Edit tour

Windows Analysis Report
https://dl.driverpack.io/test/PROD_Start_DriverPack.hta

Overview

General Information

Sample URL:	https://dl.driverpack.io/test/PROD_Start_DriverPack.hta
Analysis ID:	1564295
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Downloads suspicious files via Chrome

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a window with clipboard capturing capabilities

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Classification

Process Tree

System is w7x64

chrome.exe (PID: 2852 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1212 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1280 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 3944 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=700 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 3952 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3140 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1592 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://dl.driverpack.io/test/PROD_Start_DriverPack.hta" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

mshta.exe (PID: 2344 cmdline: mshta.exe "C:\Users\user\Desktop\" MD5: ABDFC692D9FE43E2BA8FE6CB5A8CB95A)

cleanup

HTTP traffic detected: POST /safebrowsing/clientreport/download?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: sb-ssl.google.comConnection: keep-aliveContent-Length: 465Content-Type: application/octet-streamSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: chromecache_104.1.dr, ab4f7167-f9b0-4b51-9752-2345d435a0c0.tmp.0.dr	String found in binary or memory: http://dwrapper-prod.herokuapp.com/bin/step1_av.html
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_130.1.dr	String found in binary or memory: http://www.google.com/support/websearch/bin/answer.py?hl=
Source: chromecache_127.1.dr, chromecache_105.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_127.1.dr, chromecache_105.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_120.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_113.1.dr, chromecache_123.1.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_127.1.dr, chromecache_105.1.dr, chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_131.1.dr, chromecache_114.1.dr, chromecache_120.1.dr, chromecache_132.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_127.1.dr, chromecache_105.1.dr, chromecache_130.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_130.1.dr	String found in binary or memory: https://content-googleapis-staging.sandbox.google.com
Source: chromecache_130.1.dr	String found in binary or memory: https://content-googleapis-test.sandbox.google.com
Source: chromecache_127.1.dr, chromecache_105.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_127.1.dr, chromecache_105.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmZjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmdjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmhjtg.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmtjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmxjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmZjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmdjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmhjtg.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmtjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmxjtiu7.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qE52i1dC.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qER2i1dC.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEV2i1dC.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEl2i1dC.woff2)
Source: chromecache_134.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2)
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.0.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.1.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.10.w
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.11.w
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.2.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.3.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.4.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.5.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.6.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.7.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.8.wo
Source: chromecache_102.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.9.wo
Source: chromecache_130.1.dr	String found in binary or memory: https://guidebooks.google.com
Source: chromecache_130.1.dr	String found in binary or memory: https://moltron-pa.clients6.google.com
Source: chromecache_130.1.dr	String found in binary or memory: https://myaccount.google.com/privacypolicy?hl=
Source: chromecache_120.1.dr, chromecache_132.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_131.1.dr, chromecache_114.1.dr, chromecache_120.1.dr, chromecache_132.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_130.1.dr	String found in binary or memory: https://play.google.com
Source: chromecache_129.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_105.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_127.1.dr, chromecache_105.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_130.1.dr	String found in binary or memory: https://policies.google.com/terms/generative-ai
Source: chromecache_130.1.dr	String found in binary or memory: https://policies.google.com/terms?hl=
Source: chromecache_130.1.dr	String found in binary or memory: https://schema.org
Source: chromecache_131.1.dr, chromecache_120.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_123.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_130.1.dr	String found in binary or memory: https://support.google.com
Source: chromecache_130.1.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_130.1.dr	String found in binary or memory: https://support.google.com/chrome/answer/95346
Source: chromecache_130.1.dr	String found in binary or memory: https://support.google.com/communities/answer/7424249
Source: chromecache_130.1.dr	String found in binary or memory: https://support.google.com/communities/answer/7425194
Source: chromecache_130.1.dr	String found in binary or memory: https://support.google.com/embed/tagging/install
Source: chromecache_130.1.dr	String found in binary or memory: https://supporttagging-autopush.sandbox.google.com/embed/tagging/install
Source: chromecache_113.1.dr, chromecache_123.1.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_131.1.dr, chromecache_114.1.dr, chromecache_120.1.dr, chromecache_132.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_127.1.dr, chromecache_105.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_114.1.dr, chromecache_130.1.dr, chromecache_132.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_113.1.dr, chromecache_123.1.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_113.1.dr, chromecache_123.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_113.1.dr, chromecache_123.1.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_120.1.dr, chromecache_132.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_130.1.dr	String found in binary or memory: https://www.google.com/accounts/TOS
Source: chromecache_113.1.dr, chromecache_123.1.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_130.1.dr	String found in binary or memory: https://www.google.com/chrome
Source: chromecache_130.1.dr	String found in binary or memory: https://www.google.com/intl/en/chrome/browser/desktop/index.html?standalone=1
Source: chromecache_130.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&onload=
Source: chromecache_130.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&render=explicit&onload=
Source: chromecache_130.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_131.1.dr, chromecache_114.1.dr, chromecache_120.1.dr, chromecache_132.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_105.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_105.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_130.1.dr	String found in binary or memory: https://www.googleapis.com/youtube/v3
Source: chromecache_130.1.dr	String found in binary or memory: https://www.googleapis.com/youtube/v3/videos?part=snippet%2C
Source: chromecache_132.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_113.1.dr, chromecache_123.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_130.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-H30R9PNQFN
Source: chromecache_130.1.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_110.1.dr, chromecache_129.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chromecache_130.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chromecache_130.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chromecache_130.1.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_131.1.dr, chromecache_120.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_130.1.dr	String found in binary or memory: https://www.youtube.com/embed/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49207
Source: unknown	Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49244
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49232
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 49205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 443

Source: C:\Windows\SysWOW64\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\PROD_Start_DriverPack.hta (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\mshta.exe

Memory allocated: 770B0000 page execute and read and write

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: sus22.win@27/63@22/8

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google

Jump to behavior

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\ab4f7167-f9b0-4b51-9752-2345d435a0c0.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1280 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://dl.driverpack.io/test/PROD_Start_DriverPack.hta"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=700 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3140 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1280 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\"	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=700 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3140 --field-trial-handle=1296,i,3745440234932172147,3372615042942232558,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_2852_1042843532	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe TID: 2968

