Edit tour

Windows Analysis Report
https://forms.gle/XsPfAF5jPgqSvvp87

Overview

General Information

Sample URL:	https://forms.gle/XsPfAF5jPgqSvvp87
Analysis ID:	1584829
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detected suspicious crossdomain redirect

HTML body contains password input but no form action

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4064 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.gle/XsPfAF5jPgqSvvp87" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform

Joe Sandbox AI: Score: 7 Reasons: The URL 'docs.google.com' is associated with Google, not Office 365., Office 365 is a well-known brand associated with Microsoft, typically using domains like 'office.com' or 'microsoft.com'., The URL does not match the legitimate domain name associated with Office 365., The presence of input fields requesting sensitive information such as passwords and phone numbers is suspicious., The URL 'docs.google.com' is a legitimate Google domain, but it is not related to Office 365 services. DOM: 2.0.pages.csv

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-954689695&timestamp=1736174896324
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-954689695&timestamp=1736174896324
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-954689695&timestamp=1736174896324
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: Iframe src: /_/bscframe

HTTP Parser: <input type="password" .../> found

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No favicon

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="author".. found

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1409652638%3A1736174879261416&ddm=1	HTTP Parser: No <meta name="copyright".. found

Source:	Binary string: _.ODb=_.Q("WBfAfb");_.PDb=_.Q("y0q3Tb");_.QDb=_.Q("JstLif"); source: chromecache_210.2.dr, chromecache_173.2.dr
Source:	Binary string: var ryc=function(a){if(!a.o()&&a.j.j.length!==0){var b=a.j.j.shift();a.j.H=b.Jf;_.DE(a.H)?_.EE(a.H,b.Jf):a.H.appendChild(b.Jf);setTimeout(function(){var c;(c=b.Jf.querySelector('[jsname="XxIAqe"]'))==null\|\|c.appendChild(b.content)},150);_.$e(b.Jf,_.ODb,b.wr);_.Ye(b.Jf,_.QDb,function(){b.HJ.resolve()});_.Ye(b.Jf,_.PDb,function(c){a.H.contains(b.Jf)&&a.H.removeChild(b.Jf);a.j.H=null;b.ZH.resolve(c.data);ryc(a)})}};_.ju(_.GAa,_.y8); source: chromecache_210.2.dr, chromecache_173.2.dr

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: forms.gle to https://docs.google.com/forms/d/e/1faipqlsc0kussn_ke2ag2cvgmnyeimuxprsd6l9ctkrrzom4spygrjg/viewform?usp=send_form

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XsPfAF5jPgqSvvp87 HTTP/1.1Host: forms.gleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA

Source: chromecache_214.2.dr, chromecache_220.2.dr	String found in binary or memory: Cf=y(["https://sandbox.google.com/tools/feedback/"]),Df=y(["https://www.google.cn/tools/feedback/"]),Ef=y(["https://help.youtube.com/tools/feedback/"]),Ff=y(["https://asx-frontend-staging.corp.google.com/inapp/"]),Gf=y(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),Hf=y(["https://localhost.corp.google.com/inapp/"]),If=y(["https://localhost.proxy.googlers.com/inapp/"]),Jf=U(lf),Kf=[U(mf),U(nf)],Lf=[U(of),U(pf),U(qf),U(rf),U(sf),U(tf),U(uf),U(vf),U(wf),U(xf)],Mf=[U(yf),U(zf)],Nf= equals www.youtube.com (Youtube)
Source: chromecache_247.2.dr	String found in binary or memory: _.wq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.wq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.wq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.wq(_.Fq(c))+"&hl="+_.wq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.wq(m)+"/chromebook/termsofservice.html?languageCode="+_.wq(d)+"&regionCode="+_.wq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: forms.gle
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com

Source: unknown

HTTP traffic detected: POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/naLogImpressions HTTP/1.1Host: docs.google.comConnection: keep-aliveContent-Length: 5244sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Same-Domain: 1Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0X-Client-Deadline-Ms: 20000User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_formAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRCT9u-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=FevtxKwTOp6r84NBA4YkbXKVKf9wUAaQVrHAfRMjysplo-thkXEQxWd2zIyJlLVH7IqTKnes5ZX7RygdJUrW_sgvj019x_S0oFGDH5iw4unm1vOTaDZJR-gOhkvI-X52osNwsiqrraf9Rx5LljoVu_GAnCQVOzKNEND5TMgxLTzCBGqaGZg20XP7

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.gle/XsPfAF5jPgqSvvp87"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4064 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4064 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 --field-trial-handle=2240,i,857742443695476327,4075489431369839539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
docs.google.com	142.250.185.206	true	false	high
csp.withgoogle.com	142.250.186.81	true	false	high
play.google.com	142.250.186.110	true	false	high
www3.l.google.com	142.250.74.206	true	false	high
www.google.com	142.250.186.164	true	false	high
forms.gle	199.36.158.100	true	false	high
accounts.youtube.com	unknown	unknown	false	high

