
Sep 19, 2023 14:31:46.796962976 CEST	60569	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:46.894714117 CEST	53	60569	9.9.9.9	192.168.2.3
Sep 19, 2023 14:31:48.797359943 CEST	60569	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:48.797389030 CEST	60569	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:48.888961077 CEST	53	60569	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:48.894932032 CEST	53	60569	9.9.9.9	192.168.2.3
Sep 19, 2023 14:31:50.177541018 CEST	49601	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:50.177664042 CEST	49601	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:50.269537926 CEST	53	49601	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:50.275521994 CEST	53	49601	9.9.9.9	192.168.2.3
Sep 19, 2023 14:31:52.794918060 CEST	60569	53	192.168.2.3	1.1.1.1
Sep 19, 2023 14:31:52.794975042 CEST	60569	53	192.168.2.3	9.9.9.9
Sep 19, 2023 14:31:52.886569977 CEST	53	60569	1.1.1.1	192.168.2.3
Sep 19, 2023 14:31:52.893205881 CEST	53	60569	9.9.9.9	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:36 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E
2023-09-19 12:30:36 UTC	0	OUT	Data Raw: 20 Data Ascii:
2023-09-19 12:30:36 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:30:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--1WrTJdPpc4tiQ8awAZ0cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:30:36 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-09-19 12:30:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:36 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.102 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-09-19 12:30:36 UTC	2	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-itlEOcdOMFjYSeT3fY0JMg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:30:36 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6105 X-Daystart: 19836 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:30:36 UTC	3	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 30 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 39 38 33 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6105" elapsed_seconds="19836"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-09-19 12:30:36 UTC	3	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-09-19 12:30:36 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:42 UTC	750	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 946 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.102" sec-ch-ua-platform-version: "8.0.0" X-Goog-AuthUser: 0 sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: / Origin: https://groups.google.com X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swB Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://groups.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:30:42 UTC	751	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 67 72 6f 75 70 73 66 72 6f 6e 74 65 6e 64 73 65 72 76 65 72 5f 32 30 32 33 30 39 30 37 2e 30 35 5f 70 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 38 37 33 2c 5b 5b 22 31 36 39 35 31 32 36 36 34 30 31 31 38 22 2c 6e 75 6c 6c 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 2d 37 32 30 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"boq_groupsfrontendserver_20230907.05_p0",null,null,[1,0,0,0,0]]],873,[["1695126640118",null,[],null,null,null,null,null,null,null,null,null,null,null,-7200,null,null,null,
2023-09-19 12:30:42 UTC	754	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://groups.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Sep 2023 12:30:42 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:30:42 UTC	754	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2023-09-19 12:30:42 UTC	754	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:42 UTC	752	OUT	POST /_/GroupsFrontendUi/data/batchexecute?rpcids=FEQDwf&source-path=%2Fg%2Fcustomer-service5297nivc&f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=52241&rt=c HTTP/1.1 Host: groups.google.com Connection: keep-alive Content-Length: 124 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" X-Same-Domain: 1 sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.102" sec-ch-ua-platform-version: "8.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: / Origin: https://groups.google.com X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swB Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://groups.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:30:42 UTC	754	OUT	Data Raw: 66 2e 72 65 71 3d 25 35 42 25 35 42 25 35 42 25 32 32 46 45 51 44 77 66 25 32 32 25 32 43 25 32 32 25 35 42 25 35 43 25 32 32 63 75 73 74 6f 6d 65 72 2d 73 65 72 76 69 63 65 35 32 39 37 6e 69 76 63 25 34 30 67 6f 6f 67 6c 65 67 72 6f 75 70 73 2e 63 6f 6d 25 35 43 25 32 32 25 35 44 25 32 32 25 32 43 6e 75 6c 6c 25 32 43 25 32 32 36 25 32 32 25 35 44 25 35 44 25 35 44 26 Data Ascii: f.req=%5B%5B%5B%22FEQDwf%22%2C%22%5B%5C%22customer-service5297nivc%40googlegroups.com%5C%22%5D%22%2Cnull%2C%226%22%5D%5D%5D&
2023-09-19 12:30:42 UTC	754	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:30:42 GMT Content-Disposition: attachment; filename="response.bin"; filename=UTF-8''response.bin X-Content-Type-Options: nosniff Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GroupsFrontendUi/cspreport Cross-Origin-Opener-Policy: same-origin-allow-popups Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:30:42 UTC	756	IN	Data Raw: 36 64 0d 0a 29 5d 7d 27 0a 0a 31 30 30 0a 5b 5b 22 77 72 62 2e 66 72 22 2c 22 46 45 51 44 77 66 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 37 5d Data Ascii: 6d)]}'100[["wrb.fr","FEQDwf",null,null,null,[7]