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://dl.driverpack.io/test/PROD_Start_DriverPack.hta	0%	Avira URL Cloud	safe
https://dl.driverpack.io/test/PROD_Start_DriverPack.hta	4%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
sb-ssl.l.google.com	172.217.17.78	true	false	high
play.google.com	142.250.181.78	true	false	high
plus.l.google.com	172.217.19.238	true	false	high
download.drp.su	87.117.239.151	true	false	high
www.google.com	172.217.17.68	true	false	high
support.google.com	172.217.19.206	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.193	true	false	high
sb-ssl.google.com	unknown	unknown	false	high
dl.driverpack.io	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/generate_204	false	high
https://support.google.com/chrome/?p=unsupported_windows	false	high
https://dl.driverpack.io/test/PROD_Start_DriverPack.hta	false	high
https://support.google.com/apis/prefinsert?v=0&helpcenter=chrome&hl=en&key=support-content&request_source=1&service_configuration=&mendel_ids=10800112,1706538,1714255,10800561,10800621,10800672,10800695,10800700,10800707,10800738,10800761,10800848,10800880,10800922,10800950,10800957,10801032,10801042,10801150,10801288,10801345,10801539,10801601,10801704,10801736,10801757,10802104,10802277,10802281,10802381,10802419,10802571,10802616,10802624,10802781,10803447,10803751,10803805,10803950,10803957,10803964,10803965,10804278,10804406,10804411,97601634	false	high
https://lh3.googleusercontent.com/gv4UzxwBWVHxxyY26lRgv7WIeFfZZSSCGe5vUBZdm7ePRpUvmf_5Cs23ZTgETaA2kyU4=w36-h36	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://support.google.com/apis/caseslist?hl=en&key=support-content&request_source=1&mendel_ids=10800112%2C1706538%2C1714255%2C10800561%2C10800621%2C10800672%2C10800695%2C10800700%2C10800707%2C10800738%2C10800761%2C10800848%2C10800880%2C10800922%2C10800950%2C10800957%2C10801032%2C10801042%2C10801150%2C10801288%2C10801345%2C10801539%2C10801601%2C10801704%2C10801736%2C10801757%2C10802104%2C10802277%2C10802281%2C10802381%2C10802419%2C10802571%2C10802616%2C10802624%2C10802781%2C10803447%2C10803751%2C10803805%2C10803950%2C10803957%2C10803964%2C10803965%2C10804278%2C10804406%2C10804411%2C97601634&authuser=0&v=1&helpcenter=chrome	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://support.google.com/chrome/answer/95346?visit_id=638683684954471283-2255631397&p=unsupported_windows&rd=1#chrome_update_sse3&zippy=%2Cwindows	false	high
https://support.google.com/chrome/answer/95346?visit_id=638683684954471283-2255631397&p=unsupported_windows&rd=1	false	high
https://sb-ssl.google.com/safebrowsing/clientreport/download?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_131.1.dr, chromecache_120.1.dr	false	high
http://www.broofa.com	chromecache_110.1.dr, chromecache_129.1.dr	false	high
https://support.google.com/embed/tagging/install	chromecache_130.1.dr	false	high
http://dwrapper-prod.herokuapp.com/bin/step1_av.html	chromecache_104.1.dr, ab4f7167-f9b0-4b51-9752-2345d435a0c0.tmp.0.dr	false	high
https://support.google.com	chromecache_130.1.dr	false	high
https://www.youtube.com/embed/	chromecache_130.1.dr	false	high
https://play.google.com	chromecache_130.1.dr	false	high
https://support.google.com/chrome/answer/95346	chromecache_130.1.dr	false	high
https://www.google.com/accounts/TOS	chromecache_130.1.dr	false	high
https://policies.google.com/terms?hl=	chromecache_130.1.dr	false	high
https://moltron-pa.clients6.google.com	chromecache_130.1.dr	false	high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_113.1.dr, chromecache_123.1.dr	false	high
https://www.google.com/recaptcha/api.js?trustedtypes=true&onload=	chromecache_130.1.dr	false	high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_127.1.dr, chromecache_105.1.dr	false	high
https://support.google.com/	chromecache_130.1.dr	false	high
https://www.google.com	chromecache_120.1.dr, chromecache_132.1.dr	false	high
https://content-googleapis-test.sandbox.google.com	chromecache_130.1.dr	false	high
https://stats.g.doubleclick.net/j/collect	chromecache_123.1.dr	false	high
https://apis.google.com	chromecache_127.1.dr, chromecache_105.1.dr, chromecache_110.1.dr, chromecache_129.1.dr	false	high
https://domains.google.com/suggest/flow	chromecache_127.1.dr, chromecache_105.1.dr	false	high
https://myaccount.google.com/privacypolicy?hl=	chromecache_130.1.dr	false	high
https://www.google.com/intl/en/chrome/browser/desktop/index.html?standalone=1	chromecache_130.1.dr	false	high
https://www.google.com/tools/feedback	chromecache_130.1.dr	false	high
https://supporttagging-autopush.sandbox.google.com/embed/tagging/install	chromecache_130.1.dr	false	high
https://guidebooks.google.com	chromecache_130.1.dr	false	high
https://tagassistant.google.com/	chromecache_113.1.dr, chromecache_123.1.dr	false	high
https://support.google.com/communities/answer/7424249	chromecache_130.1.dr	false	high
https://schema.org	chromecache_130.1.dr	false	high
https://cct.google/taggy/agent.js	chromecache_131.1.dr, chromecache_114.1.dr, chromecache_120.1.dr, chromecache_132.1.dr	false	high
https://plus.google.com	chromecache_105.1.dr	false	high
https://support.google.com/communities/answer/7425194	chromecache_130.1.dr	false	high
https://policies.google.com/terms/generative-ai	chromecache_130.1.dr	false	high
https://www.google.com/chrome	chromecache_130.1.dr	false	high
https://www.google.com/ads/ga-audiences	chromecache_113.1.dr, chromecache_123.1.dr	false	high
https://www.google.%/ads/ga-audiences	chromecache_113.1.dr, chromecache_123.1.dr	false	high
https://td.doubleclick.net	chromecache_131.1.dr, chromecache_114.1.dr, chromecache_120.1.dr, chromecache_132.1.dr	false	high
https://content-googleapis-staging.sandbox.google.com	chromecache_130.1.dr	false	high
https://www.merchant-center-analytics.goog	chromecache_131.1.dr, chromecache_120.1.dr	false	high
http://www.google.com/support/websearch/bin/answer.py?hl=	chromecache_130.1.dr	false	high
https://fonts.google.com/license/googlerestricted	chromecache_134.1.dr	false	high
https://adservice.google.com/pagead/regclk?	chromecache_120.1.dr	false	high
https://clients6.google.com	chromecache_127.1.dr, chromecache_105.1.dr, chromecache_130.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	support.google.com	United States	15169	GOOGLEUS	false
172.217.19.238	plus.l.google.com	United States	15169	GOOGLEUS	false
172.217.17.78	sb-ssl.l.google.com	United States	15169	GOOGLEUS	false
172.217.17.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.19.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.181.78	play.google.com	United States	15169	GOOGLEUS	false
87.117.239.151	download.drp.su	United Kingdom	20860	IOMART-ASGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564295
Start date and time:	2024-11-28 06:27:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://dl.driverpack.io/test/PROD_Start_DriverPack.hta
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus22.win@27/63@22/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, vga.dll
Excluded IPs from analysis (whitelisted): 172.217.19.195, 64.233.184.84, 172.217.17.46, 34.104.35.123, 172.217.17.74, 142.250.181.110, 172.217.19.232, 142.250.181.3, 172.217.19.234, 172.217.19.170, 172.217.19.202, 142.250.181.106, 216.58.208.234, 142.250.181.42, 142.250.181.138, 172.217.17.42, 172.217.21.42, 216.58.208.251, 172.217.19.219, 172.217.17.91, 142.250.181.155, 142.250.181.123, 172.217.17.59, 142.250.181.59, 172.217.19.251, 142.250.181.27, 142.250.181.91, 172.217.19.227, 172.217.19.10, 142.250.181.10, 142.250.181.74, 142.250.181.99
Excluded domains from analysis (whitelisted): fonts.googleapis.com, accounts.google.com, content-autofill.googleapis.com, storage.googleapis.com, fonts.gstatic.com, clientservices.googleapis.com, ogads-pa.googleapis.com, clients2.google.com, edgedl.me.gvt1.com, www.googletagmanager.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, www.google-analytics.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:29:12	API Interceptor	51x Sleep call for process: mshta.exe modified

Input	Output
URL: https://dl.driverpack.io Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://dl.driverpack.io
URL: https://support.google.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://support.google.com

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	5.121271796929296
Encrypted:	false
SSDEEP:	48:uzK1vpKljUYpuqgs1pxXzOSRByHCpmF50bxxdW6kI:qiIT3BjNOSOGmF50tKA
MD5:	DDA846A4704EFC2A03E1F8392E6F1FFC
SHA1:	387171A06EEE5A76AAEDC3664385BB89703CF6DF
SHA-256:	E9DC9648D8FB7D943431459F49A7D9926197C2D60B3C2B6A58294FD75B672B25
SHA-512:	5CC5AD3FBDF083A87A65BE76869BCA844FAA2D9BE25657B45AD070531892F20D9337739590DD8995BCA03CE23E9CB611129FE2F8457879B6263825D6DF49DA7A
Malicious:	true
Reputation:	low
Preview:	.<!DOCTYPE html>..<html>....<head>.. <title>Starting...</title>.. ->.. <meta http-equiv="X-UA-Compatible" content="IE=7">.. -->.... { IF [NOSCRIPT] } -->.. .. <noscript>.. <meta http-equiv="refresh" content="10;URL='http://'">.. </noscript>.. -->.. <HTA:APPLICATION ID="dwrapper" APPLICATIONNAME="dwrapper" ICON="magnify.exe" WIDTH="700" HEIGHT="600".. CONTEXTMENU="yes" SELECTION="yes" APPLICATION="no" BORDER="none" CAPTION="no" INNERBORDER="no".. MAXIMIZEBUTTON="yes" MINIMIZEBUTTON="yes" NAVIGABLE="yes" SCROLL="no" SCROLLFLAT="no" SHOWINTASKBAR="yes".. SINGLEINSTANCE="no" SYSMENU="yes" VERSION="0.1" WINDOWSTATE="normal" />.... <script type="text/javascript">.. var windowWidth = 700;.. var windowHeight = 600;.. (function () {.. var screenWidth = screen.availWidth;.. var screenHeight = screen.availHeight;.... var newX = (screenWidth - windowWidth) /