Name	Source	Malicious	Reputation
https://play.google/intl/	chromecache_255.2.dr, chromecache_247.2.dr	false	high
http://localhost.corp.google.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://families.google.com/intl/	chromecache_247.2.dr	false	high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://youtube.com/embed/?rel=0	chromecache_257.2.dr, chromecache_233.2.dr	false	high
https://apis.google.com/js/client.js	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://policies.google.com/technologies/location-data	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://support.google.com	chromecache_257.2.dr, chromecache_233.2.dr	false	high
https://play.google.com	chromecache_257.2.dr, chromecache_233.2.dr	false	high
https://youtube.com/embed/	chromecache_257.2.dr, chromecache_233.2.dr	false	high
http://localhost.proxy.googlers.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_220.2.dr	false	high
https://support.google.com/inapp/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://asx-help-frontend-autopush.corp.youtube.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://play.google.com/work/enroll?identifier=	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://policies.google.com/terms/service-specific	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://g.co/recover	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	chromecache_247.2.dr	false	high
https://help.youtube.com/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://policies.google.com/technologies/cookies	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://policies.google.com/terms	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://asx-frontend-staging.corp.google.com/tools/feedback/	chromecache_220.2.dr	false	high
https://support.google.com/	chromecache_220.2.dr	false	high
https://www.google.com	chromecache_257.2.dr, chromecache_233.2.dr, chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://scone-pa.clients6.google.com	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://support.google.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://policies.google.com/terms/location	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://asx-frontend-autopush.corp.google.com/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://support.google.com/accounts?p=new-si-ui	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://feedback2-test.corp.google.com/inapp/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://www.google.com/tools/feedback	chromecache_220.2.dr	false	high
https://youtube.com/t/terms?gl=	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://sandbox.google.com/inapp/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://www.google.com/intl/	chromecache_247.2.dr	false	high
https://apis.google.com/js/api.js	chromecache_206.2.dr, chromecache_154.2.dr	false	high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	chromecache_257.2.dr, chromecache_233.2.dr	false	high
https://feedback2-test.corp.googleusercontent.com/inapp/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://localhost.proxy.googlers.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://policies.google.com/privacy/google-partners	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://www.google.com/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://www.google.cn/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://policies.google.com/privacy/additional	chromecache_247.2.dr	false	high
https://asx-frontend-autopush.corp.google.de/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://www.google.cn/tools/feedback/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://www.google.com/tools/feedback/help_panel_binary.js	chromecache_220.2.dr	false	high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_190.2.dr, chromecache_206.2.dr, chromecache_154.2.dr, chromecache_176.2.dr	false	high
https://asx-frontend-autopush.corp.google.de/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://sandbox.google.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://test-scone-pa-googleapis.sandbox.google.com	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://play.google.com/log?format=json&hasfast=true	chromecache_247.2.dr	false	high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://feedback.googleusercontent.com/resources/render_frame2.html	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://sandbox.google.com/tools/feedback/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://sandbox.google.com/tools/feedback/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://localhost.corp.google.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://support.google.com/accounts?hl=	chromecache_255.2.dr, chromecache_247.2.dr	false	high
https://asx-frontend-autopush.corp.youtube.com/inapp/	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://policies.google.com/privacy	chromecache_247.2.dr	false	high
https://feedback-pa.clients6.google.com	chromecache_220.2.dr	false	high
https://asx-frontend-staging.corp.google.com/inapp/	chromecache_220.2.dr	false	high
https://www.google.com/tools/feedback/%	chromecache_214.2.dr, chromecache_220.2.dr	false	high
https://fonts.google.com/license/googlerestricted	chromecache_249.2.dr, chromecache_157.2.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
142.250.185.206	docs.google.com	United States	15169	GOOGLEUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
199.36.158.100	forms.gle	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.81	csp.withgoogle.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584829
Start date and time:	2025-01-06 15:46:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://forms.gle/XsPfAF5jPgqSvvp87
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@23/237@24/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 6 13:47:26 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9855321899946774
Encrypted:	false
SSDEEP:	48:8Q0dmTCW/H8idAKZdA19ehwiZUklqehTy+3:8Q1/CIy
MD5:	2B6C1F1FAF4A8078AF71AD615684645F
SHA1:	4091AFA30104C25FB77675E87A3C75CAD5F079D6
SHA-256:	A96ACC1F7471108C978B7A00F79A301C7C712770084A95CD154E024A932A5405
SHA-512:	CEFBF29C6836DBBE3D79358C8F9D04FFE7228C7CD60CBCD0E4341E5F8816B0B1D35DFB271E2F2698E7C1E2CA4310B7C05F661A946AEE3BBC8EA44747BA3AC2EC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....K...I`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I&Z.u....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V&Z.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V&Z.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V&Z.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V&Z.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Input	Output
URL: https://forms.gle Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://forms.gle
URL: https://www.gstatic.com/_/freebird/_/js/k=freebird... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a benign script with no clear malicious intent. It initializes a feature toggle system and includes some copyright notices, which are common in legitimate code. There are no high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The script seems to be part of a larger codebase and does not demonstrate any overtly suspicious behavior." }
"use strict";this.default_v=this.default_v\|\|{};(function(_){var window=this; try{ _._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0xc18, ]); /* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / / Copyright 2024 Google, Inc SPDX-License-Identifier: MIT / / SPDX-License-Identifier: Apache-2.0 / / Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / var ia,la,baa,caa,daa,eaa,sa,faa,jaa,maa,oaa,taa,uaa,$a,bb,db,vaa,xaa,yaa,mb,nb,Baa,ob,Caa,Daa,Haa,Jaa,Eaa,Faa,wb,Naa,Oaa,zb,Qaa,Saa,Taa,Uaa,Paa,Db,$aa,aba,bba,cba,dba,eba,Kb,fba,Xaa,gba,Jb,Yaa,Zaa,hba,iba,jba,lba,nba,oba,qba,sba,tba,vba,wba,xba,Xb,yba,Cba,Dba,Fba,Gba,Hba,Iba,Jba,Kba,Eba,Lba,Oba,Qba,Pba,Tba,cc,Vba,Uba,Xba,Yba,aca,hca,ica,jca,tc,kca,lca,mca,qca,tca,nca,sca,rca,pca,oca,uca,vca,xca,yca,xc,yc,Aca,Bca,Cca,zca,Fca,Pc,Nca,Sc,Pca,Tc,Qca,Rca,hd,Wca,Yca,md,qd,cda,nda,oda,pda,qda,Jd,rda,tda, Pd,Cda,Dda,Ida,Uda,Yda,Xda,Zda,$da,aea,cea,eea,fea,gea,mea,nea,sea,yea,zea,Aea,Bea,Pe,Gea,Iea,Jea,Oea,Lea,Sea,Tea,Uea,jf,Vea,Wea,Xea,Zea,$ea,afa,ifa,kfa,lfa,mfa,nfa,ofa,pfa,qfa,sfa,rfa,wf,wfa,xfa,zfa,Kf,Gfa,Ifa,Kfa,Nfa,Sf,Ofa,Uf,Vf,pea,Wf,Yf,Wfa,aga,cga,bga,bg,dga,ega;_.aa=function(a,b){if(Error.captureStackTrace)Error.captureStackTrace(this,_.aa);else{var c=Error().stack;c&&(this.stack=c)}a&&(this.message=String(a));b!==void 0&&(this.cause=b);this.j=!0}; _.ca=function(a){_.ba.setTimeout(function(){throw a;},0)};_.da=function(){var a=_.ba.navigator;return a&&(a=a.userAgent)?a:""};ia=function(a){return _.ea?_.fa?_.fa.brands.some(function(b){return(b=b.brand)&&_.ha(b,a)}):!1:!1};_.ja=function(a){return _.ha(_.da(),a)};_.ka=function(){return _.ea?!!_.fa&&_.fa.brands.length>0:!1};la=function(){return _.ka()?!1:_.ja("Opera")};_.aaa=function(){return _.ka()?!1:_.ja("Trident")\|\|_.ja("MSIE")};baa=function(){return _.ka()?ia("Microsoft Edge"):_.ja("Edg/")}; _.ma=function(){return _.ja("Firefox")\|\|_.ja("FxiOS")};_.pa=function(){return _.ja("Safari")&&!(_.oa()\|\|(_.ka()?0:_.ja("Coast"))\|\|la()\|\|(_.ka()?0:_.ja("Edge"))\|\|baa()\|\|(_.ka()?ia("Opera"):_.ja("OPR"))\|\|_.ma()\|\|_.ja("Silk")\|\|_.ja("Android"))};_.oa=function(){return _.ka()?ia("Chromium"):(_.ja("Chrome")\|\|_.ja("CriOS"))&&!(_.ka()?0:_.ja("Edge"))\|\|_.ja("Silk")};caa=function(){return _.ja("Android")&&!(_.oa()\|\|_.ma()\|\|la()\|\|_.ja("Silk"))}; daa=function(a){var b={};a.forEach(function(c){b[c[0]]=c[1]});return function(c){return b[c.find(function(d){return d in b})]\|\|""}}; eaa=function(a){var b=_.da();if(a==="Internet Explorer"){if(_.aaa())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\\((.*?)\\))?","g");c=[];for(var e;e=d.exec(b);)c.push([e[1],e[2],e[3]\|\|void 0]); b=daa(c);switch(a){case "Opera":if(la())return b(["Version","Opera"]);if(_.ka()?ia("Opera"):_.ja("OPR"))return b(["OPR"]);break;case "Microsoft Edge":if(_.ka()?0:_.ja("Edge"))return b(["Edge"]);if(baa())return b(["Edg"]);break;case "Chromium":if(_.oa())return b(["Chrome","CriOS","HeadlessChrome"])}return a==="Firefox"&&_.ma()\|\|a==="Safari"&&_.pa()\|\|a==="Android Browser"&&caa()\|\|a==="Silk"&&_.ja("Silk")?(b=c[2])&&b[1]\|\|"":""}; _.ra=function(a){if(_.ka()&&a!=="Silk"){var b=_.fa.brands.find(function(c){return c.brand===a});if(!b\|\|!b.version)return NaN;b=b.version.split(".")}else{b=eaa(a);if(b==="")return NaN;b=b.split(".")}return b.length===0?NaN:Number(b[0])};sa=function(){return _.ea?!!_.fa&&!!_.fa.platform:!1};_.ta=function(){return sa()?_.fa.platform==="Android":_.ja("Android")};faa=function(){return _.ja("iPhone")&&!_.ja("iPod")&&!_.ja("iPad")};_.ua
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be related to user authentication and encryption management, which is a sensitive area. While it does not contain any obvious high-risk indicators, it uses some moderately risky behaviors, such as external data transmission and fallback domains. Additionally, the script relies on the Chrome browser's encryption APIs, which could potentially be misused. Overall, the script requires further review to ensure it is implemented securely and does not have any hidden malicious intent." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("iAskyc"); _.SY=function(a){_.Kt.call(this);this.window=a.Fa.window.get();this.yc=a.Fa.yc};_.K(_.SY,_.Ku);_.SY.Ca=function(){return{Fa:{window:_.Tu,yc:_.iF}}};_.SY.prototype.pq=function(){};_.SY.prototype.addEncryptionRecoveryMethod=function(){};_.TY=function(a){return(a==null?void 0:a.eq)\|\|function(){}};_.UY=function(a){return(a==null?void 0:a.n5)\|\|function(){}};_.kWb=function(a){return(a==null?void 0:a.Rq)\|\|function(){}}; _.lWb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.mWb=function(a){setTimeout(function(){throw a;},0)};_.SY.prototype.NQ=function(){return!0};_.VY=function(a,b,c,d){c=c===void 0?"":c;a=a.yc;var e=a.FQ,f=new _.aF;b=_.Vj(f,7,_.vYa,b==null?b:_.Tc(b));e.call(a,305,b,d,void 0,void 0,_.dVb(new _.$E,_.cVb(new _.jY,c)))};_.Ou(_.Co,_.SY); _.l(); _.k("ziXSP"); var nZ=function(a){_.SY.call(this,a.La)};_.K(nZ,_.SY);nZ.Ca=_.SY.Ca;nZ.prototype.pq=function(a,b,c){var d;if((d=this.window.chrome)==null?0:d.setClientEncryptionKeys)_.TY(c)(),this.window.chrome.setClientEncryptionKeys(_.kWb(c),a,b);else{var e;((e=this.window.chrome)==null?0:e.setSyncEncryptionKeys)?(_.TY(c)(),d=YWb(b),b=b.get(_.dZ()),this.window.chrome.setSyncEncryptionKeys(_.kWb(c),a,d,b[b.length-1].epoch)):_.UY(c)()}}; nZ.prototype.addEncryptionRecoveryMethod=function(a,b,c,d,e){if(!(b.length>0)\|\|b.includes(_.dZ())){var f;(f=this.window.chrome)!=null&&f.addTrustedSyncEncryptionRecoveryMethod?(_.TY(e)(),this.window.chrome.addTrustedSyncEncryptionRecoveryMethod(_.kWb(e),a,_.eZ(c),d)):_.UY(e)()}};nZ.prototype.NQ=function(){var a;return!((a=this.window.chrome)==null\|\|!a.setClientEncryptionKeys)};var YWb=function(a){return a.get(_.dZ()).map(function(b){return b.key})};_.Ou(_.eMa,nZ); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application and does not contain any high-risk indicators. It primarily involves setting up and executing various utility functions related to user authentication and caching. While it uses some legacy APIs like `XDomainRequest`, the overall behavior seems to be within the expected range for a legitimate application. The script does not exhibit any clear signs of malicious intent or data exfiltration, and the interactions are with trusted domains. Therefore, the risk score is assessed as low." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("lOO0Vd"); _.a2a=new _.Df(_.hma); _.l(); _.k("ZDZcre"); var T2a=function(){this.Lo=_.Mu(_.RG);this.g6=_.Mu(_.a2a);this.aa=_.Mu(_.QG)};T2a.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Fb(a,function(c){var d=b.g6.getType(c.Xd())===2?b.Lo.Nb(c):b.Lo.fetch(c);return _.om(c,_.SG)?d.then(function(e){return _.Nd(e)}):d},this)};_.Pu(T2a,_.jma); _.l(); _.k("w9hDv"); _.Pg(_.$la);_.MA=function(a){_.Kt.call(this);this.aa=a.Ya.cache};_.K(_.MA,_.Ku);_.MA.Ca=function(){return{Ya:{cache:_.Et}}};_.MA.prototype.execute=function(a){_.Fb(a,function(b){var c;_.of(b)&&(c=b.jb.hc(b.ob));c&&this.aa.cJ(c)},this);return{}};_.Ou(_.fma,_.MA); _.l(); _.k("K5nYTd"); _.$1a=new _.Df(_.gma); _.l(); _.k("sP4Vbe"); _.l(); _.k("kMFpHd"); _.l(); _.k("A7fCU"); var d2a=function(a){_.Kt.call(this);this.aa=a.Fa.jga};_.K(d2a,_.Ku);d2a.Ca=function(){return{Fa:{jga:_.$1a,metadata:_.a2a},preload:{cJ:_.MA}}};d2a.prototype.execute=function(a){a=e2a(this,a);return this.aa.execute(a)}; var e2a=function(a,b){var c={};_.Fb(b,function(d,e){c[e]=d.jb.hc(d.ob);if(d.metadata){if(d.metadata.sideChannel)for(var f=_.n(d.metadata.sideChannel),g=f.next();!g.done;g=f.next())g=g.value,c[e]=_.Vya(c[e],g.extension,g.message);if(d.metadata.kb)for(d=_.n(d.metadata.kb),f=d.next();!f.done;f=d.next())f=f.value,c[e]=_.nm(c[e],f.key,f.value)}},a);return c};_.Ou(_.ima,d2a); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application and does not contain any high-risk indicators. It primarily focuses on performance monitoring and reporting, which is a common and legitimate practice. The code uses standard APIs like `URL` and `performance.memory` to gather and report information about the application's runtime environment. While there are some moderate-risk indicators, such as the use of external data transmission, the overall context suggests this is likely a benign script used for analytics and telemetry purposes." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ var nIa; _.pIa=function(){var a=nIa(_.Le("xwAfE"),function(){return _.Le("UUFaWc")}),b=nIa(_.Le("xnI9P"),function(){return _.Le("u4g7r")}),c,d,e,f;return(f=oIa)!=null?f:oIa=Object.freeze({isEnabled:function(g){return g===-1\|\|_.rf(_.Le("iCzhFc"),!1)?!1:a.enabled\|\|b.enabled},environment:(c=_.il(_.Le("y2FhP")))!=null?c:void 0,TS:(d=_.il(_.Le("MUE6Ne")))!=null?d:void 0,At:(e=_.il(_.Le("cfb2h")))!=null?e:void 0,Yp:_.kl(_.Le("yFnxrf"),-1),n2:_.TFa(_.Le("fPDxwd")).map(function(g){return _.kl(g,0)}).filter(function(g){return g>0}), c7:a,fya:b})};nIa=function(a,b){a=_.rf(a,!1);return{enabled:a,PX:a?_.Nd(_.ll(b(),_.Lz)):qIa()}};_.Lz=function(a){this.Ha=_.u(a)};_.K(_.Lz,_.v);var qIa=function(a){return function(){return _.sd(a)}}(_.Lz);var oIa; _.k("p3hmRc"); var ZIa=function(a){a.Ea=!0;return a},$Ia=function(a,b,c,d){this.transport=a;this.aa=b;this.da=c;this.environment=d;this.fa=Number(Date.now()).toString(36)+Math.random().toString(36).slice(2)};_.fA=function(){_.Kt.call(this);this.config=_.pIa();var a=this.config.Yp;this.config.isEnabled(a)&&(this.aa=aJa(this,a))};_.K(_.fA,_.Ku);_.fA.Ca=_.Ku.Ca;var aJa=function(a,b){var c=_.zBa().map(function(m){return _.Cd(m)}),d,e=ZIa(_.YIa(_.eA((new _.dA(b,_.tk(_.Oe(),3,"0"))).dw(_.Jz(new _.Iz,a.config.n2)),(d=a.config.At)!=null?d:""),c)).build();switch(b){case 2082:var f=2;break;case 1884:f=1}var g;return new $Ia(e,a.config.TS,f,(g=a.config.environment)!=null?g:"")};_.Ou(_.UFa,_.fA); _.l(); var bJa=_.fa.URL,cJa,dJa,fJa,eJa;try{new bJa("http://example.com"),cJa=!0}catch(a){cJa=!1}dJa=cJa; fJa=function(a){var b=_.xl("A");try{_.Ce(b,_.fb(a));var c=b.protocol}catch(e){throw Error("Gd`"+a);}if(c===""\|\|c===":"\|\|c[c.length-1]!=":")throw Error("Gd`"+a);if(!eJa.has(c))throw Error("Gd`"+a);if(!b.hostname)throw Error("Gd`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};eJa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host= b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a}; _.gJa=function(a){if(dJa){try{var b=new bJa(a)}catch(d){throw Error("Gd`"+a);}var c=eJa.get(b.protocol);if(!c)throw Error("Gd`"+a);if(!b.hostname)throw Error("Gd`"+a);b.origin=="null"&&(a={href:b.href,protocol:b.protocol,username:"",password:"",host:b.host,port:b.port,hostname:b.hostname,pathname:b.pathname,search:b.search,hash:b.hash},a.origin=c===b.port?b.protocol+"//"+b.hostname:b.protocol+"//"+b.hostname+":"+b.port,b=a)}else b=fJa(a);return b}; eJa=new Map([["http:","80"],["https:","443"],["ws:","80"],["wss:","443"],["ftp:","21"]]); _.k("LvGhrf"); var iJa=function(a){if(_.fa&&_.fa.performance&&_.fa.performance.memory){var b=_.fa.performance.memory;if(b){var c=new hJa;isNaN(b.jsHeapSizeLimit)\|\|_.Mz(c,1,Math.round(b.jsHeapSizeLimit).toString());isNaN(b.totalJSHeapSize)\|\|_.Mz(c,2,Math.round(b.totalJSHeapSize).toString());isNaN(b.usedJSHeapSize)\|\|_.Mz(c,3,Math.round(b.usedJSHeapSize).toString());_.bk(a,hJa,1,c)}}},lJa=function(a){if(jJa()){var b=performance.getEntriesByType("navigation");if(b&&b.length){var c=new gA;if(b=b[0]){switch(b.type){case "navigate":c.Wb(1); break;case "reload":c.Wb(2);break;case "back_forward":c.Wb(3);break;case "prerender":c.Wb(4);break;default:c.Wb(0)}var d=_.Ek(c,2,Math.round(b.startTime));d=_.Ek(d,3,Math.round(b.fetchStart));d=_.Ek(d,4,Math.round(b.domainLookupStart));d=_.Ek(d,5,Math.round(b.domainLookupEnd));d=_.Ek(d,6,Math.round(b.connectStart));d=_.Ek(d,7,Math.round(b.connectEnd));d=_.Ek(d,8,Math.round(b.requestStart));d=_.Ek(d,9,Math.round(b.responseStart));d=_.Ek(d,10,Math.round(b.responseEnd));var e=kJa(Math.round(b.domInteractive)); d=_.Ek(d,11,e);e=kJa(Math.round(b.domComplete));d=_.Ek(d,12,e);d=_.Ek(d,13,Math.round(b.loadEventStart));_.Ek(d,14,Math.round(b.loadEventEnd))}_.bk(a,gA,8,c)}}},kJa=fu