2023-09-19 12:30:42 UTC	756	IN	Data Raw: 2c 22 36 22 5d 2c 5b 22 64 69 22 2c 31 31 30 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 31 31 30 2c 22 32 37 36 35 30 30 30 39 33 35 32 36 31 32 35 38 38 34 33 22 2c 39 37 5d 5d 0a 0d 0a Data Ascii: ,"6"],["di",110],["af.httprm",110,"2765000935261258843",97]]
2023-09-19 12:30:42 UTC	756	IN	Data Raw: 31 62 0d 0a 32 35 0a 5b 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 33 36 5d 5d 0a 0d 0a Data Ascii: 1b25[["e",4,null,null,136]]
2023-09-19 12:30:42 UTC	756	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:42 UTC	756	OUT	GET /js/googleapis.proxy.js?onload=startup HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://content-people-pa.googleapis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:30:42 UTC	757	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Access-Control-Allow-Origin: * Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gapi-team" Report-To: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} Timing-Allow-Origin: * Content-Length: 18394 Date: Tue, 19 Sep 2023 12:30:42 GMT Expires: Tue, 19 Sep 2023 12:30:42 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 ETag: "b96f35aa726a3242" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-09-19 12:30:42 UTC	758	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 2c 67 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c Data Ascii: (function(){var aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},g="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.val
2023-09-19 12:30:42 UTC	759	IN	Data Raw: 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 67 6c 6f 62 61 6c 20 6f 62 6a 65 63 74 22 29 3b 0a 7d 2c 66 61 3d 65 61 28 74 68 69 73 29 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 66 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e Data Ascii: obal];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},fa=ea(this),h=function(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.len
2023-09-19 12:30:42 UTC	760	IN	Data Raw: 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 68 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 Data Ascii: lue for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};h("String.prototype.endsWith",function(a){return a?a:funct
2023-09-19 12:30:42 UTC	761	IN	Data Raw: 70 69 2e 4b 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 6e 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 70 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2c 6b 61 3d 30 2c 6c 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 4d 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 Data Ascii: pi.K=(new Date).getTime();/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0/var n=this\|\|self,p="closure_uid_"+(1E9Math.random()>>>0),ka=0,la=function(a,b){function c(){}c.prototype=b.prototype;a.M=b.prototype;a.prototype
2023-09-19 12:30:42 UTC	762	IN	Data Raw: 70 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 48 2e 74 6f 53 74 72 69 6e 67 28 29 7d 3b 6e 65 77 20 70 61 3b 76 61 72 20 71 61 3d 7b 7d 2c 72 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 71 61 21 3d 3d 71 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 53 61 66 65 53 74 79 6c 65 53 68 65 65 74 20 69 73 20 6e 6f 74 20 6d 65 61 6e 74 20 74 6f 20 62 65 20 62 75 69 6c 74 20 64 69 72 65 63 74 6c 79 22 29 3b 74 68 69 73 2e 47 3d 22 22 7d 3b 72 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 47 2e 74 6f 53 74 72 69 6e 67 28 29 7d 3b 6e 65 77 20 72 61 3b 76 61 72 20 73 61 3d 7b 7d 2c 74 61 3d Data Ascii: pa.prototype.toString=function(){return this.H.toString()};new pa;var qa={},ra=function(){if(qa!==qa)throw Error("SafeStyleSheet is not meant to be built directly");this.G=""};ra.prototype.toString=function(){return this.G.toString()};new ra;var sa={},ta=
2023-09-19 12:30:42 UTC	764	IN	Data Raw: 76 61 72 20 63 3d 61 2e 65 6e 74 72 69 65 73 5b 62 5d 3b 69 66 28 63 29 72 65 74 75 72 6e 20 63 3b 63 3d 49 28 61 2c 62 2e 73 6c 69 63 65 28 30 2c 4d 61 74 68 2e 6d 61 78 28 62 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2e 22 29 2c 30 29 29 29 3b 76 61 72 20 64 3d 0a 6e 65 77 20 78 61 28 62 2c 63 29 3b 61 2e 65 6e 74 72 69 65 73 5b 62 5d 3d 64 3b 63 2e 63 68 69 6c 64 72 65 6e 2e 70 75 73 68 28 64 29 3b 72 65 74 75 72 6e 20 64 7d 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 48 7c 7c 28 48 3d 6e 65 77 20 41 61 29 3b 72 65 74 75 72 6e 20 48 7d 3b 2f 2a 0a 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 42 61 3d 5b 5d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: var c=a.entries[b];if(c)return c;c=I(a,b.slice(0,Math.max(b.lastIndexOf("."),0)));var d=new xa(b,c);a.entries[b]=d;c.children.push(d);return d},J=function(){H\|\|(H=new Aa);return H};/* SPDX-License-Identifier: Apache-2.0*/var Ba=[],Ca=function(a){var
2023-09-19 12:30:42 UTC	766	IN	Data Raw: 68 3d 28 5b 5e 26 23 5d 2a 29 22 2c 22 67 22 29 3b 69 66 28 61 3d 61 26 26 28 63 2e 65 78 65 63 28 61 29 7c 7c 64 2e 65 78 65 63 28 61 29 29 29 74 72 79 7b 62 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 5b 32 5d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 72 65 74 75 72 6e 20 62 7d 2c 4a 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 4d 28 52 2c 22 50 51 22 2c 5b 5d 29 3b 52 2e 50 51 3d 5b 5d 3b 76 61 72 20 63 3d 62 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3d 3d 3d 63 29 61 28 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 64 3d 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 2b 2b 64 3d 3d 3d 63 26 26 61 28 29 7d 2c 66 3d 30 3b 66 3c 63 3b 66 2b 2b 29 62 5b 66 5d 28 65 29 7d 2c 53 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e Data Ascii: h=([^&#]*)","g");if(a=a&&(c.exec(a)\|\|d.exec(a)))try{b=decodeURIComponent(a[2])}catch(e){}}return b},Ja=function(a){var b=M(R,"PQ",[]);R.PQ=[];var c=b.length;if(0===c)a();else for(var d=0,e=function(){++d===c&&a()},f=0;f<c;f++)b[f](e)},S=function(a){return