Source: global traffic	HTTP traffic detected: GET /test/PROD_Start_DriverPack.hta HTTP/1.1Host: dl.driverpack.ioConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chrome/?p=unsupported_windows HTTP/1.1Host: support.google.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962
Source: global traffic	HTTP traffic detected: GET /chrome/answer/95346?visit_id=638683684954471283-2255631397&p=unsupported_windows&rd=1 HTTP/1.1Host: support.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962
Source: global traffic	HTTP traffic detected: GET /gv4UzxwBWVHxxyY26lRgv7WIeFfZZSSCGe5vUBZdm7ePRpUvmf_5Cs23ZTgETaA2kyU4=w36-h36 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://support.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apis/caseslist?hl=en&key=support-content&request_source=1&mendel_ids=10800112%2C1706538%2C1714255%2C10800561%2C10800621%2C10800672%2C10800695%2C10800700%2C10800707%2C10800738%2C10800761%2C10800848%2C10800880%2C10800922%2C10800950%2C10800957%2C10801032%2C10801042%2C10801150%2C10801288%2C10801345%2C10801539%2C10801601%2C10801704%2C10801736%2C10801757%2C10802104%2C10802277%2C10802281%2C10802381%2C10802419%2C10802571%2C10802616%2C10802624%2C10802781%2C10803447%2C10803751%2C10803805%2C10803950%2C10803957%2C10803964%2C10803965%2C10804278%2C10804406%2C10804411%2C97601634&authuser=0&v=1&helpcenter=chrome HTTP/1.1Host: support.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; SUPPORT_CONTENT=638683684961082416-2164616597; _ga_H30R9PNQFN=GS1.1.1732771699.1.0.1732771699.0.0.0; _ga=GA1.1.178909739.1732771700; NID=519=KUYniNYovDq3hifMi1FzLONQZ1Z1f9r08bktf5RnFPogZ0FZDQlGEoKqM2toj-FXC9EKEENBj-4U0t_LwDLcavoM4PQeTJytO65Y3KaVLvVZRZUobhSw23S97vrIdT1BVOM8nudU2QHfwAJmoLYmo5XctwNJvjtz58Z2pkcDMWnFW3Ux6lVejgNLtGw5qtc
Source: global traffic	HTTP traffic detected: GET /apis/prefinsert?v=0&helpcenter=chrome&hl=en&key=support-content&request_source=1&service_configuration=&mendel_ids=10800112,1706538,1714255,10800561,10800621,10800672,10800695,10800700,10800707,10800738,10800761,10800848,10800880,10800922,10800950,10800957,10801032,10801042,10801150,10801288,10801345,10801539,10801601,10801704,10801736,10801757,10802104,10802277,10802281,10802381,10802419,10802571,10802616,10802624,10802781,10803447,10803751,10803805,10803950,10803957,10803964,10803965,10804278,10804406,10804411,97601634 HTTP/1.1Host: support.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; SUPPORT_CONTENT=638683684961082416-2164616597; _ga_H30R9PNQFN=GS1.1.1732771699.1.0.1732771699.0.0.0; _ga=GA1.1.178909739.1732771700; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /gv4UzxwBWVHxxyY26lRgv7WIeFfZZSSCGe5vUBZdm7ePRpUvmf_5Cs23ZTgETaA2kyU4=w36-h36 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /generate_204 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://support.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM

Source: chromecache_130.1.dr	String found in binary or memory: ;function Jr(){this.part="snippet,id,contentDetails,localizations,statistics";this.Jk=new tr({serverUrl:"https://www.googleapis.com/youtube/v3",serviceName:"youtubeDataApi"})} equals www.youtube.com (Youtube)
Source: chromecache_130.1.dr	String found in binary or memory: ;var cga=Ga(["//www.youtube.com/player_api"]),dga=ko(cga),Kr=[],ega=!1;function Lr(){if(!ega){window.onYouTubeIframeAPIReady=fga;var a=xp("SCRIPT");Sn(a,dga);document.head.appendChild(a);ega=!0}} equals www.youtube.com (Youtube)
Source: chromecache_130.1.dr	String found in binary or memory: ;var nra=Ga(["//www.youtube.com/player_api"]),EA=4/3,ora=16/9,FA={autoplay:1,cc_load_policy:1,controls:2,hl:"en",rel:0,playsinline:0};function GA(a){var b=a.Gb;var c=a.Vl===void 0?!1:a.Vl;a=a.playerVars===void 0?FA:a.playerVars;A.call(this,"sc.tailwind.shared.video.VideoPlayer");this.o=!1;this.ma=0;this.Gb=b;this.Vl=c;this.id=this.Gb.getId();this.playerVars=a;b=this.Gb.mediumThumbnail.width;c=this.Gb.mediumThumbnail.height;this.aspectRatio=b&&c?b/c===EA?EA:ora:EA;this.watch(this.Gb)} equals www.youtube.com (Youtube)
Source: chromecache_130.1.dr	String found in binary or memory: Va=Va.split("-")[0].toLowerCase();if(Ra===Va\|\|e.localizations&&e.localizations[a.ua])a.ma=!0;e="https://www.youtube.com/embed/"+encodeURIComponent(a.id);a.embedUrl=e}a.state=2;a.Ea(0);$o("youtube_video_model/load/success");return Qa(c,0)}Sa(c);a.state=3;a.Ea(0);$o("youtube_video_model/load/failure");Oa(c)})} equals www.youtube.com (Youtube)
Source: chromecache_130.1.dr	String found in binary or memory: b.open("GET","https://www.googleapis.com/youtube/v3/videos?part=snippet%2C+id&key=AIzaSyD-4tE5aKFZYIS_IrfpCDRsgQZbv5VCJZM&id="+a.ma);b.send()} equals www.youtube.com (Youtube)
Source: chromecache_130.1.dr	String found in binary or memory: function KA(a){if(Ho())z().rs==2?window.YT&&window.YT.Player?MA(a,a.o):(Kr.push(function(f){MA(this,f)}.bind(a,a.o)),Lr()):Oo("//www.youtube.com/embed/"+a.ma+"/?rel=0&cc_load_policy=1&autoplay=1&hl="+window.sc_pageModel.lang); equals www.youtube.com (Youtube)
Source: chromecache_131.1.dr, chromecache_114.1.dr, chromecache_120.1.dr, chromecache_132.1.dr	String found in binary or memory: return b}GD.F="internal.enableAutoEventOnTimer";var Zb=wa(["data-gtm-yt-inspected-"]),ID=["www.youtube.com","www.youtube-nocookie.com"],JD,KD=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dl.driverpack.io
Source: global traffic	DNS traffic detected: DNS query: sb-ssl.google.com
Source: global traffic	DNS traffic detected: DNS query: support.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 06:27:56.826703072 CET	53	54821	8.8.8.8	192.168.2.22
Nov 28, 2024 06:27:56.862843037 CET	53	52781	8.8.8.8	192.168.2.22
Nov 28, 2024 06:27:59.941683054 CET	53	62672	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:01.153239965 CET	54842	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:01.153382063 CET	58105	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:01.279900074 CET	53	54842	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:01.291233063 CET	53	58105	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:02.351882935 CET	57390	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:02.376895905 CET	58095	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:02.595061064 CET	53	57390	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:02.620652914 CET	53	58095	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:04.914170027 CET	50446	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:04.914315939 CET	55939	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:05.168114901 CET	53	50446	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:05.287722111 CET	53	55939	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:12.993839025 CET	61618	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:12.994020939 CET	54422	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:13.248630047 CET	53	61618	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:13.251401901 CET	53	54422	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:16.853916883 CET	53	59447	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:16.884764910 CET	53	56329	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:17.481502056 CET	53	51870	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:17.608155012 CET	53	53406	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:18.879118919 CET	65084	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:18.884077072 CET	63373	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:19.005728006 CET	53	65084	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:19.016942024 CET	56207	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:19.017169952 CET	51955	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:19.140073061 CET	53	63373	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:19.272742033 CET	53	56207	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:19.272794962 CET	53	51014	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:19.344834089 CET	53	60169	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:19.390990973 CET	53	51955	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:20.681489944 CET	53	58257	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:21.303818941 CET	53	49478	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:21.567323923 CET	61598	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:21.567939997 CET	58754	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:21.822758913 CET	53	61598	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:21.835746050 CET	53	58754	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:22.008167982 CET	53	54695	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:22.018903017 CET	61601	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:22.019016981 CET	54615	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:22.274476051 CET	53	61601	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:22.399508953 CET	53	54615	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:24.012972116 CET	53	59604	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:24.100689888 CET	53031	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:24.100969076 CET	53112	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:24.238837957 CET	53	53112	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:24.355492115 CET	53	53031	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:30.106419086 CET	53	55910	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:33.294753075 CET	55277	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:33.294878960 CET	51183	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:33.549012899 CET	53	55277	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:33.693322897 CET	53	51183	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:34.853188992 CET	53	56156	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:36.661864996 CET	51268	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:36.662017107 CET	59475	53	192.168.2.22	8.8.8.8
Nov 28, 2024 06:28:36.920809984 CET	53	51268	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:37.036772013 CET	53	59475	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:53.146747112 CET	53	49263	8.8.8.8	192.168.2.22
Nov 28, 2024 06:28:56.851423025 CET	53	60122	8.8.8.8	192.168.2.22