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script contains a mix of low-risk and moderate-risk indicators. It uses legacy APIs like `XDomainRequest` and performs external data transmission, which could potentially lead to data exfiltration. However, the script appears to have a legitimate purpose related to analytics and error reporting, and it interacts with trusted domains like `google.com`. Further review may be necessary to determine the full extent of the script's behavior and potential risks." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.Pg(_.Pqa); _.k("sOXFj"); var Wu=function(){_.Kt.call(this)};_.K(Wu,_.Ku);Wu.Ca=_.Ku.Ca;Wu.prototype.aa=function(a){return a()};_.Ou(_.Oqa,Wu); _.l(); _.k("oGtAuc"); _.Yya=new _.Df(_.Pqa); _.l(); _.k("q0xTif"); var Tza=function(a){var b=function(d){_.To(d)&&(_.To(d).Mc=null,_.lv(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])};_.wv=function(a,b){a&&_.Ff.hc().register(a,b)};_.xv=function(a){_.kv.call(this,a.La);var b=this,c=a.context.Zga;this.oa=c.Hr;this.kd=this.Pa=this.eb=this.Ba=null;this.Ma=a.Fa.Lc;this.Wa=a.Fa.lpa;a=this.oa.oa.then(function(d){b.Ba=d;d=b.oa.id.Z6(d,b.oa.getParams());b.eb=d.variant});c=c.a2.then(function(d){b.Pa=d});this.Ea=this.Ea.bind(this);this.hj(_.Ni([a,c]))};_.K(_.xv,_.kv);_.xv.Ca=function(){return{context:{Zga:"FVxLkf"},Fa:{Lc:_.Uu,component:_.qv,lpa:_.Yya}}};_.xv.prototype.aa=function(){return""};_.xv.prototype.Da=function(){return!1}; _.xv.prototype.Np=function(){return this.oa};var yv=function(a){var b=_.Fb(a.Pa,a.Ea);b={fb:a.oa.getParams(),Yfa:a.oa.Da,ab:{A6:!1,fb:a.oa.getParams(),Kb:a.oa.id.Ea,BP:a.oa.jJ,Ib:a.aa(),jsdata:_.Gb(a.Ba)},oc:b,Eua:a.eb};Object.assign(b,a.Ba\|\|{});Object.assign(b,a.oa.da);Object.assign(b.ab,a.oa.da);return b};_.xv.prototype.Ea=function(a,b){return Array.isArray(a)?a.length!=1\|\|(b=this.oa.id.getChildren()[b],b&&b.hy)?_.Sf(a,function(c){return yv(c)}):yv(a[0]):yv(a)};_.xv.prototype.fa=function(){return null}; var Uza=function(a){var b=a.da();return function(){var c=_.lb.apply(0,arguments);return a.Wa.aa(function(){return b.apply(null,_.Ph(c))})}},Vza=function(a){var b=a.fa();return b?function(){var c=_.lb.apply(0,arguments);return a.Wa.aa(function(){return b.apply(null,_.Ph(c))})}:b};_.xv.prototype.render=function(){var a=yv(this),b=Uza(this);b=this.Da()?Wza(this,b,a):this.Qa.Bc(b,a);this.fa()&&(a=Xza(this,a),b.appendChild(a));(a=this.oa.id.YU())&&a.length>0&&a.forEach(function(){});this.oa.aa(b);return b}; var Xza=function(a,b){var c=a.dom.aa.aa.createElement("view-header");c.style.display="none";var d=Vza(a);b={fb:a.oa.getParams()};a.Da()?a.Ma.nE(c,d,b):(a=a.Qa.WP(d,b),c.appendChild(a));return c},Wza=function(a,b,c){var d=a.dom.aa.aa.createElement("div");a.Ma.nE(d,b,c);return d.childNodes.length==1?d.firstChild:d};_.xv.prototype.dX=function(a){var b=yv(this),c=Uza(this);Tza(a);this.Ma.Wk(a,c,b);this.Np().aa(a);this.fa()&&(b=Xza(this,b),b=(new _.Cp(b)).Mb(),_.wg(_.zg(a).body,_.Sza,b))};_.wv(_.vv,_.xv); _.l(); _.TC=function(a){var b=_.D,c=_.tk(a.Ed,15);a=_.U("O",c!=null?c:null)(null,a);return b("<title>"+_.qq(a)+"</title>")}; _.T("La","",0,function(){return _.RC()}); _.T("La","",1,function(a){return a.z6?_.RC():""}); _.k("ZZ4WUe"); var fXa=function(a,b){var c=a.fb,d=_.D;a=a.ab;var e=_.D,f=(0,_.D)(""+_.N(_.ksa())),g=(0,_.D)(""+_.Rq({text:"",jsname:"H5iMZd"},b));c={z6:_.ok(c,1,!0)};c=_.U("La")(c,b);return d(_.KE({ab:a,jscontroller:"eVCnO",jsaction:"jiqeKb:UHZ0U;rcuQ6b:WYd",content:e(""+_.LE({title:"Something went wrong",subtitle:f,Xc:g,Hd:c},b))},b))},gXa=function(a,b){return(0,_.D)(_.TC(b))},ME=function(a){_.xv.call(this,a.La)};_.K(ME,_.xv);ME.Ca=_.xv.Ca;ME.prototype.aa=function(){return"ZZ4WUe"};ME.prototype.da=function(){return fXa}; ME.prototype.fa=function(){return gXa};_.wv(_.LFa,ME);_.ev.ZZ4WUe=_.NFa; _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This script exhibits several moderate-risk behaviors, including external data transmission and fallback domains. While it appears to have an analytics or telemetry purpose, the use of legacy APIs and potential for inconsistent behavior requires further review." } The script has the following behaviors: 1. External Data Transmission (+2 points): The script sends user data to the `analytics.example.com` domain via XHR or fetch requests. 2. Legacy Practices (+1 point): The script uses the outdated `XDomainRequest` API, which poses minor risks but is not inherently malicious. 3. Fallback Domains (+2 points): The script uses multiple fallback domains, some of which may be of unknown or dubious reputation. The script's intent appears to be related to analytics or telemetry, which would warrant a subtraction of 2 points. However, the use of legacy APIs and potential for inconsistent behavior (e.g., interacting with unknown domains) raises concerns and requires further review. Therefore, the final risk score is 6, indicating a medium-risk script that should be examined more closely.
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("P6sQOc"); var g2a=!!(_.ii[0]>>28&1);var i2a=function(a,b,c,d,e){this.fa=a;this.Ba=b;this.oa=c;this.Da=d;this.Ea=e;this.aa=0;this.da=h2a(this)},j2a=function(a){var b={};_.Pa(a.ZU(),function(e){b[e]=!0});var c=a.KU(),d=a.SU();return new i2a(a.RR(),c.aa()1E3,a.oU(),d.aa()1E3,b)},h2a=function(a){return Math.random()Math.min(a.BaMath.pow(a.oa,a.aa),a.Da)},k2a=function(a,b){return a.aa>=a.fa?!1:b!=null?!!a.Ea[b]:!0};var l2a=function(){this.da=_.Mu(_.c2a);this.fa=_.Mu(_.a2a);var a=_.Mu(_.Q1a);this.fetch=a.fetch.bind(a)};l2a.prototype.aa=function(a,b){if(this.fa.getType(a.Xd())!==1)return _.Mn(a);var c=this.da.fX;return(c=c?j2a(c):null)&&k2a(c)?_.Wya(a,m2a(this,a,b,c)):_.Mn(a)}; var m2a=function(a,b,c,d){return c.then(function(e){return e},function(e){if(g2a)if(e instanceof _.yf){if(!e.status\|\|!k2a(d,e.status.xc()))throw e;}else{if("function"==typeof _.Ks&&e instanceof _.Ks&&e.da!==103&&e.da!==7)throw e;}else if(!e.status\|\|!k2a(d,e.status.xc()))throw e;return _.sf(d.da).then(function(){if(!k2a(d))throw Error("ke`"+d.fa);++d.aa;d.da=h2a(d);b=_.nm(b,_.Mka,d.aa);return m2a(a,b,a.fetch(b),d)})})};_.Pu(l2a,_.f2a); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a user interface component for handling sign-in functionality. While it contains some potentially risky behaviors, such as dynamic DOM manipulation and the use of legacy APIs, the overall intent seems to be legitimate and not malicious. The script is likely part of a larger application and requires further context to make a more accurate assessment." } The risk score of 3 is assigned based on the following analysis: 1. High-Risk Indicators (3 points each): - No indicators of high-risk behavior. 2. Moderate-Risk Indicators (2 points each): - External Data Transmission: The script appears to be sending user data to external domains, which could pose a risk if not properly handled. This adds 2 points. - Aggressive DOM Manipulation: The script is repeatedly altering the DOM, which could be a sign of aggressive or potentially problematic behavior. This adds 2 points. 3. Low-Risk Indicators (1 point each): - Legacy Practices: The script is using the `XDomainRequest` API, which is a legacy practice and poses a minor risk. This adds 1 point. Contextual Adjustments: - Trusted Domains: The script is likely interacting with known, reputable domains, which reduces the risk score by 1 point. - Analytics/Telemetry: The script's intent appears to be related to user interface and sign-in functionality, which is a common and legitimate use case. This reduces the risk score by 2 points. Final Scoring: The final risk score is 3, as the script demonstrates some potentially risky behaviors but is likely part of a larger, legitimate application. Further review and context may be necessary to make a more accurate assessment.
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.iOa=_.z("wg1P6b",[_.yB,_.Eo,_.Lo]); _.k("wg1P6b"); var Y9a;Y9a=_.Rh(["aria-"]); _.MI=function(a){_.W.call(this,a.La);this.Ma=this.Ba=this.aa=this.viewportElement=this.Pa=null;this.Yc=a.Fa.Hf;this.eb=a.Fa.focus;this.Lc=a.Fa.Lc;this.fa=this.Lj();a=-1*parseInt(_.xp(this.Lj().el(),"marginTop")\|\|"0",10);var b=parseInt(_.xp(this.Lj().el(),"marginBottom")\|\|"0",10);this.Wa={top:a,right:0,bottom:b,left:0};a=_.rf(this.getData("isMenuDynamic"),!1);b=_.rf(this.getData("isMenuHoisted"),!1);this.Ea=a?1:b?2:0;this.oa=!1;this.Da=1;this.Ea!==1&&(this.aa=this.Sa("U0exHf").children().Sc(0),this.hj(Z9a(this, this.aa.el())));_.KF(this.Aa())&&(a=this.Aa().el(),b=this.Ne.bind(this),a.__soy_skip_handler=b)};_.K(_.MI,_.W);_.MI.Ca=function(){return{Fa:{Hf:_.zF,focus:_.oF,Lc:_.Uu}}};_.MI.prototype.iA=function(a){var b=a.source;this.Pa=b;var c;((c=a.data)==null?0:c.mB)?(a=a.data.mB,this.Da=a==="MOUSE"\|\|a==="TOUCH"?1:2):this.Da=b.Ea\|\|b.Wa?1:2;$9a(this)};_.MI.prototype.Mj=function(a){a=a.event;var b=a.keyCode;b===40?this.Da=2:b===38&&(this.Da=3);return b===40\|\|b===38?(a.preventDefault(),$9a(this),!1):!0}; var $9a=function(a){_.di(function(b){a.aa?(a.av().Ba=a.Da,a.Mi()):a.trigger(_.t9a);_.Vh(b)})};_.MI.prototype.Mi=function(){a$a(this);this.da.Uf()?this.da.close():(this.Ea===2&&(b$a(this,this.aa.el()),c$a(this)),this.da.open())};_.MI.prototype.qA=function(a){if(a.source!==this.da)return!0;this.Pa&&this.Pa.Kl?_.DF(this.Yc,this.fa,{Kl:this.Pa.Kl()}):_.DF(this.Yc,this.fa);return!0};_.MI.prototype.pA=function(){d$a(this);return!0}; var d$a=function(a){_.di(function(b){if(a.vj())return b.return();a.Fe().activeElement!==a.fa.el()&&_.EF(a.Yc,a.fa);a.oa&&(a.Aa().el().removeAttribute("aria-owns"),a.Ma&&_.wZa(a.Ma,a.fa));a.Ea===1&&e$a(a);a.Ea===2&&(f$a(a,a.aa.el()),c$a(a),g$a(a));_.Vh(b)})};_.h=_.MI.prototype;_.h.Wv=function(){return!0};_.h.vj=function(){var a,b;return(b=(a=this.da)==null?void 0:a.Uf())!=null?b:!1};_.h.Zu=function(){if(!(this.da instanceof _.HI))throw Error("Fe");return this.da};_.h.av=function(){a$a(this);return this.da}; _.h.Yu=function(){return this.Sa("WjL7X").children().Sc(0)};_.h.Lj=function(){return this.fa?this.fa:h$a(this)};_.h.dispose=function(){_.W.prototype.dispose.call(this);this.oa&&e$a(this)}; var h$a=function(a){a=a.Yu();_.rf(a.getData("isTooltipWrapper"),!1)&&(a=a.children().Sc(0));_.rf(a.getData("isTouchWrapper"),!1)&&(a=a.children().Sc(0));return a},b$a=function(a,b){a.Ba=new _.Cp(document.createElement("div"));b.getAttribute("id")\|\|b.setAttribute("id",_.dg((new _.Cp(b)).Xr("menuUid")));a.Aa().el().setAttribute("aria-owns",b.getAttribute("id"));a.Ba.append(b);var c=_.zg(a.Aa().el()).body;_.GI(c)?_.s9a(c,a.Ba.el()):c.appendChild(a.Ba.el());a.Ms(b,a.Sa("U0exHf"));a.oa=!0;a.aa=_.Ju(b)}, f$a=function(a,b){a.Sa("U0exHf").empty().append(b);a.oa=!1;a.aa=_.Ju(b)};_.MI.prototype.Ua=function(a){var b=b===void 0?{}:b;this.aa&&e$a(this);b.Vka?b$a(this,a):f$a(this,a);b.viewportElement&&(this.viewportElement=b.viewportElement);Z9a(this,a)}; var Z9a=function(a,b){return _.Ti(a.Yg(b),function(c){a.da=c;c$a(a);return a.da})},c$a=function(a){a.av().Ba=a.Da;var b=a.da;b.oa=a.fa;if(!a.oa&&!b.As()){var c=a.Wa;b.aa.top=c.top\|\|0;b.aa.right=c.right\|\|0;b.aa.bottom=c.bottom\|\|0;b.aa.left=c.left\|\|0}b.Ua=a.oa;a.viewportElement&&(b.viewportElement=a.viewportElement);a.oa&&(a.Ma=b instanceof _.HI?b.ah().Aa():b.Aa(),_.vZa(a.eb,a.Ma,a.fa))},e$a=function(a){a.aa&&(a.aa.remove(),a.HC(),a.aa=null,g$a(a))},g$a=function(a){a.Ba&&(a.Ba.remove(),a.HC(),a.Ba= null)},a$a=function(a){if(!a.da)throw a=a.Aa().xb("jsname"),Error(a?"MenuButtonController: MenuSurfaceController not found (jsname="+a+").":"MenuButtonController: MenuSurfaceController not found.");};_.MI.prototype.Ne=function(a,b){i$a(this,b);return!0}; var i$a=function(a,b){_.di(function(c){var d=a.Yu().el();if(!d)throw Error("Ge");a.Lc.Wk(d,b.getContent());a.fa=h$a(a);if(a.Ea!==1&&b.data.menu){if(!a.aa)th
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script exhibits a mix of behaviors that require further review. While it appears to have some legitimate functionality related to user authentication and analytics, it also demonstrates concerning practices such as data exfiltration and potential redirects to unknown domains. The use of obfuscated code and legacy APIs adds to the overall risk. Additional context and transparency would be needed to fully assess the script's intent and impact." } The script exhibits the following behaviors: 1. Moderate-Risk Indicators (2 points each): - External Data Transmission: The script sends user data to third-party domains via `XHR` or `fetch` without clear transparency. - Fallback Domains: The script uses multiple fallback domains, some of which may be untrusted. 2. Low-Risk Indicators (1 point each): - Legacy Practices: The script uses the outdated `XDomainRequest` API, which poses minor risks but is not inherently malicious. - Tracking Behavior: The script appears to have some analytics or tracking functionality, which is not necessarily malicious but requires further review. 3. Contextual Adjustments: - Suspicious Domains: The script interacts with domains of unknown or dubious reputation, which adds 1-2 points to the risk score. - Behavioral Inconsistency: The script's behavior is not entirely consistent with its apparent purpose of user authentication, adding 1-2 points to the risk score. The final risk score is 6, indicating a medium-risk script that requires further review and analysis to determine its true intent and potential impact. While the script may have some legitimate functionality, the presence of concerning practices and lack of full transparency warrant a closer examination.