2023-09-19 12:30:42 UTC	767	IN	Data Raw: 20 70 72 6f 63 65 73 73 6f 72 20 66 6f 72 3a 20 22 2b 6b 29 3b 6c 7c 7c 57 28 22 66 61 69 6c 65 64 20 74 6f 20 67 65 6e 65 72 61 74 65 20 6c 6f 61 64 20 75 72 6c 22 29 3b 62 3d 6c 3b 63 3d 62 2e 6d 61 74 63 68 28 55 61 29 3b 28 64 3d 62 2e 6d 61 74 63 68 28 56 61 29 29 26 26 31 3d 3d 3d 64 2e 6c 65 6e 67 74 68 26 26 57 61 2e 74 65 73 74 28 62 29 26 26 63 26 26 31 3d 3d 3d 63 2e 6c 65 6e 67 74 68 7c 7c 57 28 22 66 61 69 6c 65 64 20 73 61 6e 69 74 79 3a 20 22 2b 61 29 3b 74 72 79 7b 61 3d 22 3f 22 3b 69 66 28 65 26 26 30 3c 65 2e 6c 65 6e 67 74 68 29 7b 63 3d 62 3d 30 3b 66 6f 72 28 64 3d 7b 7d 3b 63 3c 65 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 71 3d 65 5b 63 2b 2b 5d 3b 66 3d 76 6f 69 64 20 30 3b 6b 3d 74 79 70 65 6f 66 20 71 3b 66 3d 22 6f 62 6a 65 63 Data Ascii: processor for: "+k);l\|\|W("failed to generate load url");b=l;c=b.match(Ua);(d=b.match(Va))&&1===d.length&&Wa.test(b)&&c&&1===c.length\|\|W("failed sanity: "+a);try{a="?";if(e&&0<e.length){c=b=0;for(d={};c<e.length;){var q=e[c++];f=void 0;k=typeof q;f="objec
2023-09-19 12:30:42 UTC	769	IN	Data Raw: 2c 6b 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 66 5b 30 5d 29 2c 6d 3d 0a 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 66 5b 31 5d 29 3b 32 3d 3d 66 2e 6c 65 6e 67 74 68 26 26 6b 26 26 6d 26 26 28 61 5b 6b 5d 3d 61 5b 6b 5d 7c 7c 6d 29 7d 62 3d 22 2f 22 2b 63 2e 6a 6f 69 6e 28 22 2f 22 29 3b 50 61 2e 74 65 73 74 28 62 29 7c 7c 57 28 22 69 6e 76 61 6c 69 64 5f 70 72 65 66 69 78 22 29 3b 63 3d 30 3b 66 6f 72 28 64 3d 51 61 2e 6c 65 6e 67 74 68 3b 63 3c 64 3b 2b 2b 63 29 51 61 5b 63 5d 2e 74 65 73 74 28 62 29 26 26 57 28 22 69 6e 76 61 6c 69 64 5f 70 72 65 66 69 78 22 29 3b 63 3d 58 28 61 2c 22 6b 22 2c 21 30 29 3b 64 3d 58 28 61 2c 22 61 6d 22 29 3b 65 3d 58 28 61 2c 22 72 73 22 29 3b 61 3d 58 28 61 2c 22 74 22 29 3b 72 65 74 Data Ascii: ,k=decodeURIComponent(f[0]),m=decodeURIComponent(f[1]);2==f.length&&k&&m&&(a[k]=a[k]\|\|m)}b="/"+c.join("/");Pa.test(b)\|\|W("invalid_prefix");c=0;for(d=Qa.length;c<d;++c)Qa[c].test(b)&&W("invalid_prefix");c=X(a,"k",!0);d=X(a,"am");e=X(a,"rs");a=X(a,"t");ret
2023-09-19 12:30:42 UTC	770	IN	Data Raw: 0a 65 6c 73 65 7b 76 61 72 20 62 3d 63 62 28 29 2c 63 3d 22 22 3b 6e 75 6c 6c 21 3d 3d 62 26 26 28 63 3d 27 20 6e 6f 6e 63 65 3d 22 27 2b 62 2b 27 22 27 29 3b 61 3d 22 3c 22 2b 59 2b 27 20 73 72 63 3d 22 27 2b 65 6e 63 6f 64 65 55 52 49 28 61 29 2b 27 22 27 2b 63 2b 22 3e 3c 2f 22 2b 59 2b 22 3e 22 3b 4c 2e 77 72 69 74 65 28 5a 3f 5a 2e 63 72 65 61 74 65 48 54 4d 4c 28 61 29 3a 61 29 7d 7d 2c 64 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 4c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 59 29 3b 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 5a 3f 5a 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 3b 61 3d 63 62 28 29 3b 6e 75 6c 6c 21 3d 3d 61 26 26 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e Data Ascii: else{var b=cb(),c="";null!==b&&(c=' nonce="'+b+'"');a="<"+Y+' src="'+encodeURI(a)+'"'+c+"></"+Y+">";L.write(Z?Z.createHTML(a):a)}},db=function(a){var b=L.createElement(Y);b.setAttribute("src",Z?Z.createScriptURL(a):a);a=cb();null!==a&&b.setAttribute("non
2023-09-19 12:30:42 UTC	771	IN	Data Raw: 29 2e 75 70 64 61 74 65 3b 46 3f 46 28 66 29 3a 66 26 26 4d 28 52 2c 22 63 75 22 2c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 69 66 28 45 29 7b 55 28 22 6d 65 30 22 2c 78 2c 4f 29 3b 74 72 79 7b 67 62 28 45 2c 63 2c 71 29 7d 66 69 6e 61 6c 6c 79 7b 55 28 22 6d 65 31 22 2c 78 2c 4f 29 7d 7d 72 65 74 75 72 6e 20 31 7d 3b 30 3c 6b 26 26 28 41 3d 4b 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 62 61 3d 21 30 3b 6d 28 29 7d 2c 6b 29 29 3b 76 61 72 20 72 3d 62 62 28 61 2c 63 61 29 3b 69 66 28 72 2e 6c 65 6e 67 74 68 29 7b 72 3d 62 62 28 61 2c 6c 29 3b 76 61 72 20 75 3d 4d 28 52 2c 22 43 50 22 2c 5b 5d 29 2c 76 3d 75 2e 6c 65 6e 67 74 68 3b 75 5b 76 5d 3d 66 75 6e 63 74 69 6f 6e 28 78 29 7b 69 66 28 21 78 29 72 65 74 75 72 6e 20 30 3b 55 28 22 Data Ascii: ).update;F?F(f):f&&M(R,"cu",[]).push(f);if(E){U("me0",x,O);try{gb(E,c,q)}finally{U("me1",x,O)}}return 1};0<k&&(A=K.setTimeout(function(){ba=!0;m()},k));var r=bb(a,ca);if(r.length){r=bb(a,l);var u=M(R,"CP",[]),v=u.length;u[v]=function(x){if(!x)return 0;U("
2023-09-19 12:30:42 UTC	773	IN	Data Raw: 3d 61 2e 6c 65 6e 67 74 68 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 28 62 29 2e 73 70 6c 69 74 28 22 3a 22 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 21 5b 22 61 70 69 22 2c 22 70 6c 61 74 66 6f 72 6d 22 5d 2e 69 6e 63 6c 75 64 65 73 28 64 29 7d 29 2c 63 2e 66 65 61 74 75 72 65 73 3d 61 29 29 7d 5d 29 3b 4b 61 2e 62 73 30 3d 77 69 6e 64 6f 77 2e 67 61 70 69 2e 5f 62 73 7c 7c 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 4d 61 28 22 62 73 30 22 29 3b 4b 61 2e 62 73 31 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 4d 61 28 22 62 73 31 22 29 3b 64 65 6c 65 74 65 20 77 69 6e 64 6f 77 2e 67 61 70 69 2e 5f 62 73 3b 77 69 6e 64 6f 77 2e 67 61 70 69 2e 6c 6f 61 64 28 22 22 2c 7b 63 61 6c 6c Data Ascii: =a.length\|\|(a=a.substr(b).split(":").filter(function(d){return!["api","platform"].includes(d)}),c.features=a))}]);Ka.bs0=window.gapi._bs\|\|(new Date).getTime();Ma("bs0");Ka.bs1=(new Date).getTime();Ma("bs1");delete window.gapi._bs;window.gapi.load("",{call