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 28, 2024 06:27:56.826790094 CET	192.168.2.22	8.8.8.8	d04c	(Port unreachable)	Destination Unreachable
Nov 28, 2024 06:28:05.287887096 CET	192.168.2.22	8.8.8.8	d050	(Port unreachable)	Destination Unreachable
Nov 28, 2024 06:28:16.884818077 CET	192.168.2.22	8.8.8.8	d043	(Port unreachable)	Destination Unreachable
Nov 28, 2024 06:28:19.140129089 CET	192.168.2.22	8.8.8.8	d037	(Port unreachable)	Destination Unreachable
Nov 28, 2024 06:28:22.008255005 CET	192.168.2.22	8.8.8.8	d045	(Port unreachable)	Destination Unreachable
Nov 28, 2024 06:28:33.693526030 CET	192.168.2.22	8.8.8.8	d04c	(Port unreachable)	Destination Unreachable
Nov 28, 2024 06:28:37.036854982 CET	192.168.2.22	8.8.8.8	d04c	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:04 UTC	690	OUT	GET /test/PROD_Start_DriverPack.hta HTTP/1.1 Host: dl.driverpack.io Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 05:28:04 UTC	275	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 05:25:49 GMT Content-Type: application/octet-stream Content-Length: 1672 Last-Modified: Wed, 19 Apr 2023 05:06:44 GMT Connection: close ETag: "643f76e4-688" Content-Disposition: attachment Accept-Ranges: bytes
2024-11-28 05:28:04 UTC	1672	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 74 61 72 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 20 20 2d 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 37 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 20 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 7b 20 49 46 20 5b 4e 4f 53 43 52 49 50 54 5d 20 7d 20 2d 2d 3e 0d 0a 20 20 20 20 3c 21 2d 2d 0d 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 Data Ascii: <!DOCTYPE html><html><head> <title>Starting...</title> ... -> <meta http-equiv="X-UA-Compatible" content="IE=7"> ... --> ... { IF [NOSCRIPT] } --> ... <noscript> <meta http-equiv="refresh" c

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:06 UTC	438	OUT	POST /safebrowsing/clientreport/download?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: sb-ssl.google.com Connection: keep-alive Content-Length: 465 Content-Type: application/octet-stream Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2024-11-28 05:28:06 UTC	465	OUT	Data Raw: 0a 37 68 74 74 70 73 3a 2f 2f 64 6c 2e 64 72 69 76 65 72 70 61 63 6b 2e 69 6f 2f 74 65 73 74 2f 50 52 4f 44 5f 53 74 61 72 74 5f 44 72 69 76 65 72 50 61 63 6b 2e 68 74 61 12 22 0a 20 e9 dc 96 48 d8 fb 7d 94 34 31 45 9f 49 a7 d9 92 61 97 c2 d6 0b 3c 2b 6a 58 29 4f d7 5b 67 2b 25 18 88 0d 22 4d 0a 37 68 74 74 70 73 3a 2f 2f 64 6c 2e 64 72 69 76 65 72 70 61 63 6b 2e 69 6f 2f 74 65 73 74 2f 50 52 4f 44 5f 53 74 61 72 74 5f 44 72 69 76 65 72 50 61 63 6b 2e 68 74 61 10 00 1a 0e 38 37 2e 31 31 37 2e 32 33 39 2e 31 35 31 22 00 22 3b 0a 37 68 74 74 70 73 3a 2f 2f 64 6c 2e 64 72 69 76 65 72 70 61 63 6b 2e 69 6f 2f 74 65 73 74 2f 50 52 4f 44 5f 53 74 61 72 74 5f 44 72 69 76 65 72 50 61 63 6b 2e 68 74 61 10 02 2a 00 30 01 4a 19 50 52 4f 44 5f 53 74 61 72 74 5f 44 72 Data Ascii: 7https://dl.driverpack.io/test/PROD_Start_DriverPack.hta" H}41EIa<+jX)O[g+%"M7https://dl.driverpack.io/test/PROD_Start_DriverPack.hta87.117.239.151"";7https://dl.driverpack.io/test/PROD_Start_DriverPack.hta*0JPROD_Start_Dr
2024-11-28 05:28:07 UTC	757	IN	HTTP/1.1 200 OK P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Vary: Origin Vary: X-Origin Vary: Referer Date: Thu, 28 Nov 2024 05:28:07 GMT Content-Type: text/html Server: ESF Content-Length: 261 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Set-Cookie: NID=519=0HIxxLv8h_GPkzdyKMm7S4dR58yuOvSXrlJ9adJH5XqRUV3U8PvZtxexsfEByMY-Pep5fVkSQ5cOeuMNf37oE1HuGV8RcRR1jQlylfPmmzd59XqCCKjx_fbK8aT_jF5pplOEQL9A_TxxRdBZ0K0ZdbKqF6HR2-UsffLFMho07w0JRFBa-rnLhxM; expires=Fri, 30-May-2025 05:28:07 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Expires: Thu, 28 Nov 2024 05:28:07 GMT Cache-Control: private Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:07 UTC	261	IN	Data Raw: 08 00 1a 80 02 39 61 32 65 32 65 62 63 32 32 33 37 31 64 33 33 35 31 32 30 61 66 33 35 33 65 62 39 62 66 37 66 36 33 65 32 31 30 34 32 30 35 39 35 32 66 62 66 62 30 37 64 36 65 64 63 38 33 64 33 34 62 34 61 62 64 37 31 62 38 39 64 35 66 36 65 30 36 33 37 30 34 30 33 65 31 34 31 65 38 31 62 64 37 63 33 30 33 63 38 38 33 38 32 66 32 65 35 38 38 32 37 35 61 62 35 61 64 35 38 63 32 37 37 63 31 31 38 61 33 39 61 39 65 39 38 64 34 30 38 66 30 30 37 38 65 38 38 39 31 63 38 32 62 38 38 64 31 61 30 38 37 65 35 37 32 31 38 38 62 63 65 31 33 38 63 65 37 36 36 61 32 36 61 37 65 61 64 39 66 35 65 33 30 64 37 31 39 39 32 66 38 33 36 38 32 33 61 65 39 63 63 36 64 33 35 32 63 30 36 33 33 39 65 32 61 37 61 37 64 62 37 66 30 32 36 38 38 62 35 39 63 39 63 61 39 66 35 31 30 Data Ascii: 9a2e2ebc22371d335120af353eb9bf7f63e2104205952fbfb07d6edc83d34b4abd71b89d5f6e06370403e141e81bd7c303c88382f2e588275ab5ad58c277c118a39a9e98d408f0078e8891c82b88d1a087e572188bce138ce766a26a7ead9f5e30d71992f836823ae9cc6d352c06339e2a7a7db7f02688b59c9ca9f510