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("Wt6vjf"); var Aya=function(){var a=_.Oe();return _.tk(a,1)},Bu=function(a){this.Ha=_.u(a,0,Bu.messageId)};_.K(Bu,_.v);Bu.prototype.Ga=function(){return _.gk(this,1)};Bu.prototype.Ta=function(a){return _.Dk(this,1,a)};Bu.messageId="f.bo";var Cu=function(){_.ln.call(this)};_.K(Cu,_.ln);Cu.prototype.Id=function(){this.NV=!1;Bya(this);_.ln.prototype.Id.call(this)};Cu.prototype.aa=function(){Cya(this);if(this.cF)return Dya(this),!1;if(!this.VX)return Du(this),!0;this.dispatchEvent("p");if(!this.cS)return Du(this),!0;this.rP?(this.dispatchEvent("r"),Du(this)):Dya(this);return!1}; var Eya=function(a){var b=new _.fg(a.a7);a.aT!=null&&_.ig(b,"authuser",a.aT);return b},Dya=function(a){a.cF=!0;var b=Eya(a),c="rt=r&f_uid="+_.bl(a.cS);_.Tn(b,(0,_.Ng)(a.fa,a),"POST",c)}; Cu.prototype.fa=function(a){a=a.target;Cya(this);if(_.Wn(a)){this.RM=0;if(this.rP)this.cF=!1,this.dispatchEvent("r");else if(this.VX)this.dispatchEvent("s");else{try{var b=_.Xn(a),c=JSON.parse(b.substring(b.indexOf("\n")));var d=(new Bu(c[0])).Ga()}catch(e){_.Vf(e);this.dispatchEvent("t");Fya(this);return}this.cF=!1;d?this.dispatchEvent("q"):this.dispatchEvent("r")}Du(this)}else{if(a.getStatus()!=0){d="";try{d=_.Xn(a)}catch(e){}a=Error("kd`"+a.getStatus()+"`"+Eya(this).toString()+"`"+String(a.XD)+ "`"+d);_.Vf(a);this.dispatchEvent("t")}Fya(this)}};var Cya=function(a){var b=_.Au.get(window.location.protocol=="https:"?"SAPISID":"APISID","");a.rP=a.LM!==""&&b==="";a.VX=a.LM!=b;a.LM=b},Fya=function(a){a.rP\|\|(a.cF=!0,a.RM=Math.min((a.RM\|\|3)2,60),Du(a))},Du=function(a){if(a.NV\|\|a.cF)Bya(a),a.zQ=window.setTimeout((0,_.Ng)(a.aa,a),Math.max(3,a.RM)1E3)},Bya=function(a){a.zQ&&(window.clearTimeout(a.zQ),a.zQ=0)};_.h=Cu.prototype;_.h.kd=null;_.h.RM=0;_.h.zQ=0;_.h.LM=null;_.h.rP=!1;_.h.VX=!1;_.h.aT=null; _.h.a7="/_/idv/";_.h.cS="";_.h.NV=!1;_.h.cF=!1;_.Se(_.yma,Cu);_.Cb().hl(function(a){var b=new Cu;_.Np(a,_.yma,b);if(Aya()){a=Aya();var c=_.Le("WZsZ1e").string(null);b.cS=a;c!==void 0&&(b.LM=c);a=_.ml();a.lastIndexOf("/",0)==0\|\|(a="/"+a);b.a7=a+"/idv/";(a=_.tk(_.Oe(),3,"0"))&&_.Le("gGcLoe").bool(!1)&&(b.aT=a);b.NV=!0;b.aa()}}); _.l(); _.k("hhhU8"); var WKa;new _.Li(function(a){WKa=a});_.YFa();_.Af(function(){WKa()}); _.l(); _.k("FCpbqb"); _.Cb().hl(function(a){_.Of(_.bqa,a)}); _.l(); _.k("WhJNk"); var wKa=new Date(1262304E6),xKa=new Date(12779424E5),yKa=new Date(129384E7),zKa=function(a,b){b?a.push(Math.round((b-wKa.getTime())/6E4)):a.push(null)},AKa=function(a,b,c){a.push(b.getTimezoneOffset()/15+56);a:{var d=b.getTimezoneOffset();var e=c.getTimezoneOffset();if(d!=e)for(b=b.getTime()/6E4,c=c.getTime()/6E4;b<=c;){var f=(b>>1)+(c>>1),g=f*6E4,m=(new Date(g+3E4)).getTimezoneOffset();if((new Date(g-3E4)).getTimezoneOffset()!=m){d=g;break a}if(m==d)b=f+1;else if(m==e)c=f-1;else break}d=null}zKa(a, d)};var BKa=function(a){_.Kt.call(this);this.aa=a.Fa.window;var b=b===void 0?!1:b;if(!_.rf(_.Le("xn5OId"),!1)&&_.Au.isEnabled()&&(_.Au.get("OTZ")===void 0\|\|b)){a=_.Au.set;b=[];var c=new Date;zKa(b,c.getTime());b.push(c.getTimezoneOffset()/15+56);AKa(b,wKa,xKa);AKa(b,xKa,yKa);b=b.join("_");a.call(_.Au,"OTZ",b,{maxAge:2592E3,path:"/",domain:void 0,secure:this.aa.get().location.protocol==="https:"})}};_.K(BKa,_.Ku);BKa.Ca=function(){return{Fa:{window:_.Tu}}};_.Ou(_.bqa,BKa); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	```json { "risk_score": 3, "reasoning": "The script contains obfuscated code and URLs, which is a high-risk indicator. However, there are no clear signs of malicious intent such as data exfiltration or dynamic code execution. The script appears to be related to some form of image loading and event handling, possibly for analytics or telemetry, but the obfuscation raises concerns." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ var Fua=function(a,b){this.da=a;this.fa=b;if(!c){var c=new _.fg("//www.google.com/images/cleardot.gif");_.Sm(c)}this.oa=c};_.h=Fua.prototype;_.h.kd=null;_.h.m0=1E4;_.h.iC=!1;_.h.XS=0;_.h.hM=null;_.h.eX=null;_.h.setTimeout=function(a){this.m0=a};_.h.start=function(){if(this.iC)throw Error("sc");this.iC=!0;this.XS=0;Gua(this)};_.h.stop=function(){Hua(this);this.iC=!1}; var Gua=function(a){a.XS++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.on((0,_.Ng)(a.rJ,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.Ng)(a.uma,a),a.aa.onerror=(0,_.Ng)(a.tma,a),a.aa.onabort=(0,_.Ng)(a.sma,a),a.hM=_.on(a.vma,a.m0,a),a.aa.src=String(a.oa))};_.h=Fua.prototype;_.h.uma=function(){this.rJ(!0)};_.h.tma=function(){this.rJ(!1)};_.h.sma=function(){this.rJ(!1)};_.h.vma=function(){this.rJ(!1)}; _.h.rJ=function(a){Hua(this);a?(this.iC=!1,this.da.call(this.fa,!0)):this.XS<=0?Gua(this):(this.iC=!1,this.da.call(this.fa,!1))};var Hua=function(a){a.aa&&(a.aa.onload=null,a.aa.onerror=null,a.aa.onabort=null,a.aa=null);a.hM&&(_.pn(a.hM),a.hM=null);a.eX&&(_.pn(a.eX),a.eX=null)};var Iua=function(){_.ln.call(this);this.aa=new Fua(this.yma,this);this.fa=51E3+Math.round(18E3*Math.random())};_.K(Iua,_.ln);_.h=Iua.prototype;_.h.yma=function(a){this.gW=Date.now();this.o5(a)};_.h.o5=function(a){this.Z4=a;this.dispatchEvent("g")};_.h.kd=null;_.h.gW=0;_.h.Z4=!0;var Jua=function(){this.aa=new Iua};_.Se(_.Hn,Jua);_.Cb().hl(function(a){var b=new Jua(a);_.Np(a,_.Hn,b)}); _.k("byfTOb"); _.l(); _.k("lsjVmc"); var qs=function(a,b){b=b===void 0?!0:b;_.oi.call(this);this.Ba=a;this.da=new _.ps(this);b&&_.Kua(this);_.Jg(this,this.da)};_.rs=function(a){this.Ha=_.u(a,0,_.rs.messageId)};_.K(_.rs,_.v);_.rs.prototype.ty=_.ba(41);_.rs.messageId="xsrf";_.Lua=new _.Zk(48448350,_.rs);_.ni(qs,_.oi);qs.prototype.aa=null;qs.prototype.fa="at";qs.prototype.oa=null;_.Kua=function(a){var b=a.Ba.get(_.Zl);b.Ba.includes(a.da);b.oa(a.da)};qs.prototype.configure=function(a,b,c){this.aa=a;this.oa=b;c&&(this.fa=c)};_.ps=function(a){this.fa=a};_.ni(_.ps,_.Tf);_.ps.prototype.aa=_.ba(15);_.ps.prototype.da=_.ba(18);_.Se(_.In,qs);_.Cb().hl(function(a){var b=new qs(a,!1);_.Np(a,_.In,b);b.configure(_.Le("SNlM0e").string(null),_.Le("S06Grb").string(null))}); _.l(); _.nf.prototype.bO=_.ca(6,function(){return this.ex});_.ss=function(a){var b=a.Xd().bO();if(b==null\|\|b<0)return null;var c=_.Il[b];if(c){var d=Object.values(c)[0],e=_.om(a,_.em);c=_.om(a,_.Gka);var f=_.om(a,_.fm),g=_.om(a,_.gm),m=_.om(a,_.Hka);b=_.Hl[b];a={En:d,Hs:b?Object.values(b)[0]:void 0,request:a.ji(),lD:!!e};f&&(a.H1=f);g&&(a.I1=g);c&&(a.cB=c);m&&(a.eP=m);return a}return(c=_.Jl[b])?(c=Object.values(c)[0],b=_.Kl[b],{En:b?Object.values(b)[0]:void 0,hB:c,wW:a.ji()}):null}; _.Mua=function(a){return _.Fc(function(b){return b instanceof a&&!_.nc(b.Ha)})};_.Nua=function(a,b){a.sort(b\|\|_.Na)};_.ts=function(a,b){b in a&&delete a[b]};_.us=function(a,b){return a!==null&&b in a?a[b]:void 0};_.Rn.prototype.vD=_.ca(21,function(){for(var a={},b=this.getAllResponseHeaders().split("\r\n"),c=0;c<b.length;c++)if(!_.hj(b[c])){var d=_.lka(b[c],":",1),e=d[0];d=d[1];if(typeof d==="string"){d=d.trim();var f=a[e]\|\|[];a[e]=f;f.push(d)}}return _.Fb(a,function(g){return g.join(", ")})}); _.Pn.prototype.Om=_.ca(20,function(){return _.tk(this,3)});_.Oua=function(a,b){return _.xe(a,2,b)};_.Pua=function(a){var b=a.type;if(typeof b==="string")switch(b.toLowerCase()){case "checkbox":case "radio":return a.checked?a.value:null;case "select-one":return b=a.selectedIndex,b>=0?a.options[b].value:null;case "select-multiple":b=[];for(var c,d=0;c=a.options[d];d++)c.selected&&b.push(c.value);return b.length?b:null}return a.value!=null?a.value:null}; _.vs=function(a){_.oi.call(this);this.pb=a;this.oa={}};_.ni(_.vs,_.oi);var Qua=[];_.vs.prototype.listen=function(a,b,c,d){Array.isArray(b)\|\|(b&&(Qua[0]=b.toString()),b=Qua);for(var e=0;e<b.length;e++){var f=_.en(a,b[e],c\|\|this.ha
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be part of a legitimate library, likely related to Google's Closure Library, as indicated by the copyright notices. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The presence of obfuscated variable names is typical for minified code and not inherently malicious. No interactions with external domains or suspicious behaviors are observed." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x24cc1989, 0x1be1, 0x1a70ff1, 0x91406f4, 0x3210, 0x0, 0x36000000, 0x32000000, 0x61, ]); /* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / / Copyright 2024 Google, Inc SPDX-License-Identifier: MIT / / SPDX-License-Identifier: Apache-2.0 / / Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var baa,daa,Qa,Ua,gaa,iaa,jb,saa,zaa,Ab,Laa,Naa,Qaa,Mb,Raa,Sb,Ub,Vb,Saa,Taa,Xb,Uaa,Vaa,Waa,ac,aba,cba,ic,jc,kc,gba,iba,jba,nba,pba,rba,sba,wba,zba,tba,yba,xba,vba,uba,Aba,Bba,Cba,Jba,Mba,Oba,Pba,Lba,Rba,Oc,Tba,Zba,$ba,aca,bca,cca,dca,Xba,Yba,fca,hca,kca,lca,mca,nca,oca,rca,tca,sca,vca,Ed,Dd,xca,wca,Aca,zca,Cca,Eca,Fca,Hca,Ld,Ica,Jca,Kca,Qd,Qca,Rca,ce,Sca,Pd,Sd,Xca,ne,bda,Wca,cda,eda,fda,ida,lda,mda,nda,qda,Ida,Oda,Pe,Qda,Qe,Rda,Wda,gea,iea,jea,kea,mea,qea,rea,sea,tea,wea,yea,Eea,Iea,Jea,Kea,Oea,Xea, Tea,$ea,Zea,gg,cfa,jg,efa,ffa,gfa,lfa,qfa,ofa,ufa,vfa,wfa,yfa,zfa,Afa,Dfa,Efa,Kfa,Mfa,Nfa,Ofa,Pfa,Qfa,Rfa,Sfa,Ufa,Vfa,Xfa,aga,bga,dga,bh,ch,iga,kga,lga,mga,nga,pga,dh,rga,sga,fh,tga,uga,vga,yga,zga,Aga,Dga,Ega,Fga,Hga,Lga,Pga,aaa,Uga,Kh,Vga,Mh,Wga,Xga,Yga,Qh,Sh,cha,hha,gha,ci,jha;_.ba=function(a){return function(){return aaa[a].apply(this,arguments)}};_.ca=function(a,b){return aaa[a]=b};_.ha=function(a){_.fa.setTimeout(function(){throw a;},0)};_.ja=function(a){a&&typeof a.dispose=="function"&&a.dispose()}; baa=function(a){for(var b=0,c=arguments.length;b<c;++b){var d=arguments[b];_.ka(d)?baa.apply(null,d):_.ja(d)}};_.la=function(a,b){if(Error.captureStackTrace)Error.captureStackTrace(this,_.la);else{var c=Error().stack;c&&(this.stack=c)}a&&(this.message=String(a));b!==void 0&&(this.cause=b);this.aa=!0};_.ma=function(a){return a[a.length-1]};_.na=function(a,b,c){for(var d=typeof a==="string"?a.split(""):a,e=a.length-1;e>=0;--e)e in d&&b.call(c,d[e],e,a)}; _.pa=function(a,b,c){b=_.oa(a,b,c);return b<0?null:typeof a==="string"?a.charAt(b):a[b]};_.oa=function(a,b,c){for(var d=a.length,e=typeof a==="string"?a.split(""):a,f=0;f<d;f++)if(f in e&&b.call(c,e[f],f,a))return f;return-1};_.ra=function(a,b){return(0,_.qa)(a,b)>=0};_.sa=function(a){if(!Array.isArray(a))for(var b=a.length-1;b>=0;b--)delete a[b];a.length=0};_.ua=function(a,b){_.ra(a,b)\|\|a.push(b)};_.Ba=function(a,b){b=(0,_.qa)(a,b);var c;(c=b>=0)&&_.wa(a,b);return c}; _.wa=function(a,b){return Array.prototype.splice.call(a,b,1).length==1};_.Ca=function(a){return Array.prototype.concat.apply([],arguments)};_.Da=function(a){var b=a.length;if(b>0){for(var c=Array(b),d=0;d<b;d++)c[d]=a[d];return c}return[]};_.Ea=function(a,b){for(var c=1;c<arguments.length;c++){var d=arguments[c];if(_.ka(d)){var e=a.length\|\|0,f=d.length\|\|0;a.length=e+f;for(var g=0;g<f;g++)a[e+g]=d[g]}else a.push(d)}}; _.caa=function(a,b,c){return arguments.length<=2?Array.prototype.slice.call(a,b):Array.prototype.slice.call(a,b,c)};_.Ka=function(a,b){b=b\|\|a;for(var c=0,d=0,e={};d<a.length;){var f=a[d++],g=_.Ha(f)?"o"+_.Ja(f):(typeof f).charAt(0)+f;Object.prototype.hasOwnProperty.call(e,g)\|\|(e[g]=!0,b[c++]=f)}b.length=c};_.La=function(a,b){if(!_.ka(a)\|\|!_.ka(b)\|\|a.length!=b.length)return!1;for(var c=a.length,d=daa,e=0;e<c;e++)if(!d(a[e],b[e]))return!1;return!0};_.Na=function(a,b){return a>b?1:a<b?-1:0}; daa=function(a,b){return a===b};_.eaa=function(a,b){var c={};(0,_.Pa)(a,function(d,e){c[b.call(void 0,d,e,a)]=d});return c};Qa=function(a){return a.toString().indexOf("`")===-1};_.Ta=function(a){return new _.Ra(_.Sa,a[0].toLowerCase())};Ua=function(a){return{valueOf:a}.valueOf()};gaa=function(){var a=null;if(!faa)return a;try{var b=function(c){return c};a=faa.createPolicy("AccountsSignInUi#html",{createHTML:b,createScript:b,createS
URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "OFFICE 365 AUTHENTICATION", "prominent_button_name": "unknown", "text_input_field_labels": [ "FULL NAME", "SCHOOL EMAIL", "P...ASS.....COD.......E", "RECONFIRM P...ASS.....COD.......E", "PHONE NUMEBER" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	{ "brands": [ "Office 365" ] }
	{ "brands": [ "Office 365" ] }
URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or phone" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	```json{ "legit_domain": "office.com", "classification": "wellknown", "reasons": [ "The URL 'docs.google.com' is associated with Google, not Office 365.", "Office 365 is a well-known brand associated with Microsoft, typically using domains like 'office.com' or 'microsoft.com'.", "The URL does not match the legitimate domain name associated with Office 365.", "The presence of input fields requesting sensitive information such as passwords and phone numbers is suspicious.", "The URL 'docs.google.com' is a legitimate Google domain, but it is not related to Office 365 services." ], "riskscore": 9} Google indexed: True
URL: docs.google.com Brands: Office 365 Input Fields: FULL NAME, SCHOOL EMAIL, P...ASS.....COD.......E, RECONFIRM P...ASS.....COD.......E, PHONE NUMEBER
URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }
URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or phone" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }
URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or phone" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP9-KCEk51jVdMaQemAldAjXCtHyicIFeJzYjKagB_m3Ra-p3NAZrHwpS9Sl5-Hi7Nw4H8UFV Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 15:47:24.814105988 CET	53	59899	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:24.883882046 CET	53	55803	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:25.932543993 CET	53	54604	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:29.381347895 CET	53048	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:29.381494999 CET	63149	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:29.388223886 CET	53	63149	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:29.388525963 CET	53	53048	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:29.871012926 CET	61427	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:29.871222019 CET	62407	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:29.877968073 CET	53	61427	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:29.878704071 CET	53	62407	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:30.559036016 CET	61901	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:30.559201956 CET	52418	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:30.565953970 CET	53	61901	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:30.565979958 CET	53	52418	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:31.911851883 CET	53	59827	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:31.913800955 CET	53	60739	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:33.764617920 CET	53	49347	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:34.000314951 CET	53	52516	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:34.079214096 CET	53	50843	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:35.251235008 CET	53	52169	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:35.569394112 CET	50422	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:35.569557905 CET	61024	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:35.575998068 CET	53	50422	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:35.576775074 CET	53	61024	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:37.450339079 CET	55881	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:37.450498104 CET	60318	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:37.457192898 CET	53	55881	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:37.457391024 CET	53	60318	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:37.511797905 CET	61381	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:37.511975050 CET	61119	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:37.518446922 CET	53	61381	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:37.518551111 CET	53	61119	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:42.978746891 CET	53	61237	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:59.369241953 CET	57054	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:59.369551897 CET	59758	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:47:59.375921011 CET	53	57054	1.1.1.1	192.168.2.5
Jan 6, 2025 15:47:59.376105070 CET	53	59758	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:01.748394012 CET	53	57589	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:17.121736050 CET	62618	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:17.121896982 CET	57181	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:17.128648996 CET	53	62618	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:17.130286932 CET	53	57181	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:19.139780045 CET	53	62707	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:22.219758034 CET	55346	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:22.220031977 CET	54433	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:22.226593018 CET	53	55346	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:22.226953030 CET	53	54433	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:24.230900049 CET	53	56772	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:24.638442993 CET	53	57773	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:27.877863884 CET	53	59230	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:36.052108049 CET	64356	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:36.052268982 CET	64493	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:36.058641911 CET	53	64356	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:36.058981895 CET	53	64493	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:36.460942030 CET	51791	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:36.461102962 CET	52626	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:36.469285965 CET	53	51791	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:36.469701052 CET	53	52626	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:37.875277996 CET	63989	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:37.875503063 CET	50734	53	192.168.2.5	1.1.1.1
Jan 6, 2025 15:48:37.882061958 CET	53	63989	1.1.1.1	192.168.2.5
Jan 6, 2025 15:48:37.882143021 CET	53	50734	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:30 UTC	669	OUT	GET /XsPfAF5jPgqSvvp87 HTTP/1.1 Host: forms.gle Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:47:30 UTC	1207	IN	HTTP/1.1 302 Found Connection: close Content-Length: 0 Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cache-Control: no-cache, no-store, max-age=0, must-revalidate Content-Security-Policy: script-src 'report-sample' 'nonce-QMxBUD37uRwLOHcUPxo0ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport/allowlist,require-trusted-types-for 'script';report-uri /_/DurableDeepLinkUi/cspreport Content-Type: application/binary Cross-Origin-Opener-Policy: unsafe-none Cross-Origin-Resource-Policy: same-site Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form
2025-01-06 14:47:30 UTC	550	IN	Data Raw: 50 65 72 6d 69 73 73 69 6f 6e 73 2d 50 6f 6c 69 63 79 3a 20 63 68 2d 75 61 2d 61 72 63 68 3d 2a 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 2a 2c 20 63 68 2d 75 61 2d 66 75 6c 6c 2d 76 65 72 73 69 6f 6e 3d 2a 2c 20 63 68 2d 75 61 2d 66 75 6c 6c 2d 76 65 72 73 69 6f 6e 2d 6c 69 73 74 3d 2a 2c 20 63 68 2d 75 61 2d 6d 6f 64 65 6c 3d 2a 2c 20 63 68 2d 75 61 2d 77 6f 77 36 34 3d 2a 2c 20 63 68 2d 75 61 2d 66 6f 72 6d 2d 66 61 63 74 6f 72 73 3d 2a 2c 20 63 68 2d 75 61 2d 70 6c 61 74 66 6f 72 6d 3d 2a 2c 20 63 68 2d 75 61 2d 70 6c 61 74 66 6f 72 6d 2d 76 65 72 73 69 6f 6e 3d 2a 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 30 36 20 4a 61 6e 20 32 Data Ascii: Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Pragma: no-cacheAccept-Ranges: bytesDate: Mon, 06 Jan 2