2023-09-19 12:30:42 UTC	774	IN	Data Raw: 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 70 6c 75 73 2f 63 69 72 63 6c 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 70 6c 75 73 5f 73 68 61 72 65 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 0a 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 2b 31 2f 73 68 61 72 65 62 75 74 74 6f 6e 3f 70 6c 75 73 53 68 61 72 65 3d 74 72 75 65 26 75 73 65 67 61 70 69 3d 31 22 7d 2c 72 62 72 5f 73 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 73 69 6d 70 6c 65 73 63 72 6f 6c 6c Data Ascii: ion_prefix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""},url:":socialhost:/:session_prefix::se:_/+1/sharebutton?plusShare=true&usegapi=1"},rbr_s:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarsimplescroll
2023-09-19 12:30:42 UTC	776	IN	Data Raw: 70 6c 61 74 65 73 2f 62 61 64 67 65 2e 68 74 6d 6c 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 64 61 74 61 63 6f 6e 6e 65 63 74 6f 72 3a 7b 75 72 6c 3a 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 63 6f 6e 6e 65 63 74 6f 72 2e 63 6f 72 70 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 75 69 2f 77 69 64 67 65 74 76 69 65 77 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 73 75 72 76 65 79 6f 70 74 69 6e 3a 7b 75 72 6c 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 2f 63 75 73 74 6f 6d 65 72 72 65 76 69 65 77 73 2f 6f 70 74 69 6e 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 69 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c Data Ascii: plates/badge.html?usegapi=1"},dataconnector:{url:"https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1"},surveyoptin:{url:"https://www.google.com/shopping/customerreviews/optin?usegapi=1"},":socialhost:":"https://apis.google.com",
2023-09-19 12:30:42 UTC	777	IN	Data Raw: 69 62 69 6c 69 74 79 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 76 69 73 69 62 69 6c 69 74 79 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 61 75 74 6f 63 6f 6d 70 6c 65 74 65 22 7d 2c 0a 22 3a 73 69 67 6e 75 70 68 6f 73 74 3a 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6c 75 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 72 61 74 69 6e 67 62 61 64 67 65 3a 7b 75 72 6c 3a 22 68 74 Data Ascii: ibility:{params:{url:""},url:":socialhost:/:session_prefix:_/widget/render/visibility?usegapi=1"},autocomplete:{params:{url:""},url:":socialhost:/:session_prefix:_/widget/render/autocomplete"},":signuphost:":"https://plus.google.com",ratingbadge:{url:"ht
2023-09-19 12:30:42 UTC	778	IN	Data Raw: 69 3d 31 22 7d 2c 73 61 76 65 74 6f 77 61 6c 6c 65 74 3a 7b 75 72 6c 3a 22 68 74 74 70 73 3a 2f 2f 70 61 79 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 70 2f 76 2f 77 69 64 67 65 74 2f 73 61 76 65 22 7d 2c 0a 70 65 72 73 6f 6e 3a 7b 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 70 65 72 73 6f 6e 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 73 61 76 65 74 6f 64 72 69 76 65 3a 7b 75 72 6c 3a 22 68 74 74 70 73 3a 2f 2f 64 72 69 76 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 61 76 65 74 6f 64 72 69 76 65 62 75 74 74 6f 6e 3f 75 73 65 67 61 70 69 3d 31 22 2c 6d 65 74 68 6f 64 73 3a 5b 22 73 61 76 65 22 5d 7d 2c 70 61 67 65 3a 7b 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f Data Ascii: i=1"},savetowallet:{url:"https://pay.google.com/gp/v/widget/save"},person:{url:":socialhost:/:session_prefix:_/widget/render/person?usegapi=1"},savetodrive:{url:"https://drive.google.com/savetodrivebutton?usegapi=1",methods:["save"]},page:{url:":socialho

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:42 UTC	757	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:30:42 UTC	765	IN	HTTP/1.1 400 Bad Request Date: Tue, 19 Sep 2023 12:30:42 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-09-19 12:30:42 UTC	765	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2023-09-19 12:30:42 UTC	768	IN	Data Raw: 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d Data Ascii: der-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:42 UTC	775	OUT	GET /_/GroupsFrontendUi/data/batchexecute?rpcids=FEQDwf&source-path=%2Fg%2Fcustomer-service5297nivc&f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=52241&rt=c HTTP/1.1 Host: groups.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:30:43 UTC	779	IN	HTTP/1.1 405 Method Not Allowed Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:30:42 GMT X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GroupsFrontendUi/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Allow: POST Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:30:43 UTC	780	IN	Data Raw: 37 30 0d 0a 29 5d 7d 27 0a 0a 31 30 33 0a 5b 5b 22 65 72 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 34 30 35 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 39 5d 2c 5b 22 64 69 22 2c 31 34 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 31 34 2c 22 31 32 30 34 34 37 37 30 32 39 30 31 36 33 35 30 34 35 30 22 2c 39 37 5d 5d 0a 0d 0a Data Ascii: 70)]}'103[["er",null,null,null,null,405,null,null,null,9],["di",14],["af.httprm",14,"1204477029016350450",97]]
2023-09-19 12:30:43 UTC	780	IN	Data Raw: 31 62 0d 0a 32 35 0a 5b 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 33 39 5d 5d 0a 0d 0a Data Ascii: 1b25[["e",4,null,null,139]]