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:15 UTC	793	OUT	GET /chrome/?p=unsupported_windows HTTP/1.1 Host: support.google.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962
2024-11-28 05:28:15 UTC	565	IN	HTTP/1.1 301 Moved Permanently Location: https://support.google.com/chrome/answer/95346?visit_id=638683684954471283-2255631397&p=unsupported_windows&rd=1#chrome_update_sse3 X-Robots-Tag: follow,index Date: Thu, 28 Nov 2024 05:28:15 GMT Expires: Thu, 28 Nov 2024 05:28:15 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: support-content-ui Content-Length: 336 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:15 UTC	336	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 68 72 6f 6d 65 2f 61 6e 73 77 65 72 2f 39 35 33 34 36 3f 76 69 73 69 74 5f 69 64 3d 36 33 38 36 38 33 36 38 34 39 35 34 34 37 31 32 38 33 2d 32 32 35 35 36 33 31 33 39 37 26 61 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://support.google.com/chrome/answer/95346?visit_id=638683684954471283-2255631397&a

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:15 UTC	849	OUT	GET /chrome/answer/95346?visit_id=638683684954471283-2255631397&p=unsupported_windows&rd=1 HTTP/1.1 Host: support.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962
2024-11-28 05:28:16 UTC	1477	IN	HTTP/1.1 200 OK P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000; includeSubdomains Content-Type: text/html; charset=UTF-8 Date: Thu, 28 Nov 2024 05:28:16 GMT Expires: Thu, 28 Nov 2024 05:28:16 GMT Cache-Control: private, max-age=0 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-KXEBeEE9kUcY2JsV9sjD' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http: 'report-sample';report-uri https://csp.withgoogle.com/csp/scfe P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." X-Content-Type-Options: nosniff Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=519=p4dkXG3IWr23bSum6j9CCON7EZT7bzFLBveBCg-9ufI-9p7W-Zpa3FErfiTj_x57qgvYdphDkoG5B4hDR0eYYO-wPZf4VxmIAwBe7PgoNEojIuxx1HkBflxeM0EwK4CcyPDIo0S7SXnwrzniIkEBfYd4namYizgAl-_C0iOe_bRPgCMZwBtwFTY; expires=Fri, 30-May-2025 05:28:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Set-Cookie: NID=519=p4dkXG3IWr23bSum6j9CCON7EZT7bzFLBveBCg-9ufI-9p7W-Zpa3FErfiTj_x57qgvYdphDkoG5B4hDR0eYYO-wPZf4VxmIAwBe7PgoNEojIuxx1HkBflxeM0EwK4CcyPDIo0S7SXnwrzniIkEBfYd4namYizgAl-_C0iOe_bRPgCMZwBtwFTY; expires=Fri, 30-May-2025 05:28:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 68 63 66 65 22 20 64 61 74 61 2d 70 61 67 65 2d 74 79 70 65 3d 22 41 4e 53 57 45 52 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 77 6e 6c 6f 61 64 20 26 61 6d 70 3b 20 69 6e 73 74 61 6c 6c 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 20 2d 20 43 6f 6d 70 75 74 65 72 20 2d 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 20 48 65 6c 70 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 65 6d 61 69 6c 3d 6e 6f 22 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 66 6f 6c 6c 6f 77 2c 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e Data Ascii: 8000<!doctype html><html class="hcfe" data-page-type="ANSWER" lang="en"><head><title>Download & install Google Chrome - Computer - Google Chrome Help</title><meta content="email=no" name="format-detection"><meta content="follow,index" name="robots">
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 31 46 30 30 2d 31 46 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 34 57 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 37 30 2d 30 33 37 37 2c 55 2b 30 33 37 41 2d 30 33 37 46 2c 55 2b 30 Data Ascii: xKOzY.woff2)format('woff2');unicode-range:U+1F00-1FFF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)format('woff2');unicode-range:U+0370-0377,U+037A-037F,U+0
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 55 2b 31 43 38 30 2d 31 43 38 41 2c 55 2b 32 30 42 34 2c 55 2b 32 44 45 30 2d 32 44 46 46 2c 55 2b 41 36 34 30 2d 41 36 39 46 2c 55 2b 46 45 32 45 2d 46 45 32 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 41 42 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 30 31 2c 55 2b 30 34 30 30 2d 30 34 35 46 2c 55 2b 30 Data Ascii: U+1C80-1C8A,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F;}@font-face{font-family:'Roboto';font-style:normal;font-weight:500;src:url(https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)format('woff2');unicode-range:U+0301,U+0400-045F,U+0
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 30 30 30 2d 30 30 46 46 2c 55 2b 30 31 33 31 2c 55 2b 30 31 35 32 2d 30 31 35 33 2c 55 2b 30 32 42 42 2d 30 32 42 43 2c 55 2b 30 32 43 36 2c 55 2b 30 32 44 41 2c 55 2b 30 32 44 43 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 32 30 30 30 2d 32 30 36 46 2c 55 2b 32 30 41 43 2c 55 2b 32 31 32 32 2c 55 2b 32 31 39 31 2c 55 2b 32 31 39 33 2c 55 2b 32 32 31 32 2c 55 2b 32 32 31 35 2c 55 2b 46 45 46 46 2c 55 2b 46 46 46 44 3b 7d 40 66 6f 6e 74 2d 66 61 63 Data Ascii: fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)format('woff2');unicode-range:U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD;}@font-fac
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 57 55 6c 66 43 68 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 30 2d 30 32 42 41 2c 55 2b 30 32 42 44 2d 30 32 43 35 2c 55 2b 30 32 43 37 2d 30 32 43 43 2c 55 2b 30 32 43 45 2d 30 32 44 37 2c 55 2b 30 32 44 44 2d 30 32 46 46 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 Data Ascii: t-face{font-family:'Roboto';font-style:normal;font-weight:700;src:url(https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)format('woff2');unicode-range:U+0100-02BA,U+02BD-02C5,U+02C7-02CC,U+02CE-02D7,U+02DD-02FF,U+0304,U+0308,U+0329,U
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 2c 55 2b 30 33 30 38 2d 30 33 30 39 2c 55 2b 30 33 32 33 2c 55 2b 30 33 32 39 2c 55 2b 31 45 41 30 2d 31 45 46 39 2c 55 2b 32 30 41 42 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6f 6f 67 6c 65 20 53 61 6e 73 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 67 6f 6f 67 6c 65 73 61 6e 73 2f 76 31 36 2f 34 55 61 47 72 45 4e 48 73 78 4a 6c 47 44 75 47 6f 31 4f 49 6c 4c 33 41 77 70 35 4d 4b 67 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 30 2d 30 32 42 41 2c 55 2b 30 32 42 44 2d Data Ascii: ,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB;}@font-face{font-family:'Google Sans';font-style:normal;font-weight:400;src:url(https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlL3Awp5MKg.woff2)format('woff2');unicode-range:U+0100-02BA,U+02BD-
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 2c 55 2b 30 31 32 38 2d 30 31 32 39 2c 55 2b 30 31 36 38 2d 30 31 36 39 2c 55 2b 30 31 41 30 2d 30 31 41 31 2c 55 2b 30 31 41 46 2d 30 31 42 30 2c 55 2b 30 33 30 30 2d 30 33 30 31 2c 55 2b 30 33 30 33 2d 30 33 30 34 2c 55 2b 30 33 30 38 2d 30 33 30 39 2c 55 2b 30 33 32 33 2c 55 2b 30 33 32 39 2c 55 2b 31 45 41 30 2d 31 45 46 39 2c 55 2b 32 30 41 42 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6f 6f 67 6c 65 20 53 61 6e 73 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 67 6f 6f 67 6c 65 73 61 6e 73 2f 76 31 36 2f 34 55 61 62 72 45 4e 48 73 78 4a 6c 47 44 Data Ascii: ,U+0128-0129,U+0168-0169,U+01A0-01A1,U+01AF-01B0,U+0300-0301,U+0303-0304,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB;}@font-face{font-family:'Google Sans';font-style:normal;font-weight:500;src:url(https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGD
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 3b 0a 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 29 7b 77 69 6e 64 6f 77 5b 27 77 73 72 74 27 5d 20 3d 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 29 3b 7d 0a 20 20 3c 2f 73 63 72 69 70 74 3e 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 2f 61 6e 61 6c 79 74 69 63 73 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 20 6e 6f 6e 63 65 3d 22 4b 58 45 42 65 45 45 39 6b 55 63 59 32 4a 73 56 39 73 6a 44 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 Data Ascii: ate().getTime(); if (window.performance && window.performance.now){window['wsrt'] = Math.floor(window.performance.now());} </script> <script src="https://www.google-analytics.com/analytics.js" async="" nonce="KXEBeEE9kUcY2JsV9sjD"></script><script s
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 27 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 27 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 72 65 6d 7d 2e 68 63 66 65 3a 6e 6f 74 28 68 74 6d 6c 29 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 72 65 6d 7d 2e 68 63 66 65 20 70 7b 6d 61 72 67 69 6e 3a 2e 33 31 32 35 72 65 6d 20 30 7d 2e 68 63 66 65 20 61 7b 63 6f 6c 6f 72 3a 23 30 62 35 37 64 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 68 63 66 65 20 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 2e 68 63 66 65 20 61 72 74 69 63 6c 65 20 73 65 63 74 69 6f 6e 20 73 65 63 74 69 6f 6e 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 73 6b 69 70 2d 6c 69 6e 6b 7b 70 6f Data Ascii: etica, sans-serif, 'Noto Color Emoji';letter-spacing:0rem;line-height:1.25rem}.hcfe:not(html){font-size:.875rem}.hcfe p{margin:.3125rem 0}.hcfe a{color:#0b57d0;text-decoration:none}.hcfe a img{border:0}.hcfe article section section{padding:0}.skip-link{po
2024-11-28 05:28:16 UTC	1477	IN	Data Raw: 6d 7d 2e 68 63 66 65 20 73 75 70 7b 74 6f 70 3a 2d 2e 35 65 6d 7d 2e 68 63 66 65 20 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 34 38 2e 31 38 37 35 72 65 6d 29 7b 2e 68 63 66 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 66 66 66 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 68 63 66 65 3a 6e 6f 74 28 68 74 6d 6c 29 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 72 65 6d 7d 2e 68 63 66 65 2e 72 65 6e 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 73 74 61 74 69 63 7d 2e 68 63 66 65 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 35 72 65 6d 3b 6d 61 72 Data Ascii: m}.hcfe sup{top:-.5em}.hcfe a:hover{text-decoration:underline}@media (min-width:48.1875rem){.hcfe{background:#ffffff;position:absolute;width:100%}.hcfe:not(html){font-size:.875rem}.hcfe.render{position:static}.hcfe h1{font-size:2rem;line-height:2.5rem;mar