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:31 UTC	747	OUT	GET /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form HTTP/1.1 Host: docs.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:47:31 UTC	3627	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:47:31 GMT Content-Security-Policy-Report-Only: report-uri https://csp.withgoogle.com/csp/forms/prod;frame-ancestors 'none' P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-gsxafuvwvdRlYYukRiyE6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Reporting-Endpoints: default="/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/web-reports?bl=apps-forms.freebird_20241203.02_p0&clss=1&context=eJwNxn9M1GUcB_DH5_t8HhE4hKNwpaNB5AomweHKhFA87kJmQho8bOkE45iUCCKDNFO0HzoSZRqCNrrjpyfcOVKZmbEsB4Vl00xDrJY_QDkOCeLkxxbX-4_X9vIt9_Uwxaw-ijn9FJvQKdYYqFioXrGuEMUWzVNsx3OKRS1S7HC0YoWLFdu3QrFa-D1HsQcwJ1exp2C8QDGxRbFdJYodhLwdipVCb7liD2FJpWIpcKtKsUHIqFbMAjO1igUcUyysW7FYcI0rNg2lHsU-gfb5WewivBaaxRQ8fmGIz0DiplFuBuelUd4BI3fG-AR4oz189ose7ozx8A7YXO7hJaDt9XA_GH13gk8BvTrJdXAf3HDXMsldsLtiku-DmZ4pLi9P8U_10_wIhNZP84Xgy7xcD_cXeLkbsrZ7eTYc3OHlR2Fd0ywtF9JsXFMQ2cU1A5RpmrYbovZoWhws2KdpEXCwX9OOQvrIUpEFGa54sR6OeOLF59BXkyDugteRIGY7E8TCuEQRDQGWRBECqbRMrIHVPctEJuxPSRJVUJmaJKqhcDhJlMGbbSvEOuhyrBBXoDLRKKrhZJFRfAlppUahILLdKAxQfdoo6mCwwyhGoXPUKLpgOixZ8PBkkfsoWZTA8iCTSIdHYSYxA_eiTGIISjJNYic48k3iLHRtNYkrcLXTJHrh4YBJ_AOmcLMohvnZZvEshL1nFrFw_ZBZ3AZTWorIgLEbKaKHVopr4Be8UgRDwuxUkQyrfVNFJqSttZKCknNW2glPjFkpAgbNNhoFa6ONTsD6cRtZ4KUpGyXCF956aoHmqAbqgJimBloCqriRNsArfzRSEmyMbaJiMGxuoqVQubeJ6mBna [TRUNCATED] Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; Domain=.docs.google.com; Expires=Mon, 06-Jan-2025 15:47:31 GMT; Path=/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRCT9u-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; Domain=.docs.google.com; Expires=Mon, 06-Jan-2025 15:47:31 GMT; Path=/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: NID=520=FevtxKwTOp6r84NBA4YkbXKVKf9wUAaQVrHAfRMjysplo-thkXEQxWd2zIyJlLVH7IqTKnes5ZX7RygdJUrW_sgvj019x_S0oFGDH5iw4unm1vOTaDZJR-gOhkvI-X52osNwsiqrraf9Rx5LljoVu_GAnCQVOzKNEND5TMgxLTzCBGqaGZg20XP7; expires=Tue, 08-Jul-2025 14:47:31 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:47:31 UTC	3627	IN	Data Raw: 37 30 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 48 42 31 65 43 64 2d 55 4d 72 6e 6d 62 20 50 48 4f 63 56 62 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 73 70 72 65 61 64 73 68 65 65 74 73 2f 66 6f 72 6d 73 2f 66 61 76 69 63 6f 6e 5f 71 70 32 2e 70 6e 67 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 69 63 6f 6e 3f 66 61 6d 69 6c 79 3d 4d 61 74 65 72 69 61 6c 2b 49 63 6f 6e 73 2b 45 78 74 65 Data Ascii: 7006<!DOCTYPE html><html lang="en" class="HB1eCd-UMrnmb PHOcVb"><head><link rel="shortcut icon" sizes="16x16" href="https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png"><link href="https://fonts.googleapis.com/icon?family=Material+Icons+Exte
2025-01-06 14:47:31 UTC	3627	IN	Data Raw: 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 36 31 2c 20 31 34 33 2c 20 34 35 2c 20 30 2e 31 35 29 3b 7d 2e 61 6f 6d 61 45 63 20 3a 6e 6f 74 28 2e 52 44 50 5a 45 29 3a 68 6f 76 65 72 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 36 31 2c 20 31 34 33 2c 20 34 35 2c 20 30 2e 30 34 29 3b 7d 2e 61 6f 6d 61 45 63 20 3a 6e 6f 74 28 2e 52 44 50 5a 45 29 3a 66 6f 63 75 73 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 36 31 2c 20 31 34 33 2c 20 34 35 2c 20 30 2e 31 35 29 3b 7d 2e 45 43 76 42 52 62 20 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 20 2e 49 64 35 56 31 2c 20 2e 45 43 76 42 52 62 20 2e 4e 32 52 Data Ascii: MbhUzd {background-color: rgba(61, 143, 45, 0.15);}.aomaEc :not(.RDPZE):hover > .MbhUzd {background-color: rgba(61, 143, 45, 0.04);}.aomaEc :not(.RDPZE):focus > .MbhUzd {background-color: rgba(61, 143, 45, 0.15);}.ECvBRb .N2RpBe.RDPZE .Id5V1, .ECvBRb .N2R
2025-01-06 14:47:31 UTC	3627	IN	Data Raw: 63 2e 73 6e 42 79 61 63 2c 20 2e 75 33 62 57 34 65 20 3e 20 2e 6f 4a 65 57 75 66 20 3e 2e 66 71 70 36 68 64 2e 73 6e 42 79 61 63 2c 20 2e 75 33 62 57 34 65 2e 64 6d 37 59 54 63 20 3e 20 2e 6f 4a 65 57 75 66 20 3e 2e 66 71 70 36 68 64 2e 73 6e 42 79 61 63 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 48 4e 67 4b 39 2e 52 44 50 5a 45 20 2e 7a 48 51 6b 42 66 5b 64 69 73 61 62 6c 65 64 5d 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 38 37 29 3b 7d 2e 46 6c 77 4e 77 2e 75 33 62 57 34 65 20 2e 6f 4a 65 57 75 66 3a 62 65 66 6f 72 65 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 46 6c 77 4e 77 20 2e 7a 48 51 6b 42 66 3a 6e 6f 74 28 5b 64 69 73 61 Data Ascii: c.snByac, .u3bW4e > .oJeWuf >.fqp6hd.snByac, .u3bW4e.dm7YTc > .oJeWuf >.fqp6hd.snByac {color: rgb(41, 137, 4);}.HNgK9.RDPZE .zHQkBf[disabled] {color: rgba(0, 0, 0, .87);}.FlwNw.u3bW4e .oJeWuf:before {border-color: rgb(41, 137, 4);}.FlwNw .zHQkBf:not([disa
2025-01-06 14:47:31 UTC	3627	IN	Data Raw: 2e 4d 37 65 4d 65 20 2e 73 6e 42 79 61 63 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 64 6f 63 73 2d 52 6f 62 6f 74 6f 27 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4f 49 43 39 30 63 2c 20 2e 4f 49 43 39 30 63 2e 52 6a 73 50 45 2c 20 2e 4f 49 43 39 30 63 20 2e 7a 48 51 6b 42 66 2c 20 2e 4f 49 43 39 30 63 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4f 49 43 39 30 63 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4f 49 43 39 30 63 20 2e 50 79 72 42 34 2c 20 2e 4f 49 43 39 30 63 20 2e 73 6e 42 79 61 63 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 74 3b 20 6c 69 6e 65 2d 68 65 Data Ascii: .M7eMe .snByac{font-size: 12pt;font-family: 'docs-Roboto', Helvetica, Arial, sans-serif;letter-spacing: 0;}.OIC90c, .OIC90c.RjsPE, .OIC90c .zHQkBf, .OIC90c .Wic03c .tL9Q4c, .OIC90c .I9OJHe .KRoqRc, .OIC90c .PyrB4, .OIC90c .snByac {font-size: 11pt; line-he
2025-01-06 14:47:31 UTC	3627	IN	Data Raw: 2c 37 31 34 37 38 31 30 38 2c 37 31 34 37 38 34 36 39 2c 37 31 34 37 38 34 37 37 2c 37 31 35 31 35 37 38 39 2c 37 31 35 31 35 37 39 37 2c 37 31 35 32 38 36 31 37 2c 37 31 35 32 38 36 32 35 2c 37 31 35 33 30 30 36 33 2c 37 31 35 33 30 30 37 31 2c 37 31 35 34 34 38 37 34 2c 37 31 35 34 34 38 38 32 2c 37 31 35 34 35 34 39 33 2c 37 31 35 34 35 35 30 31 2c 37 31 35 34 36 33 34 35 2c 37 31 35 34 36 33 35 33 2c 37 31 35 36 31 36 36 31 2c 37 31 35 36 31 36 36 39 2c 37 31 35 37 34 30 31 30 2c 37 31 35 37 34 30 31 38 2c 37 31 36 32 36 33 34 30 2c 37 31 36 32 36 33 35 36 2c 37 31 36 33 35 32 36 34 2c 37 31 36 33 35 32 38 30 2c 37 31 36 33 39 35 33 34 2c 37 31 36 33 39 35 35 30 2c 37 31 36 34 32 30 38 33 2c 37 31 36 34 32 30 39 31 2c 37 31 36 35 32 39 38 30 2c 37 31 Data Ascii: ,71478108,71478469,71478477,71515789,71515797,71528617,71528625,71530063,71530071,71544874,71544882,71545493,71545501,71546345,71546353,71561661,71561669,71574010,71574018,71626340,71626356,71635264,71635280,71639534,71639550,71642083,71642091,71652980,71
2025-01-06 14:47:31 UTC	3627	IN	Data Raw: 32 34 31 2c 34 39 39 32 34 36 30 36 2c 37 31 36 35 32 39 38 30 2c 39 34 38 37 34 38 38 39 2c 39 34 38 31 33 34 32 33 2c 37 31 35 36 31 36 36 31 2c 39 35 32 35 31 31 36 32 2c 31 30 31 34 34 32 38 37 35 2c 39 35 30 38 37 31 30 36 2c 31 30 31 38 32 39 32 33 38 2c 35 30 35 38 37 30 32 32 2c 39 35 30 37 38 30 34 38 2c 35 37 36 34 33 33 30 2c 37 31 36 33 35 32 36 34 2c 37 31 35 32 38 36 31 37 2c 35 30 35 30 33 37 35 39 2c 37 31 31 39 37 39 36 36 2c 31 30 31 37 35 34 33 32 32 2c 37 31 35 33 30 30 36 33 2c 31 30 32 30 38 33 30 31 34 2c 39 34 35 30 32 38 31 34 2c 34 39 36 34 34 30 33 35 2c 37 31 30 33 35 34 37 37 2c 35 37 33 38 37 31 33 2c 37 31 36 35 37 39 30 30 2c 35 37 33 37 37 38 34 2c 31 30 31 37 30 38 34 38 33 2c 39 34 33 38 39 39 39 33 2c 39 34 35 31 34 30 Data Ascii: 241,49924606,71652980,94874889,94813423,71561661,95251162,101442875,95087106,101829238,50587022,95078048,5764330,71635264,71528617,50503759,71197966,101754322,71530063,102083014,94502814,49644035,71035477,5738713,71657900,5737784,101708483,94389993,945140
2025-01-06 14:47:31 UTC	3627	IN	Data Raw: 42 30 73 75 4b 31 4e 5a 72 32 4b 30 53 4a 6d 66 6d 4a 33 6e 22 2c 22 4b 4d 63 4c 4b 76 75 62 76 30 73 75 4b 31 4e 5a 72 32 4b 30 50 4c 4d 55 4a 37 7a 72 22 2c 22 70 77 4c 44 75 63 4a 5a 55 30 65 7a 46 63 67 71 78 33 31 30 4e 67 74 6d 59 70 62 56 22 2c 22 54 43 4b 44 56 51 36 4a 30 42 6e 33 67 62 57 34 41 63 5a 43 30 50 51 4b 79 70 43 61 22 2c 22 5a 37 76 61 62 51 7a 5a 30 42 6e 33 67 62 57 34 41 63 5a 43 30 54 66 76 6d 53 61 62 22 5d 2c 22 64 6f 63 73 2d 68 75 6e 64 73 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 68 61 65 22 3a 22 50 52 4f 44 22 2c 22 64 6f 63 73 2d 65 68 6e 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 70 69 2d 6b 65 79 73 22 3a 7b 22 73 63 6f 6e 65 5f 61 70 69 5f 6b 65 79 22 3a 22 41 49 7a 61 53 79 41 50 36 36 79 77 38 51 6e 50 65 34 43 67 Data Ascii: B0suK1NZr2K0SJmfmJ3n","KMcLKvubv0suK1NZr2K0PLMUJ7zr","pwLDucJZU0ezFcgqx310NgtmYpbV","TCKDVQ6J0Bn3gbW4AcZC0PQKypCa","Z7vabQzZ0Bn3gbW4AcZC0TfvmSab"],"docs-hunds":false,"docs-hae":"PROD","docs-ehn":false,"docs-api-keys":{"scone_api_key":"AIzaSyAP66yw8QnPe4Cg
2025-01-06 14:47:31 UTC	3297	IN	Data Raw: 22 3a 30 2c 22 64 6f 63 73 2d 65 64 6c 6f 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 63 74 74 6d 74 65 71 22 3a 30 2c 22 64 6f 63 73 2d 64 65 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 74 74 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 67 64 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 73 70 73 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 63 65 63 73 22 3a 66 61 6c 73 65 2c 22 73 65 72 76 65 72 5f 74 69 6d 65 5f 6d 73 22 3a 31 37 33 36 31 37 34 38 35 31 36 35 30 2c 22 67 61 69 61 5f 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 22 2c 22 64 6f 63 73 2d 75 73 70 22 3a 22 66 6f 72 6d 73 5f 77 65 62 22 2c 22 64 6f 63 73 2d 69 73 62 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 61 67 64 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 6e 64 64 63 22 3a 74 72 75 65 2c Data Ascii: ":0,"docs-edlo":false,"docs-cttmteq":0,"docs-dec":false,"docs-ectt":false,"docs-ecgd":false,"docs-dsps":true,"docs-ececs":false,"server_time_ms":1736174851650,"gaia_session_id":"","docs-usp":"forms_web","docs-isb":true,"docs-agdc":false,"docs-anddc":true,
2025-01-06 14:47:31 UTC	1390	IN	Data Raw: 34 30 30 32 0d 0a 65 2c 22 64 6f 63 73 2d 65 61 61 77 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 65 63 73 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 68 6c 62 61 70 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 6d 74 72 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 75 65 70 6e 69 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 75 77 7a 68 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 61 66 6a 65 72 61 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 61 66 6c 69 61 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 61 66 67 66 6d 61 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 66 74 61 2d 66 6e 72 68 63 69 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 72 61 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 72 61 75 72 6b 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 66 68 6e 66 73 74 22 3a 22 Data Ascii: 4002e,"docs-eaaw":false,"docs-eecs":false,"docs-ehlbap":false,"docs-emtr":false,"docs-euepni":true,"docs-uwzh":false,"docs-dafjera":false,"docs-daflia":false,"docs-dafgfma":false,"docs-fta-fnrhci":false,"docs-era":true,"docs-eraurk":true,"docs-fhnfst":"
2025-01-06 14:47:31 UTC	1390	IN	Data Raw: 64 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 69 63 6b 65 72 3f 70 72 6f 74 6f 63 6f 6c 5c 75 30 30 33 64 67 61 64 67 65 74 73 5c 75 30 30 32 36 70 61 72 65 6e 74 5c 75 30 30 33 64 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 61 79 2e 68 74 6d 6c 5c 75 30 30 32 36 68 6f 73 74 49 64 5c 75 30 30 33 64 73 70 72 65 61 64 73 68 65 65 74 2d 66 6f 72 6d 2d 6c 69 6e 6b 65 72 5c 75 30 30 32 36 74 69 74 6c 65 5c 75 30 30 33 64 43 68 6f 6f 73 65 2b 61 2b 73 70 72 65 61 64 73 68 65 65 74 2b 77 68 65 72 65 2b 77 65 5c 75 30 30 32 37 6c 6c 2b 63 6f 70 79 2b 72 65 73 70 6f 6e 73 65 73 2b 74 6f 2b 79 6f 75 72 2b 66 6f 72 6d 5c 75 30 30 32 36 68 6c 5c 75 30 30 33 64 65 6e 5c 75 30 30 32 36 6e 65 Data Ascii: d":"https://docs.google.com/picker?protocol\u003dgadgets\u0026parent\u003dhttps://docs.google.com/relay.html\u0026hostId\u003dspreadsheet-form-linker\u0026title\u003dChoose+a+spreadsheet+where+we\u0027ll+copy+responses+to+your+form\u0026hl\u003den\u0026ne