2023-09-19 12:30:43 UTC	780	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:43 UTC	862	OUT	POST /_/GroupsFrontendUi/browserinfo?f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=152241&rt=j HTTP/1.1 Host: groups.google.com Connection: keep-alive Content-Length: 118 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" X-Same-Domain: 1 sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.102" sec-ch-ua-platform-version: "8.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: / Origin: https://groups.google.com X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swB Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://groups.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:30:43 UTC	864	OUT	Data Raw: 66 2e 72 65 71 3d 25 35 42 39 25 32 43 31 25 32 43 31 25 32 43 25 35 42 6e 75 6c 6c 25 32 43 31 30 32 34 25 32 43 31 32 38 30 25 35 44 25 32 43 25 35 42 6e 75 6c 6c 25 32 43 39 31 33 25 32 43 31 32 38 30 25 35 44 25 32 43 25 35 42 31 25 32 43 31 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 25 35 42 31 25 32 43 32 25 32 43 31 25 35 44 25 35 44 26 Data Ascii: f.req=%5B9%2C1%2C1%2C%5Bnull%2C1024%2C1280%5D%2C%5Bnull%2C913%2C1280%5D%2C%5B1%2C1%2Cnull%2C1%5D%2C%5B1%2C2%2C1%5D%5D&
2023-09-19 12:30:44 UTC	865	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:30:44 GMT Content-Disposition: attachment; filename="response.bin"; filename=UTF-8''response.bin X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GroupsFrontendUi/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version= Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:30:44 UTC	866	IN	Data Raw: 35 63 0d 0a 29 5d 7d 27 0a 0a 5b 5b 5b 22 66 2e 6d 74 22 5d 2c 5b 22 64 69 22 2c 31 37 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 31 37 2c 22 2d 35 32 34 Data Ascii: 5c)]}'[[["f.mt"],["di",17],["af.httprm",17,"-524
2023-09-19 12:30:44 UTC	867	IN	Data Raw: 39 37 36 32 36 39 38 30 37 37 33 35 38 35 33 30 22 2c 39 36 5d 2c 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 39 32 5d 5d 5d 0d 0a Data Ascii: 9762698077358530",96],["e",4,null,null,92]]]
2023-09-19 12:30:44 UTC	867	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:43 UTC	864	OUT	GET /_/GroupsFrontendUi/manifest.json HTTP/1.1 Host: groups.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.102" sec-ch-ua-platform-version: "8.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swB Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://groups.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:30:44 UTC	867	IN	HTTP/1.1 200 OK Content-Type: application/manifest+json; charset=utf-8 Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Expires: Tue, 19 Sep 2023 12:30:44 GMT Date: Tue, 19 Sep 2023 12:30:44 GMT Cache-Control: private, max-age=86400 Cross-Origin-Opener-Policy: same-origin-allow-popups Cross-Origin-Resource-Policy: same-site Content-Security-Policy: script-src 'report-sample' 'nonce-O-7pi4C0WwUQwbPvPzPgYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/GroupsFrontendUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/GroupsFrontendUi/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GroupsFrontendUi/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-09-19 12:30:44 UTC	868	IN	Data Raw: 64 63 0d 0a 7b 22 6e 61 6d 65 22 3a 22 47 6f 6f 67 6c 65 20 47 72 6f 75 70 73 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 47 6f 6f 67 6c 65 20 47 72 6f 75 70 73 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 3f 6c 66 68 73 5c 75 30 30 33 64 32 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 72 63 22 3a 22 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 70 72 6f 64 75 63 74 2f 31 78 2f 67 72 6f 75 70 73 5f 33 32 64 70 2e 70 6e 67 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 2c 22 73 69 7a 65 73 22 3a 22 33 32 78 33 32 22 7d 5d 7d 0d 0a Data Ascii: dc{"name":"Google Groups","short_name":"Google Groups","start_url":"/?lfhs\u003d2","display":"standalone","icons":[{"src":"//ssl.gstatic.com/images/branding/product/1x/groups_32dp.png","type":"image/png","sizes":"32x32"}]}
2023-09-19 12:30:44 UTC	868	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (530)
Category:	downloaded
Size (bytes):	3433
Entropy (8bit):	5.507368716219485
Encrypted:	false
SSDEEP:	48:kEz1Wg0tqifqn/oaOy2MKDX8y3JvbGASK7RHAFRvT3Z52p6Ire:keXoaOzXKg2FRvP2gse
MD5:	2C56C95332D527036CA319D96DAD0FE8
SHA1:	5333C17ACDCDF2CFE50F23116D28ADFA5047FC2A
SHA-256:	6BBA8CE74FDB5A4F861E44EBE685E7785A581245AD29BCF3A27CD6A409EC9D98
SHA-512:	F94F578D0AC31B27771B5C566FB3AAA04BB29A539A3681A6DC3F433674410DBD45ECFAA5136E8A6E36B64F1D45E8D362B9894A2B0F3DF66A5794BA01B26AF221
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/_/mss/boq-groups/_/js/k=boq-groups.GroupsFrontendUi.en_US.h73sJsz_Rtw.es5.O/ck=boq-groups.GroupsFrontendUi.3HFXsT7duPQ.L.B1.O/am=AIDp9Nq_va0M/d=1/exm=A4UTCb,A7fCU,BVgquf,COQbmf,CkvV3e,EEDORb,EFQ78c,ENNBBf,Fudpzb,GFartf,GcWJze,IZT63,JNoxi,K99qY,KG2eXe,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,Mq9n0c,N5Lqpc,NBfYR,NPumQe,NSYzcf,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,Ppzpfb,PrPYRd,Q5OcEd,QIhFr,RMhBfe,RqjULd,SdcwHb,SpsfSb,U0aPgd,U4Hp0d,UTkAge,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,VXdfxd,VwDzFe,W7UAvf,WO9ee,XVMNvd,YbIhPd,YwHGTd,YyFM9b,Z5uLle,ZfAoz,ZwDk9d,_b,_tp,aW3pY,aurFic,bm51tf,byfTOb,c0uoEe,dNsHRd,duFQFc,e5qFLc,fKUV3e,gwNYeb,gychg,hKSk3e,hc6Ubd,i78JDf,iSvg6e,kWgXee,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,ovKuLd,owcnme,pjICDe,pw70Gc,s39S4,sKlkue,t8tqF,txTMtc,uY3Nvd,w9hDv,wd5Wgc,wmnU7d,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,conversationlistview/ed=1/wt=2/ujg=1/rs=ALAdxDn8MhPd47zBmN0tV2MS9s1e3ZTtuw/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;VS7Vxc:U9fLAc;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:QIhFr;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:duFQFc/m=JNqlS"