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:20 UTC	547	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://support.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 05:28:21 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://support.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Nov 2024 05:28:21 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:20 UTC	1718	OUT	POST /apis/caseslist?hl=en&key=support-content&request_source=1&mendel_ids=10800112%2C1706538%2C1714255%2C10800561%2C10800621%2C10800672%2C10800695%2C10800700%2C10800707%2C10800738%2C10800761%2C10800848%2C10800880%2C10800922%2C10800950%2C10800957%2C10801032%2C10801042%2C10801150%2C10801288%2C10801345%2C10801539%2C10801601%2C10801704%2C10801736%2C10801757%2C10802104%2C10802277%2C10802281%2C10802381%2C10802419%2C10802571%2C10802616%2C10802624%2C10802781%2C10803447%2C10803751%2C10803805%2C10803950%2C10803957%2C10803964%2C10803965%2C10804278%2C10804406%2C10804411%2C97601634&authuser=0&v=1&helpcenter=chrome HTTP/1.1 Host: support.google.com Connection: keep-alive Content-Length: 2 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" Content-Type: application/json+protobuf X-SupportContent-AllowApiCookieAuth: true X-SupportContent-XsrfToken: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://support.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://support.google.com/chrome/answer/95346?visit_id=638683684954471283-2255631397&p=unsupported_windows&rd=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=p4dkXG3IWr23bSum6j9CCON7EZT7bzFLBveBCg-9ufI-9p7W-Zpa3FErfiTj_x57qgvYdphDkoG5B4hDR0eYYO-wPZf4VxmIAwBe7PgoNEojIuxx1HkBflxeM0EwK4CcyPDIo0S7SXnwrzniIkEBfYd4namYizgAl-_C0iOe_bRPgCMZwBtwFTY; SUPPORT_CONTENT=638683684961082416-2164616597
2024-11-28 05:28:20 UTC	2	OUT	Data Raw: 5b 5d Data Ascii: []
2024-11-28 05:28:21 UTC	1665	IN	HTTP/1.1 200 OK P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000; includeSubdomains Date: Thu, 28 Nov 2024 05:28:21 GMT Expires: Thu, 28 Nov 2024 05:28:21 GMT Cache-Control: private, max-age=0 Content-Type: application/json; charset=UTF-8 Access-Control-Allow-Origin: https://support.google.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT Access-Control-Allow-Headers: X-SupportContent-XsrfToken, Authorization, Content-Type, If-None-Match, X-SupportContent-AllowApiCookieAuth, x-googapps-allowed-domains Access-Control-Max-Age: 3600 P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=519=KUYniNYovDq3hifMi1FzLONQZ1Z1f9r08bktf5RnFPogZ0FZDQlGEoKqM2toj-FXC9EKEENBj-4U0t_LwDLcavoM4PQeTJytO65Y3KaVLvVZRZUobhSw23S97vrIdT1BVOM8nudU2QHfwAJmoLYmo5XctwNJvjtz58Z2pkcDMWnFW3Ux6lVejgNLtGw5qtc; expires=Fri, 30-May-2025 05:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Set-Cookie: NID=519=KUYniNYovDq3hifMi1FzLONQZ1Z1f9r08bktf5RnFPogZ0FZDQlGEoKqM2toj-FXC9EKEENBj-4U0t_LwDLcavoM4PQeTJytO65Y3KaVLvVZRZUobhSw23S97vrIdT1BVOM8nudU2QHfwAJmoLYmo5XctwNJvjtz58Z2pkcDMWnFW3Ux6lVejgNLtGw5qtc; expires=Fri, 30-May-2025 05:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:21 UTC	7	IN	Data Raw: 32 0d 0a 5b 5d 0d 0a Data Ascii: 2[]
2024-11-28 05:28:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:20 UTC	1642	OUT	POST /apis/prefinsert?v=0&helpcenter=chrome&hl=en&key=support-content&request_source=1&service_configuration=&mendel_ids=10800112,1706538,1714255,10800561,10800621,10800672,10800695,10800700,10800707,10800738,10800761,10800848,10800880,10800922,10800950,10800957,10801032,10801042,10801150,10801288,10801345,10801539,10801601,10801704,10801736,10801757,10802104,10802277,10802281,10802381,10802419,10802571,10802616,10802624,10802781,10803447,10803751,10803805,10803950,10803957,10803964,10803965,10804278,10804406,10804411,97601634 HTTP/1.1 Host: support.google.com Connection: keep-alive Content-Length: 587 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" Content-Type: text/plain;charset=UTF-8 X-SupportContent-AllowApiCookieAuth: true X-SupportContent-XsrfToken: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://support.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://support.google.com/chrome/answer/95346?visit_id=638683684954471283-2255631397&p=unsupported_windows&rd=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=p4dkXG3IWr23bSum6j9CCON7EZT7bzFLBveBCg-9ufI-9p7W-Zpa3FErfiTj_x57qgvYdphDkoG5B4hDR0eYYO-wPZf4VxmIAwBe7PgoNEojIuxx1HkBflxeM0EwK4CcyPDIo0S7SXnwrzniIkEBfYd4namYizgAl-_C0iOe_bRPgCMZwBtwFTY; SUPPORT_CONTENT=638683684961082416-2164616597
2024-11-28 05:28:20 UTC	587	OUT	Data Raw: 7b 22 63 6f 6d 6d 6f 6e 5f 70 61 72 61 6d 73 22 3a 7b 22 63 6f 6e 74 65 78 74 5f 70 61 72 61 6d 73 22 3a 7b 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 31 30 38 30 30 31 31 32 2c 31 37 30 36 35 33 38 2c 31 37 31 34 32 35 35 2c 31 30 38 30 30 35 36 31 2c 31 30 38 30 30 36 32 31 2c 31 30 38 30 30 36 37 32 2c 31 30 38 30 30 36 39 35 2c 31 30 38 30 30 37 30 30 2c 31 30 38 30 30 37 30 37 2c 31 30 38 30 30 37 33 38 2c 31 30 38 30 30 37 36 31 2c 31 30 38 30 30 38 34 38 2c 31 30 38 30 30 38 38 30 2c 31 30 38 30 30 39 32 32 2c 31 30 38 30 30 39 35 30 2c 31 30 38 30 30 39 35 37 2c 31 30 38 30 31 30 33 32 2c 31 30 38 30 31 30 34 32 2c 31 30 38 30 31 31 35 30 2c 31 30 38 30 31 32 38 38 2c 31 30 38 30 31 33 34 35 2c 31 30 38 30 31 35 33 39 2c 31 30 38 30 31 36 Data Ascii: {"common_params":{"context_params":{"experiment_id":[10800112,1706538,1714255,10800561,10800621,10800672,10800695,10800700,10800707,10800738,10800761,10800848,10800880,10800922,10800950,10800957,10801032,10801042,10801150,10801288,10801345,10801539,108016
2024-11-28 05:28:21 UTC	1621	IN	HTTP/1.1 200 OK P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000; includeSubdomains Date: Thu, 28 Nov 2024 05:28:21 GMT Expires: Thu, 28 Nov 2024 05:28:21 GMT Cache-Control: private, max-age=0 Content-Type: application/json; charset=UTF-8 Access-Control-Allow-Origin: https://support.google.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET Access-Control-Allow-Headers: X-SupportContent-XsrfToken, Authorization, Content-Type, If-None-Match, X-SupportContent-AllowApiCookieAuth, x-googapps-allowed-domains P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM; expires=Fri, 30-May-2025 05:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Set-Cookie: NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM; expires=Fri, 30-May-2025 05:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:21 UTC	44	IN	Data Raw: 32 36 0d 0a 7b 22 68 65 6c 70 63 65 6e 74 65 72 22 3a 22 63 68 72 6f 6d 65 22 2c 22 75 73 65 72 5f 70 72 65 66 22 3a 5b 5d 7d 0d 0a Data Ascii: 26{"helpcenter":"chrome","user_pref":[]}
2024-11-28 05:28:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:21 UTC	737	OUT	GET /gv4UzxwBWVHxxyY26lRgv7WIeFfZZSSCGe5vUBZdm7ePRpUvmf_5Cs23ZTgETaA2kyU4=w36-h36 HTTP/1.1 Host: lh3.googleusercontent.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 05:28:22 UTC	530	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Disposition: inline;filename="unnamed.png" X-Content-Type-Options: nosniff Server: fife Content-Length: 151 X-XSS-Protection: 0 Date: Thu, 28 Nov 2024 04:16:15 GMT Expires: Fri, 29 Nov 2024 04:16:15 GMT Cache-Control: public, max-age=86400, no-transform Age: 4326 ETag: "v1" Content-Type: image/png Vary: Origin Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:22 UTC	151	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 04 00 00 00 4a 7e f5 73 00 00 00 5e 49 44 41 54 38 cb 63 60 18 05 30 50 1a 5a 1a 4a 8a 72 d1 d2 57 40 28 42 bc 86 d5 a5 ff 81 70 25 b1 ca c3 c0 ca 41 30 84 38 e7 bc 86 6b 78 49 84 b3 a0 ce 81 c1 95 c4 3b 07 06 83 f1 29 17 43 72 0e 31 ce 2a 5d 83 a1 1c 04 57 e0 52 1e 8e 55 39 08 06 0d 54 fa f9 8f 1b 52 47 c3 c8 01 00 30 ec 8f a5 de b7 8a 5f 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRJ~s^IDAT8c`0PZJrW@(Bp%A08kxI;)Cr1*]WRU9TRG0_IENDB`