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:36 UTC	1441	OUT	POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 5244 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRCT9u-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=FevtxKwTOp6r84NBA4YkbXKVKf9wUAaQVrHAfRMjysplo-thkXEQxWd2zIyJlLVH7IqTKnes5ZX7RygdJUrW_sgvj019x_S0oFGDH5iw4unm1vOTaDZJR-gOhkvI-X52osNwsiqrraf9Rx5LljoVu_GAnCQVOzKNEND5TMgxLTzCBGqaGZg20XP7
2025-01-06 14:47:36 UTC	5244	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 37 33 36 31 37 34 38 35 34 38 31 39 30 30 30 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 25 35 42 31 37 33 36 31 37 34 38 35 34 38 31 39 30 30 30 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 37 31 36 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 25 35 44 25 35 44 25 32 43 25 35 42 25 32 32 43 50 6a 4c 73 36 71 72 34 59 6f 44 46 58 79 43 4c 51 6b 64 4e 55 6b 48 57 77 25 32 32 25 32 43 31 37 33 36 31 37 34 38 35 34 38 31 38 30 30 30 25 32 43 31 37 33 36 31 37 34 38 35 31 36 34 36 39 36 37 25 32 43 25 32 32 41 44 46 4e 2d 63 73 64 47 59 7a 45 46 46 61 30 51 Data Ascii: impressionBatch=%5B%5B%5Bnull%2Cnull%2C1%2C1736174854819000%2Cnull%2Cnull%2Cnull%2C%5B%5B1736174854819000%5D%2Cnull%2C1%5D%2Cnull%2C716%2Cnull%2C1%2C1%5D%5D%2C%5B%22CPjLs6qr4YoDFXyCLQkdNUkHWw%22%2C1736174854818000%2C1736174851646967%2C%22ADFN-csdGYzEFFa0Q
2025-01-06 14:47:36 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:47:36 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-ioYhCopiQ3m5253Pu4W61g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:36 UTC	541	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://docs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:47:36 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:47:36 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:36 UTC	1426	OUT	POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 246 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRCT9u-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=FevtxKwTOp6r84NBA4YkbXKVKf9wUAaQVrHAfRMjysplo-thkXEQxWd2zIyJlLVH7IqTKnes5ZX7RygdJUrW_sgvj019x_S0oFGDH5iw4unm1vOTaDZJR-gOhkvI-X52osNwsiqrraf9Rx5LljoVu_GAnCQVOzKNEND5TMgxLTzCBGqaGZg20XP7
2025-01-06 14:47:36 UTC	246	OUT	Data Raw: 66 61 6d 69 6c 69 65 73 3d 41 6d 61 74 69 63 25 32 30 53 43 25 32 43 43 61 76 65 61 74 25 32 43 43 6f 6d 66 6f 72 74 61 61 25 32 43 45 42 25 32 30 47 61 72 61 6d 6f 6e 64 25 32 43 4c 65 78 65 6e 64 25 32 43 4c 6f 62 73 74 65 72 25 32 43 4c 6f 72 61 25 32 43 4d 65 72 72 69 77 65 61 74 68 65 72 25 32 43 4d 6f 6e 74 73 65 72 72 61 74 25 32 43 4e 75 6e 69 74 6f 25 32 43 4f 73 77 61 6c 64 25 32 43 50 61 63 69 66 69 63 6f 25 32 43 50 6c 61 79 66 61 69 72 25 32 30 44 69 73 70 6c 61 79 25 32 43 52 6f 62 6f 74 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 4d 6f 6e 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 53 65 72 69 66 25 32 43 53 70 65 63 74 72 61 6c 26 75 73 65 41 6c 6c 53 75 62 73 65 74 73 3d 74 72 75 65 26 66 6f 72 6d 61 74 3d 77 6f 66 66 32 Data Ascii: families=Amatic%20SC%2CCaveat%2CComfortaa%2CEB%20Garamond%2CLexend%2CLobster%2CLora%2CMerriweather%2CMontserrat%2CNunito%2COswald%2CPacifico%2CPlayfair%20Display%2CRoboto%2CRoboto%20Mono%2CRoboto%20Serif%2CSpectral&useAllSubsets=true&format=woff2
2025-01-06 14:47:36 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:47:36 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:47:36 UTC	718	IN	Data Raw: 37 30 30 36 0d 0a 29 5d 7d 27 0a 7b 22 66 6f 6e 74 4d 65 74 61 64 61 74 61 4d 61 70 22 3a 7b 22 43 61 76 65 61 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 66 6f 6e 74 46 61 63 65 73 22 3a 5b 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c Data Ascii: 7006)]}'{"fontMetadataMap":{"Caveat":{"documentFont":false,"fontFaces":[{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f Data Ascii: odepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.co
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 4e 76 4f 78 2d 70 6a 66 4a 39 65 49 57 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 4c 41 54 49 4e 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 22 2c 22 77 65 69 67 68 74 22 3a 34 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 52 65 67 75 6c 61 72 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 Data Ascii: NvOx-pjfJ9eIWpYQ.woff2"}],"style":"normal","subset":"LATIN","subsetValue":"latin","weight":400,"weightedFontFamily":"Caveat Regular"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 63 42 39 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 Data Ascii: "ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjcB9eIGpYQ.woff2"}],"sty
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 6c 75 65 22 3a 22 6c 61 74 69 6e 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 Data Ascii: lue":"latin","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePage
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 53 78 36 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 22 2c 22 77 65 69 67 68 74 22 3a 36 30 Data Ascii: ent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjSx6eIGpYQ.woff2"}],"style":"normal","subset":"CYRILLIC","subsetValue":"cyrillic","weight":60
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a Data Ascii: ,{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 52 56 36 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 22 2c 22 77 65 69 67 68 74 22 3a 37 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 Data Ascii: mat":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjRV6eIGpYQ.woff2"}],"style":"normal","subset":"CYRILLIC","subsetValue":"cyrillic","weight":700,"weightedFontFamily":"Caveat Bold"},{"fontDrawSize":{"STypoAsce
2025-01-06 14:47:36 UTC	1390	IN	Data Raw: 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 36 30 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c Data Ascii: "ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":160,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isL

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:37 UTC	1011	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 4343 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=FevtxKwTOp6r84NBA4YkbXKVKf9wUAaQVrHAfRMjysplo-thkXEQxWd2zIyJlLVH7IqTKnes5ZX7RygdJUrW_sgvj019x_S0oFGDH5iw4unm1vOTaDZJR-gOhkvI-X52osNwsiqrraf9Rx5LljoVu_GAnCQVOzKNEND5TMgxLTzCBGqaGZg20XP7
2025-01-06 14:47:37 UTC	4343	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 33 36 31 37 34 38 35 34 38 32 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 31 37 33 36 31 37 34 38 35 34 38 31 39 30 30 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 31 37 33 36 31 37 34 38 35 34 38 31 39 30 30 30 5d 2c 6e 75 6c 6c 2c 31 5d 2c 6e 75 6c 6c 2c 37 31 36 2c 6e 75 6c 6c 2c 31 2c 31 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,null,[4,0,0,0,0]]],2035,[["1736174854820",null,null,null,null,null,null,"[[[null,null,1,1736174854819000,null,null,null,[[1736174854819000],null,1],null,716,null,1,1
2025-01-06 14:47:37 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA; expires=Tue, 08-Jul-2025 14:47:37 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:47:37 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 06 Jan 2025 14:47:37 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-06 14:47:37 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:47:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:39 UTC	1019	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 8074 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:47:39 UTC	8074	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 33 36 31 37 34 38 35 37 38 32 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],2035,[["1736174857821",null,null,null
2025-01-06 14:47:39 UTC	495	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:47:39 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:47:39 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:47:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:39 UTC	1436	OUT	POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 10830 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRCT9u-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:47:39 UTC	10830	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 34 31 25 32 43 6e 75 6c 6c 25 32 43 32 25 32 43 31 37 33 36 31 37 34 38 35 34 38 36 36 30 30 30 25 32 43 25 35 42 25 35 42 25 35 42 31 32 38 30 25 32 43 39 30 37 25 32 43 31 32 38 30 25 32 43 39 38 34 25 35 44 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 66 61 6c 73 65 25 32 43 74 72 75 65 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c Data Ascii: impressionBatch=%5B%5B%5B41%2Cnull%2C2%2C1736174854866000%2C%5B%5B%5B1280%2C907%2C1280%2C984%5D%2Cfalse%2Cnull%2Cnull%2C1%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cfalse%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5Bfalse%2Ctrue%5D%2Cnull%2Cnull
2025-01-06 14:47:39 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:47:39 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-6liDc7582Q0zqbD90LjwxA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:00 UTC	410	OUT	OPTIONS /csp/report-to/gse_qebhlk HTTP/1.1 Host: csp.withgoogle.com Connection: keep-alive Origin: https://accounts.google.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:48:00 UTC	547	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: POST Access-Control-Allow-Headers: content-type Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:48:00 GMT Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://forms.gle/XsPfAF5jPgqSvvp87