Preview:	"use strict";this.default_GroupsFrontendUi=this.default_GroupsFrontendUi\|\|{};(function(_){var window=this;.try{._.XLa=_.z("JNqlS",[]);._.m("JNqlS");.var jUc=function(a){return(0,_.N)('<div class="'+_.T("Pgfurc")+'" jscontroller="'+_.T("F7ckzd")+'" jsmodel="'+_.T("UcaXYd")+'" jsaction="'+_.T("JIbuQc")+":"+_.T("oQ5Pl")+"("+_.T("SdgIzc")+");"+_.T("rcuQ6b")+":"+_.T("npT2md")+';" data-query="'+_.T(a?a:"")+'"><div jsname="'+_.T("xpv2f")+'" role="option"></div></div>')},kUc=function(a,b,c){return(0,_.N)('<div jsname="'+_.T("peMN4b")+'" class="'+_.T("qTSr1c")+'" data-query="'+_.T(a)+'" role="option" tabindex="0">'+_.AJ(b,void 0,void 0,void 0,void 0,void 0,."bGZHfd")+_.S(c)+"</div>")},lUc=function(a,b,c,d,e){c='<div class="'+_.T("yTtljf")+'"'+(c?' data-query="'+_.T(c)+'"':"")+' data-render-advanced="'+_.T(b)+'"'+(d?' data-role-filters="'+_.T(d)+'"':"")+' jscontroller="'+_.T("q43fWd")+'" jsaction="'+_.T("rcuQ6b")+":"+_.T("npT2md")+";"+_.T("JIbuQc")+":"+_.T("bypPxe")+"("+_.T("p4afx")+"),"+_.T("wK

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	432
Entropy (8bit):	5.293299330065219
Encrypted:	false
SSDEEP:	12:hYA0HqJmqGKCIay79hLFBkAAqJmPm/esHbWCIap4Nbx4IQL:hYPcBtvBvPz7Wy4NW
MD5:	E1C621A12FB20601BA45EF68B1B097F6
SHA1:	475033DA926AECFB100D4058B05F32E64AA27C4A
SHA-256:	428161D1D48D68DD7A091FCD82758630020C2B8F4D15D438D3E7F07BA71F22CD
SHA-512:	9A80755E77ACB67E83EBA9A46061B6DAA7CC40EADC657DEF77830E7501DCCB319B4851844183994B0AD6483C681D06E6F0E3E2B53D42974E063EA34D5CBCF4A8
Malicious:	false
Reputation:	low
URL:	https://content-people-pa.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.vIVemAYlBvo.O%2Fd%3D1%2Frs%3DAHpOoo_eZqauDOH0vAaumGJQwp71CTPx9g%2Fm%3D__features__
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<script type="text/javascript" nonce="KtpIPCx3P2jKgEZFLeQ7gw">. window['startup'] = function() {. googleapis.server.init();. };.</script>.<script type="text/javascript". src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async. defer nonce="KtpIPCx3P2jKgEZFLeQ7gw"></script>.</head>.<body>.</body>.</html>.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (824)
Category:	downloaded
Size (bytes):	1326
Entropy (8bit):	5.3211492705182
Encrypted:	false
SSDEEP:	24:k3K5v4S2ggYKauDiE/3t2xduimJ6ZlZ844nIMztLCI0OV/QORLwXvfNNZEre:kK5wSu/1kjEGdmhRCIjxEXv3ZEre
MD5:	CC321F60C30CF8C2612FA544BBC6B0DA
SHA1:	89CBC08D06A68AAE1FAEEB2B82BB8403F0F7037B
SHA-256:	E4FF6A74D74630797AE44411387B0851974BAF740F0568CAA8E0792BA0CEF025
SHA-512:	B836E27339613CD968A4D562B6209D510AE631EAD387B577CC6AB55BB74E1D6DA4B6A1D3AE6A18704559A1904C47F35AA87301F1AFB08679ABE582B6C6579711
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/_/mss/boq-groups/_/js/k=boq-groups.GroupsFrontendUi.en_US.h73sJsz_Rtw.es5.O/ck=boq-groups.GroupsFrontendUi.3HFXsT7duPQ.L.B1.O/am=AIDp9Nq_va0M/d=1/exm=A4UTCb,A7fCU,BVgquf,COQbmf,CkvV3e,EEDORb,EFQ78c,ENNBBf,Fudpzb,GFartf,GcWJze,IZT63,JNoxi,K99qY,KG2eXe,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,Mq9n0c,N5Lqpc,NBfYR,NPumQe,NSYzcf,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PrPYRd,QIhFr,RMhBfe,RqjULd,SdcwHb,SpsfSb,U0aPgd,U4Hp0d,UTkAge,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,VXdfxd,VwDzFe,W7UAvf,WO9ee,XVMNvd,YbIhPd,YwHGTd,YyFM9b,Z5uLle,ZfAoz,ZwDk9d,_b,_tp,aW3pY,aurFic,byfTOb,c0uoEe,dNsHRd,duFQFc,e5qFLc,fKUV3e,gwNYeb,gychg,hKSk3e,hc6Ubd,i78JDf,iSvg6e,kWgXee,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,ovKuLd,owcnme,pjICDe,pw70Gc,s39S4,sKlkue,t8tqF,txTMtc,uY3Nvd,w9hDv,wd5Wgc,wmnU7d,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,conversationlistview/ed=1/wt=2/ujg=1/rs=ALAdxDn8MhPd47zBmN0tV2MS9s1e3ZTtuw/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;VS7Vxc:U9fLAc;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:QIhFr;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:duFQFc/m=bm51tf"
Preview:	"use strict";this.default_GroupsFrontendUi=this.default_GroupsFrontendUi\|\|{};(function(_){var window=this;.try{._.m("bm51tf");.var V3b=function(a,b,c,d,e){this.Ba=a;this.Da=b;this.Ca=c;this.Ha=d;this.La=e;this.oa=0;this.Aa=U3b(this)},W3b=function(a){var b={};_.Na(a.D8(),function(e){b[e]=!0});var c=a.k8(),d=a.s8();return new V3b(a.r8(),1E3c.getSeconds(),a.Q7(),1E3d.getSeconds(),b)},U3b=function(a){return Math.random()Math.min(a.DaMath.pow(a.Ca,a.oa),a.Ha)};V3b.prototype.PD=function(a){return this.oa>=this.Ba?!1:null!=a?!!this.La[a]:!0};var X3b=function(a){_.U.call(this,a.Sa);this.Ba=a.service.Xaa;this.Ca=a.service.metadata;a=a.service.GKa;this.Aa=a.fetch.bind(a)};_.F(X3b,_.U);X3b.rb=_.U.rb;X3b.Pa=function(){return{service:{Xaa:_.R3b,metadata:_.O3b,GKa:_.G3b}}};X3b.prototype.oa=function(a,b){if(1!=this.Ca.getType(a.Ef()))return _.Ql(a);var c=this.Ba.oa;(c=c?W3b(c):null)&&c.PD()?(b=Y3b(this,a,b,c),a=new _.Pl(a,b,2)):a=_.Ql(a);return a};.var Y3b=function(a,b,c,d){return c.then(function

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:	24:hY6svN/6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z1sW:3qN/2+pUAew85zf
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:44 UTC	868	OUT	GET /_/GroupsFrontendUi/browserinfo?f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=152241&rt=j HTTP/1.1 Host: groups.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiWocsBCIurzAEI+7vMAQjMvMwBCJjRzAE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk; OTZ=7213711_48_52_123900_48_436380