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:22 UTC	547	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://support.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 05:28:23 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://support.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Nov 2024 05:28:23 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:23 UTC	974	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1640 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://support.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=KUYniNYovDq3hifMi1FzLONQZ1Z1f9r08bktf5RnFPogZ0FZDQlGEoKqM2toj-FXC9EKEENBj-4U0t_LwDLcavoM4PQeTJytO65Y3KaVLvVZRZUobhSw23S97vrIdT1BVOM8nudU2QHfwAJmoLYmo5XctwNJvjtz58Z2pkcDMWnFW3Ux6lVejgNLtGw5qtc
2024-11-28 05:28:23 UTC	1640	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 4e 6f 74 5f 41 20 42 72 61 6e 64 22 2c 22 39 39 22 5d 2c 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 30 39 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 30 39 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 30 2e 31 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 30 39 2e 30 2e 35 34 31 34 2e 31 32 30 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 38 36 30 2c 5b 5b 22 31 37 33 32 37 37 31 36 39 37 37 35 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Not_A Brand","99"],["Google Chrome","109"],["Chromium","109"]],0,"Windows","0.1.0","x86","","109.0.5414.120"],[4,0,0,0,0]]],860,[["1732771697759",null,null,null,
2024-11-28 05:28:24 UTC	498	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://support.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Nov 2024 05:28:23 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:24 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-28 05:28:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:23 UTC	1373	OUT	GET /apis/caseslist?hl=en&key=support-content&request_source=1&mendel_ids=10800112%2C1706538%2C1714255%2C10800561%2C10800621%2C10800672%2C10800695%2C10800700%2C10800707%2C10800738%2C10800761%2C10800848%2C10800880%2C10800922%2C10800950%2C10800957%2C10801032%2C10801042%2C10801150%2C10801288%2C10801345%2C10801539%2C10801601%2C10801704%2C10801736%2C10801757%2C10802104%2C10802277%2C10802281%2C10802381%2C10802419%2C10802571%2C10802616%2C10802624%2C10802781%2C10803447%2C10803751%2C10803805%2C10803950%2C10803957%2C10803964%2C10803965%2C10804278%2C10804406%2C10804411%2C97601634&authuser=0&v=1&helpcenter=chrome HTTP/1.1 Host: support.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; SUPPORT_CONTENT=638683684961082416-2164616597; _ga_H30R9PNQFN=GS1.1.1732771699.1.0.1732771699.0.0.0; _ga=GA1.1.178909739.1732771700; NID=519=KUYniNYovDq3hifMi1FzLONQZ1Z1f9r08bktf5RnFPogZ0FZDQlGEoKqM2toj-FXC9EKEENBj-4U0t_LwDLcavoM4PQeTJytO65Y3KaVLvVZRZUobhSw23S97vrIdT1BVOM8nudU2QHfwAJmoLYmo5XctwNJvjtz58Z2pkcDMWnFW3Ux6lVejgNLtGw5qtc
2024-11-28 05:28:24 UTC	503	IN	HTTP/1.1 400 Bad Request Strict-Transport-Security: max-age=31536000; includeSubdomains Date: Thu, 28 Nov 2024 05:28:24 GMT Expires: Thu, 28 Nov 2024 05:28:24 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:24 UTC	17	IN	Data Raw: 63 0d 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0d 0a Data Ascii: cBad request.
2024-11-28 05:28:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:23 UTC	1296	OUT	GET /apis/prefinsert?v=0&helpcenter=chrome&hl=en&key=support-content&request_source=1&service_configuration=&mendel_ids=10800112,1706538,1714255,10800561,10800621,10800672,10800695,10800700,10800707,10800738,10800761,10800848,10800880,10800922,10800950,10800957,10801032,10801042,10801150,10801288,10801345,10801539,10801601,10801704,10801736,10801757,10802104,10802277,10802281,10802381,10802419,10802571,10802616,10802624,10802781,10803447,10803751,10803805,10803950,10803957,10803964,10803965,10804278,10804406,10804411,97601634 HTTP/1.1 Host: support.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; SUPPORT_CONTENT=638683684961082416-2164616597; _ga_H30R9PNQFN=GS1.1.1732771699.1.0.1732771699.0.0.0; _ga=GA1.1.178909739.1732771700; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:24 UTC	503	IN	HTTP/1.1 400 Bad Request Strict-Transport-Security: max-age=31536000; includeSubdomains Date: Thu, 28 Nov 2024 05:28:24 GMT Expires: Thu, 28 Nov 2024 05:28:24 GMT Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: support-content-ui X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:24 UTC	17	IN	Data Raw: 63 0d 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0d 0a Data Ascii: cBad request.
2024-11-28 05:28:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:25 UTC	974	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1671 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://support.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:25 UTC	1671	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 4e 6f 74 5f 41 20 42 72 61 6e 64 22 2c 22 39 39 22 5d 2c 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 30 39 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 30 39 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 30 2e 31 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 30 39 2e 30 2e 35 34 31 34 2e 31 32 30 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 38 36 30 2c 5b 5b 22 31 37 33 32 37 37 31 36 39 39 37 30 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Not_A Brand","99"],["Google Chrome","109"],["Chromium","109"]],0,"Windows","0.1.0","x86","","109.0.5414.120"],[4,0,0,0,0]]],860,[["1732771699708",null,null,null,
2024-11-28 05:28:25 UTC	498	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://support.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Nov 2024 05:28:25 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:25 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-28 05:28:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:26 UTC	673	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:26 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:26 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:26 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:26 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:28 UTC	673	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:29 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:29 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:29 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:29 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://dl.driverpack.io/test/PROD_Start_DriverPack.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\PROD_Start_DriverPack.hta (copy)