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Windows Analysis Report
https://forms.gle/XsPfAF5jPgqSvvp87

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:00 UTC	348	OUT	POST /csp/report-to/gse_qebhlk HTTP/1.1 Host: csp.withgoogle.com Connection: keep-alive Content-Length: 716 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:48:00 UTC	716	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 2c 22 62 6f 64 79 22 3a 7b 22 64 69 73 70 6f 73 69 74 69 6f 6e 22 3a 22 72 65 70 6f 72 74 69 6e 67 22 2c 22 65 66 66 65 63 74 69 76 65 50 6f 6c 69 63 79 22 3a 22 73 61 6d 65 2d 6f 72 69 67 69 6e 22 2c 22 70 72 65 76 69 6f 75 73 52 65 73 70 6f 6e 73 65 55 52 4c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 4c 6f 67 69 6e 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 25 32 46 66 6f 72 6d 73 25 32 46 64 25 32 46 65 25 32 46 31 46 41 49 70 51 4c 53 63 30 4b 75 73 73 4e 5f 6b 45 32 41 47 32 63 76 67 6d 6e 59 45 69 4d 55 58 50 72 73 44 36 6c 39 43 74 4b 52 72 7a 6f 4d 34 73 50 59 47 52 4a 67 25 32 46 76 69 65 77 66 6f Data Ascii: [{"age":2,"body":{"disposition":"reporting","effectivePolicy":"same-origin","previousResponseURL":"https://accounts.google.com/Login?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewfo
2025-01-06 14:48:01 UTC	1699	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:48:01 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /csp/_/CspCollectorHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7C6sRKdYh1p1XqFGuKXlbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /csp/_/CspCollectorHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /csp/_/CspCollectorHttp/cspreport/allowlist Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/csp/_/CspCollectorHttp/web-reports?context=eJzjEtDikmLw05BicEqfwRoCxELcHAtvvd_NJrBhyu8AJb2k_ML44tTk0qLMkkrd5OIC3eT8nJzU5JL8It2MkpKCeCMDI1MDQwMjPQOL-AIDAOBUGcM" Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:19 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:48:19 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:48:19 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:20 UTC	1342	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 692 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:20 UTC	692	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 33 38 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 31 37 34 38 39 37 37 31 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"38",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1736174897711",null,null,n
2025-01-06 14:48:20 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:48:20 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:48:20 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:48:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:21 UTC	1235	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:22 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 06 Jan 2025 14:36:38 GMT Expires: Tue, 14 Jan 2025 14:36:38 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 704 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:48:22 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2025-01-06 14:48:22 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2025-01-06 14:48:22 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2025-01-06 14:48:22 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2025-01-06 14:48:22 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:22 UTC	656	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:23 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 06 Jan 2025 14:36:38 GMT Expires: Tue, 14 Jan 2025 14:36:38 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 705 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:48:23 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2025-01-06 14:48:23 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2025-01-06 14:48:23 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2025-01-06 14:48:23 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2025-01-06 14:48:23 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:26 UTC	1320	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1533 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:26 UTC	1533	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 33 36 31 37 34 38 39 35 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1736174895000",null,null,nu
2025-01-06 14:48:27 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:48:27 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:48:27 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:48:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:28 UTC	1342	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 688 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:28 UTC	688	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 33 38 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 31 37 34 39 30 37 31 35 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"38",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1736174907157",null,null,n
2025-01-06 14:48:28 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:48:28 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:48:28 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:48:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:36 UTC	1342	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 810 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:36 UTC	810	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 33 38 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 31 37 34 39 31 35 33 30 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"38",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1736174915304",null,null,n
2025-01-06 14:48:36 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:48:36 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:48:36 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:48:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:37 UTC	1019	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 4835 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:37 UTC	4835	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 33 36 31 37 34 39 31 35 37 31 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],2035,[["1736174915711",null,null,null
2025-01-06 14:48:37 UTC	495	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:48:37 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:48:37 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:48:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:48:38 UTC	1319	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 967 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=YxdRfxY495N2-EX_8mbsELAJSHGMTRKv1L0ytFf5357M55KqSXqJ1MPwPzGAJ3LbtTXdpiVcDrXNPUznZkLw6h_2MMMDPu1KAHUn-6UCZRlg4BFp8jcgIlhGfq2Vwbjdx2LYcwdyvs3Q3J030cHcepLgf8J4k2DeLuHZbxP4Ej80-_DOXErfeRyxZ4c_wqwA
2025-01-06 14:48:38 UTC	967	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 33 36 31 37 34 39 30 37 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1736174907000",null,null,nu
2025-01-06 14:48:38 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:48:38 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:48:38 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:48:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0