2023-09-19 12:30:44 UTC	869	IN	HTTP/1.1 405 Method Not Allowed Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:30:44 GMT X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GroupsFrontendUi/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Allow: POST Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:30:44 UTC	870	IN	Data Raw: 38 33 0d 0a 29 5d 7d 27 0a 0a 5b 5b 5b 22 65 72 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 34 30 35 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 39 5d 2c 5b 22 64 69 22 2c 31 32 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 31 32 2c 22 31 36 35 34 39 33 31 38 36 36 35 30 31 34 35 34 36 34 33 22 2c 39 36 5d 2c 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 33 31 5d 5d 5d 0d 0a Data Ascii: 83)]}'[[["er",null,null,null,null,405,null,null,null,9],["di",12],["af.httprm",12,"1654931866501454643",96],["e",4,null,null,131]]]
2023-09-19 12:30:44 UTC	871	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:36 UTC	1	OUT	GET /?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi HTTP/1.1 Host: us-west-2.protection.sophos.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-09-19 12:30:36 UTC	5	IN	HTTP/1.1 302 Found Content-Type: text/html Content-Length: 0 Connection: close Date: Tue, 19 Sep 2023 12:30:36 GMT x-amzn-RequestId: 7dea265e-a9c8-43d1-be1e-b912e1309839 Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow x-amz-apigw-id: LgQg-EN5vHcF1Gw= Location: https://groups.google.com/d/forum/customer-service5297nivc X-Amzn-Trace-Id: Root=1-6509946c-166e96d62848f9371ea273e1;Sampled=0;lineage=b506645d:0 X-Cache: Miss from cloudfront Via: 1.1 8f53b5d73ff2f5f8cae7b49606b79bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: EWR53-C2 X-Amz-Cf-Id: Icd8GoK04EJfxYO7s1grEe20bfqUkk0d32yafV0smQQnlPUYlw4HkQ==

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:31:13 UTC	871	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 721 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-model: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102" sec-ch-ua-platform-version: "8.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version: "104.0.5112.102" sec-ch-ua-platform: "Windows" Accept: / Origin: https://groups.google.com X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swB Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://groups.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk
2023-09-19 12:31:13 UTC	872	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 67 72 6f 75 70 73 66 72 6f 6e 74 65 6e 64 73 65 72 76 65 72 5f 32 30 32 33 30 39 30 37 2e 30 35 5f 70 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 33 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 38 34 2c 5b 5b 22 31 36 39 35 31 32 36 36 37 32 33 38 36 22 2c 6e 75 6c 6c 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5c 22 32 31 37 32 36 34 39 34 37 32 5c 22 2c 5c 22 32 35 30 30 30 30 33 36 5c 22 2c 5c 22 31 38 33 39 39 39 38 34 5c 22 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"boq_groupsfrontendserver_20230907.05_p0",null,null,[3,0,0,0,0]]],1884,[["1695126672386",null,[],null,null,null,null,"[[\"2172649472\",\"25000036\",\"18399984\"],null,null,
2023-09-19 12:31:14 UTC	873	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://groups.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Sep 2023 12:31:14 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:31:14 UTC	873	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2023-09-19 12:31:14 UTC	873	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:31:44 UTC	873	OUT	POST /_/GroupsFrontendUi/browserinfo?f.sid=554045669980204913&bl=boq_groupsfrontendserver_20230907.05_p0&hl=en-US&soc-app=696&soc-platform=1&soc-device=1&_reqid=252241&rt=j HTTP/1.1 Host: groups.google.com Connection: keep-alive Content-Length: 118 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" X-Same-Domain: 1 sec-ch-ua-full-version-list: "Chromium";v="104.0.5112.102", " Not A;Brand";v="99.0.0.0", "Google Chrome";v="104.0.5112.102" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "104.0.5112.102" sec-ch-ua-platform-version: "8.0.0" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-model: sec-ch-ua-platform: "Windows" Accept: / Origin: https://groups.google.com X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCMy8zAEI6sDMAQicycwBCOPLzAEImNHMAQiZ0swB Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://groups.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E; NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk; OTZ=7213711_48_52_123900_48_436380
2023-09-19 12:31:44 UTC	875	OUT	Data Raw: 66 2e 72 65 71 3d 25 35 42 39 25 32 43 31 25 32 43 31 25 32 43 25 35 42 6e 75 6c 6c 25 32 43 31 30 32 34 25 32 43 31 32 38 30 25 35 44 25 32 43 25 35 42 6e 75 6c 6c 25 32 43 39 31 33 25 32 43 31 32 38 30 25 35 44 25 32 43 25 35 42 31 25 32 43 31 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 25 35 42 31 25 32 43 32 25 32 43 31 25 35 44 25 35 44 26 Data Ascii: f.req=%5B9%2C1%2C1%2C%5Bnull%2C1024%2C1280%5D%2C%5Bnull%2C913%2C1280%5D%2C%5B1%2C1%2Cnull%2C1%5D%2C%5B1%2C2%2C1%5D%5D&