C:\Users\user\Downloads\Unconfirmed 246082.crdownload (copy)

C:\Users\user\Downloads\ab4f7167-f9b0-4b51-9752-2345d435a0c0.tmp

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Windows Analysis Report
https://dl.driverpack.io/test/PROD_Start_DriverPack.hta

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:28 UTC	891	OUT	GET /generate_204 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:30 UTC	203	IN	HTTP/1.1 204 No Content Content-Length: 0 Cross-Origin-Resource-Policy: cross-origin Date: Thu, 28 Nov 2024 05:28:29 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:32 UTC	965	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 906 sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://support.google.com X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:32 UTC	906	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 4e 6f 74 5f 41 20 42 72 61 6e 64 22 2c 22 39 39 22 5d 2c 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 30 39 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 30 39 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 30 2e 31 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 30 39 2e 30 2e 35 34 31 34 2e 31 32 30 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 37 37 31 37 30 38 37 33 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Not_A Brand","99"],["Google Chrome","109"],["Chromium","109"]],0,"Windows","0.1.0","x86","","109.0.5414.120"],[1,0,0,0,0]]],373,[["1732771708731",null,null,null,
2024-11-28 05:28:33 UTC	498	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://support.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Nov 2024 05:28:32 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:28:33 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-28 05:28:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:33 UTC	673	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:34 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:34 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:34 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:34 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:35 UTC	985	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:36 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 116987 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 21 Nov 2024 10:32:54 GMT Expires: Fri, 21 Nov 2025 10:32:54 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 11 Nov 2024 18:41:25 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 586541 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:36 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 66 61 2c 6d 61 2c 6e 61 2c 72 61 2c 73 61 2c 75 61 3b 61 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);var aa,ba,fa,ma,na,ra,sa,ua;aa=fun
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 Data Ascii: rn a;a[b]=c.value;return a};fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 73 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 Data Ascii: defined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error("b`"+String(a));};ra=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};sa=typeof Object.assign=="function"?Object
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 30 3b 74 68 69 73 2e 4b 72 3d 5b 5d 3b 74 68 69 73 2e 58 55 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 4d 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 48 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 4d 64 61 3d 66 75 6e 63 74 Data Ascii: 0;this.Kr=[];this.XU=!1;var k=this.aF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.aF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Mda),reject:h(this.HJ)}};e.prototype.Mda=funct
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 79 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4b 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4b 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 4d 4f 28 74 68 69 73 2e 4b 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4b 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 68 2e 5a 78 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 Data Ascii: ototype.y7=function(){if(this.Kr!=null){for(var h=0;h<this.Kr.length;++h)f.MO(this.Kr[h]);this.Kr=null}};var f=new b;e.prototype.tfa=function(h){var k=this.aF();h.Zx(k.resolve,k.reject)};e.prototype.ufa=function(h,k){var l=this.aF();try{h.call(k,l.resolv
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6d 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 42 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d Data Ascii: regular expression");return a+""};ma("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ba(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 72 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 72 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 Data Ascii: a(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!ra(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&ra(l,f)?l[f][this.Ga]:voi
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 58 65 2e 50 6b 2e 6e 65 78 74 3d 6b 2e 58 65 2e 6e 65 78 74 2c 6b 2e 58 65 2e 6e 65 78 74 2e 50 6b 3d 0a 6b 2e 58 65 2e 50 6b 2c 6b 2e 58 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 50 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 58 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e Data Ascii: th\|\|delete this[0][k.id],k.Xe.Pk.next=k.Xe.next,k.Xe.next.Pk=k.Xe.Pk,k.Xe.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Pk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Xe};c.prototype.get=function
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e Data Ascii: c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.n
2024-11-28 05:28:36 UTC	1390	IN	Data Raw: 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6d 61 Data Ascii: ;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});ma

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:36 UTC	662	OUT	GET /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:37 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:36 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:37 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:37 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:40 UTC	799	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:41 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 116987 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 21 Nov 2024 10:32:54 GMT Expires: Fri, 21 Nov 2025 10:32:54 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 11 Nov 2024 18:41:25 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 586547 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:41 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 66 61 2c 6d 61 2c 6e 61 2c 72 61 2c 73 61 2c 75 61 3b 61 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);var aa,ba,fa,ma,na,ra,sa,ua;aa=fun
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 Data Ascii: rn a;a[b]=c.value;return a};fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 73 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 Data Ascii: defined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error("b`"+String(a));};ra=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};sa=typeof Object.assign=="function"?Object
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 30 3b 74 68 69 73 2e 4b 72 3d 5b 5d 3b 74 68 69 73 2e 58 55 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 4d 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 48 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 4d 64 61 3d 66 75 6e 63 74 Data Ascii: 0;this.Kr=[];this.XU=!1;var k=this.aF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.aF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Mda),reject:h(this.HJ)}};e.prototype.Mda=funct
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 79 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4b 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4b 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 4d 4f 28 74 68 69 73 2e 4b 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4b 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 68 2e 5a 78 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 Data Ascii: ototype.y7=function(){if(this.Kr!=null){for(var h=0;h<this.Kr.length;++h)f.MO(this.Kr[h]);this.Kr=null}};var f=new b;e.prototype.tfa=function(h){var k=this.aF();h.Zx(k.resolve,k.reject)};e.prototype.ufa=function(h,k){var l=this.aF();try{h.call(k,l.resolv
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6d 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 42 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d Data Ascii: regular expression");return a+""};ma("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ba(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 72 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 72 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 Data Ascii: a(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!ra(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&ra(l,f)?l[f][this.Ga]:voi
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 58 65 2e 50 6b 2e 6e 65 78 74 3d 6b 2e 58 65 2e 6e 65 78 74 2c 6b 2e 58 65 2e 6e 65 78 74 2e 50 6b 3d 0a 6b 2e 58 65 2e 50 6b 2c 6b 2e 58 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 50 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 58 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e Data Ascii: th\|\|delete this[0][k.id],k.Xe.Pk.next=k.Xe.next,k.Xe.next.Pk=k.Xe.Pk,k.Xe.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Pk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Xe};c.prototype.get=function
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e Data Ascii: c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.n
2024-11-28 05:28:41 UTC	1390	IN	Data Raw: 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6d 61 Data Ascii: ;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});ma

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:46 UTC	673	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:46 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:46 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:46 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:46 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:47 UTC	673	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:48 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:48 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:48 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:48 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:48 UTC	673	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:49 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:48 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:49 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:49 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:28:53 UTC	673	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCLjIzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; NID=519=xgTaEfaHmiUWz7Or1mPqT7RxCSKt2cSxyuH7m2mU2V4o61JGDE-hhEmZ7IZT7BDP6o3C9HIZoguhyOZf1Lx_e4wp6rC6z00LXLLzkraDd_aRFKdNSD7BcpbWqCKYKDg7Iu1tXyViaLSHVkwl6544UT_Jdno4dvKe8Nw-HDrqZRt3_ImBp0zrbdpDam8KfoM
2024-11-28 05:28:54 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Nov 2024 05:28:54 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:28:54 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-11-28 05:28:54 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span