2023-09-19 12:31:44 UTC	875	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:31:44 GMT Content-Disposition: attachment; filename="response.bin"; filename=UTF-8''response.bin X-Content-Type-Options: nosniff Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GroupsFrontendUi/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin-allow-popups Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-09-19 12:31:44 UTC	876	IN	Data Raw: 35 64 0d 0a 29 5d 7d 27 0a 0a 5b 5b 5b 22 66 2e 6d 74 22 5d 2c 5b 22 64 69 22 2c 32 37 5d 2c 5b 22 61 66 2e 68 74 74 70 72 6d 22 2c 32 37 2c 22 2d 34 36 39 Data Ascii: 5d)]}'[[["f.mt"],["di",27],["af.httprm",27,"-469
2023-09-19 12:31:44 UTC	876	IN	Data Raw: 39 34 36 30 36 33 32 35 39 33 39 35 39 33 38 36 22 2c 31 30 32 5d 2c 5b 22 65 22 2c 34 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 39 33 5d 5d 5d 0d 0a Data Ascii: 9460632593959386",102],["e",4,null,null,93]]]
2023-09-19 12:31:44 UTC	876	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:31:44 UTC	876	OUT	POST /domainreliability/upload HTTP/1.1 Host: google.com Connection: keep-alive Content-Length: 1013 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-09-19 12:31:44 UTC	877	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 68 74 74 70 5f 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 34 30 30 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 48 54 54 50 53 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 36 31 37 31 37 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 34 34 33 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 34 32 2e 32 35 31 2e 33 35 2e 31 37 34 3a 34 34 33 22 2c 22 73 74 61 74 75 73 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6c 61 79 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 2c 22 77 61 73 5f 70 72 6f 78 69 65 64 22 3a 66 61 6c 73 65 7d Data Ascii: {"entries":[{"http_response_code":400,"network_changed":false,"protocol":"HTTPS","request_age_ms":61717,"request_elapsed_ms":443,"sample_rate":1.0,"server_ip":"142.251.35.174:443","status":"http.error","url":"https://play.google.com/","was_proxied":false}
2023-09-19 12:31:44 UTC	879	IN	HTTP/1.1 200 OK Report-To: {"endpoints":[{"priority":1,"url":"https://beacons.gcp.gvt2.com/domainreliability/upload-nel","weight":1},{"priority":1,"url":"https://beacons.gvt2.com/domainreliability/upload-nel","weight":1},{"priority":1,"url":"https://beacons2.gvt2.com/domainreliability/upload-nel","weight":1},{"priority":1,"url":"https://beacons3.gvt2.com/domainreliability/upload-nel","weight":1},{"priority":1,"url":"https://beacons4.gvt2.com/domainreliability/upload-nel","weight":1},{"priority":1,"url":"https://clients2.google.com/domainreliability/upload-nel","weight":1},{"priority":2,"url":"https://beacons5.gvt2.com/domainreliability/upload-nel","weight":1},{"priority":2,"url":"https://beacons5.gvt3.com/domainreliability/upload-nel","weight":1}],"group":"nel","max_age":300} NEL: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} Location: https://e2c51.gcp.gvt2.com/nel/ Content-Type: application/javascript; charset=utf-8 Date: Tue, 19 Sep 2023 12:31:44 GMT Server: Domain Reliability Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:36 UTC	6	OUT	GET /d/forum/customer-service5297nivc HTTP/1.1 Host: groups.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E
2023-09-19 12:30:37 UTC	6	IN	HTTP/1.1 302 Found Content-Type: application/binary Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 19 Sep 2023 12:30:37 GMT Location: https://groups.google.com/g/customer-service5297nivc P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GroupsFrontendRedirectsUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-T4cjaUx3eFbsYJEbOA81Hg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/GroupsFrontendRedirectsUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/GroupsFrontendRedirectsUi/cspreport/allowlist Cross-Origin-Resource-Policy: same-site Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Set-Cookie: NID=511=LjDKYCpvgiuCYdrImvnSgeGnoGpDjp_QqSDJbx6EYAhg-jIp323BBp3md3BDBoT0-r0xglSNQZhoe9Hi-FLJuuZVvPNf22x3TBMabvuZ6Dif0hSGQc8OY9NpIq6EhJozx8ErhiA5TmBQBeaJwrH46VkCuXKCq-hibbEasUJeWDk; expires=Wed, 20-Mar-2024 12:30:37 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-09-19 12:30:41 UTC	562	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://groups.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://groups.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-09-19 12:30:41 UTC	618	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://groups.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Sep 2023 12:30:41 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	14:30:31
Start date:	19/09/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-west-2.protection.sophos.com/?d=google.com&u=aHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9kL2ZvcnVtL2N1c3RvbWVyLXNlcnZpY2U1Mjk3bml2Yw==&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmFi&t=ZG5HT3RHd3lORUJ4b1FLYkZNYW1VNXhhUjFqNXBQZklFSXhjNStRaG9mcz0=&h=a466707d5c874c118d9b5c2f464274eb&s=AVNPUEhUT0NFTkNSWVBUSVawmKuXg5JUYdIOp92D5STsHW74AAPv4kDPGJfeA3djwfbW-7lqK2aSB1t1x07we7BPxaZmhGqh8j1VzLzgKpYi
Imagebase:	0x7ff61b720000
File size:	2'852'640 bytes
MD5 hash:	7BC7B4AEDC055BB02BCB52710132E9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	14:30:33
Start date:	19/09/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1808,i,10018836059509693255,16172007586500317314,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff61b720000
File size:	2'852'640 bytes
MD5 hash:	7BC7B4AEDC055BB02BCB52710132E9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Chrome Cache Entry: 99

Static File Info

Network Behavior

Network Port Distribution

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre