Edit tour

Windows Analysis Report
https://forms.gle/XsPfAF5jPgqSvvp87

Overview

General Information

Sample URL:	https://forms.gle/XsPfAF5jPgqSvvp87
Analysis ID:	1584830
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detected suspicious crossdomain redirect

HTML body contains password input but no form action

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3900 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.gle/XsPfAF5jPgqSvvp87" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform

Joe Sandbox AI: Score: 7 Reasons: The brand 'Office 365' is well-known and is associated with Microsoft., The legitimate domain for Office 365 is 'office.com' or 'microsoft.com'., The URL 'docs.google.com' is associated with Google, not Microsoft or Office 365., The use of a Google domain for an Office 365 brand is suspicious and suggests phishing., The input fields request sensitive information, which is common in phishing attempts. DOM: 2.0.pages.csv

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1789171690&timestamp=1736175239759
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1789171690&timestamp=1736175239759
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1789171690&timestamp=1736175239759
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1789171690&timestamp=1736175239759
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: Iframe src: /_/bscframe

HTTP Parser: <input type="password" .../> found

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No favicon

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="author".. found

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNbHA&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1127276215%3A1736175234955762&ddm=1	HTTP Parser: No <meta name="copyright".. found

Source:	Binary string: _.ODb=_.Q("WBfAfb");_.PDb=_.Q("y0q3Tb");_.QDb=_.Q("JstLif"); source: chromecache_190.2.dr, chromecache_151.2.dr
Source:	Binary string: var ryc=function(a){if(!a.o()&&a.j.j.length!==0){var b=a.j.j.shift();a.j.H=b.Jf;_.DE(a.H)?_.EE(a.H,b.Jf):a.H.appendChild(b.Jf);setTimeout(function(){var c;(c=b.Jf.querySelector('[jsname="XxIAqe"]'))==null\|\|c.appendChild(b.content)},150);_.$e(b.Jf,_.ODb,b.wr);_.Ye(b.Jf,_.QDb,function(){b.HJ.resolve()});_.Ye(b.Jf,_.PDb,function(c){a.H.contains(b.Jf)&&a.H.removeChild(b.Jf);a.j.H=null;b.ZH.resolve(c.data);ryc(a)})}};_.ju(_.GAa,_.y8); source: chromecache_190.2.dr, chromecache_151.2.dr

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: forms.gle to https://docs.google.com/forms/d/e/1faipqlsc0kussn_ke2ag2cvgmnyeimuxprsd6l9ctkrrzom4spygrjg/viewform?usp=send_form

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XsPfAF5jPgqSvvp87 HTTP/1.1Host: forms.gleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2

Source: chromecache_200.2.dr, chromecache_194.2.dr	String found in binary or memory: Cf=y(["https://sandbox.google.com/tools/feedback/"]),Df=y(["https://www.google.cn/tools/feedback/"]),Ef=y(["https://help.youtube.com/tools/feedback/"]),Ff=y(["https://asx-frontend-staging.corp.google.com/inapp/"]),Gf=y(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),Hf=y(["https://localhost.corp.google.com/inapp/"]),If=y(["https://localhost.proxy.googlers.com/inapp/"]),Jf=U(lf),Kf=[U(mf),U(nf)],Lf=[U(of),U(pf),U(qf),U(rf),U(sf),U(tf),U(uf),U(vf),U(wf),U(xf)],Mf=[U(yf),U(zf)],Nf= equals www.youtube.com (Youtube)
Source: chromecache_129.2.dr	String found in binary or memory: _.wq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.wq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.wq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.wq(_.Fq(c))+"&hl="+_.wq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.wq(m)+"/chromebook/termsofservice.html?languageCode="+_.wq(d)+"&regionCode="+_.wq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: forms.gle
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com

Source: unknown

HTTP traffic detected: POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/naLogImpressions HTTP/1.1Host: docs.google.comConnection: keep-aliveContent-Length: 5286sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Same-Domain: 1Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0X-Client-Deadline-Ms: 20000User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_formAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRD4-O-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=jPG99HoW9EKVebwyEa753Wc2x5OOGvUEXYtX6byAisjwfpHwwbD3JNbOskY_t6sJxtSFga3wmcAuSOxB0ZTYiHKPcZ0U28NsZi2vuREp_DsqfroTa3_1PiH-eUHWXQhBI2rZfDii6ppE8qIt0tvNN-Rsa6ysXlMz4WrQQ-JO05aojtV0eBu1RC9J

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.gle/XsPfAF5jPgqSvvp87"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3900 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3900 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1700,i,10064265145141087651,17530339163304269354,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
docs.google.com	142.250.185.110	true	false	high
csp.withgoogle.com	142.250.186.113	true	false	high
play.google.com	142.250.186.46	true	false	high
www3.l.google.com	142.250.185.142	true	false	high
www.google.com	172.217.16.196	true	false	high
forms.gle	199.36.158.100	true	false	high
accounts.youtube.com	unknown	unknown	false	high

Name	Source	Malicious	Reputation
https://play.google/intl/	chromecache_182.2.dr, chromecache_129.2.dr	false	high
http://localhost.corp.google.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://families.google.com/intl/	chromecache_129.2.dr	false	high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://youtube.com/embed/?rel=0	chromecache_213.2.dr, chromecache_234.2.dr	false	high
https://apis.google.com/js/client.js	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://policies.google.com/technologies/location-data	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://support.google.com	chromecache_213.2.dr, chromecache_234.2.dr	false	high
https://play.google.com	chromecache_213.2.dr, chromecache_234.2.dr	false	high
https://youtube.com/embed/	chromecache_213.2.dr, chromecache_234.2.dr	false	high
http://localhost.proxy.googlers.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_194.2.dr	false	high
https://support.google.com/inapp/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://asx-help-frontend-autopush.corp.youtube.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://play.google.com/work/enroll?identifier=	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://policies.google.com/terms/service-specific	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://g.co/recover	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	chromecache_129.2.dr	false	high
https://help.youtube.com/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://policies.google.com/technologies/cookies	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://policies.google.com/terms	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://asx-frontend-staging.corp.google.com/tools/feedback/	chromecache_194.2.dr	false	high
https://support.google.com/	chromecache_194.2.dr	false	high
https://www.google.com	chromecache_213.2.dr, chromecache_182.2.dr, chromecache_234.2.dr, chromecache_129.2.dr	false	high
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://scone-pa.clients6.google.com	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://support.google.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://policies.google.com/terms/location	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://asx-frontend-autopush.corp.google.com/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://support.google.com/accounts?p=new-si-ui	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://feedback2-test.corp.google.com/inapp/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://www.google.com/tools/feedback	chromecache_194.2.dr	false	high
https://youtube.com/t/terms?gl=	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://sandbox.google.com/inapp/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://www.google.com/intl/	chromecache_129.2.dr	false	high
https://apis.google.com/js/api.js	chromecache_133.2.dr, chromecache_186.2.dr	false	high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	chromecache_213.2.dr, chromecache_234.2.dr	false	high
https://feedback2-test.corp.googleusercontent.com/inapp/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://localhost.proxy.googlers.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://policies.google.com/privacy/google-partners	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://www.google.com/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://www.google.cn/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://policies.google.com/privacy/additional	chromecache_129.2.dr	false	high
https://asx-frontend-autopush.corp.google.de/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://www.google.cn/tools/feedback/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://www.google.com/tools/feedback/help_panel_binary.js	chromecache_194.2.dr	false	high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_133.2.dr, chromecache_154.2.dr, chromecache_168.2.dr, chromecache_186.2.dr	false	high
https://asx-frontend-autopush.corp.google.de/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://sandbox.google.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://test-scone-pa-googleapis.sandbox.google.com	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://play.google.com/log?format=json&hasfast=true	chromecache_168.2.dr	false	high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://feedback.googleusercontent.com/resources/render_frame2.html	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://sandbox.google.com/tools/feedback/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://sandbox.google.com/tools/feedback/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://localhost.corp.google.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://support.google.com/accounts?hl=	chromecache_182.2.dr, chromecache_129.2.dr	false	high
https://asx-frontend-autopush.corp.youtube.com/inapp/	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://policies.google.com/privacy	chromecache_129.2.dr	false	high
https://feedback-pa.clients6.google.com	chromecache_194.2.dr	false	high
https://asx-frontend-staging.corp.google.com/inapp/	chromecache_194.2.dr	false	high
https://www.google.com/tools/feedback/%	chromecache_200.2.dr, chromecache_194.2.dr	false	high
https://fonts.google.com/license/googlerestricted	chromecache_227.2.dr, chromecache_136.2.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
142.250.186.113	csp.withgoogle.com	United States	15169	GOOGLEUS	false
142.250.185.110	docs.google.com	United States	15169	GOOGLEUS	false
199.36.158.100	forms.gle	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584830
Start date and time:	2025-01-06 15:52:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://forms.gle/XsPfAF5jPgqSvvp87
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@23/228@24/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (578)
Category:	downloaded
Size (bytes):	1513
Entropy (8bit):	5.463839609615064
Encrypted:	false
SSDEEP:	24:k11CAvO8wqDsdqJN1mmSf9s+C2aSSkj47c6Q1MZxFqDHVHp1JBr1a:qkj8wqDqGSf9VESSk87dLmzRr1a
MD5:	2F2266A2355D99331618FCD8440DA50A
SHA1:	FEFF0586C2375031471EC51498D5B80E82C31BAE
SHA-256:	D1AEC308B37C6AE9F0E16C3C3D9CDC07E93A6A20C1C2CD749B88D441BFF30553
SHA-512:	F293A2BBB92748751EB4CEC30737CA7962E4E4485B2A95F06E33257AFFEF732978821273009320D5F7D4AFDF82D0A96AF5945AB95C68EF9622FA189A0D44B55D
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/_/freebird/_/js/k=freebird.v.en.dyilmju5Pxw.O/am=GAw/d=0/rs=AMjVe6ijQwVgSCAYHc9n_oHLRvEOnoPLcw/m=sydn,sWGJ4b"
Preview:	"use strict";this.default_v=this.default_v\|\|{};(function(_){var window=this;.try{._.q("sWGJ4b");.var Nuc=function(a){this.Ba=_.n(a)};_.B(Nuc,_.E);var Suc=function(a,b){b=b\|\|{};if(b=b.I9)switch(_.Oh(b,2)){case 1:a.Ra("MIaCgc");if(b=b==null?void 0:_.jL(b,1))a.open("div","fFsnHe"),a.Nb(Ouc\|\|(Ouc=["class","rRld8e"])),a.Lb(),a.Ra("lBL31d"),_.T7(a,{icon:164}),a.Ta(),a.close(),a.open("span","Pw1xR"),a.Nb(Puc\|\|(Puc=["class","FczIpc"])),a.Lb(),a.print(b),a.close();a.Ta();break;case 2:a.Ra("EXhbA");if(b=b==null?void 0:_.jL(b,1))a.open("div","QqNTyb"),a.Nb(Quc\|\|(Quc=["class","rRld8e"])),a.Lb(),a.Ra("m6mm9e"),_.T7(a,{icon:139}),a.Ta(),a.close(),a.open("span",."lJICRc"),a.Nb(Ruc\|\|(Ruc=["class","RHiWt"])),a.Lb(),a.print(b),a.close();a.Ta()}};Suc.De=_.Hx;var Quc,Ruc,Ouc,Puc;var U7=function(a){_.R.call(this,a.Ma);this.j=a.service.Mb};_.B(U7,_.R);U7.ya=function(){return{service:{Mb:_.HC}}};U7.prototype.o=function(a){var b=a.data;a=b.type;var c=b.message;if(b.Hc)this.ha().Ua("XgsRcf"),this.ha().Ua("Jj6L

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 15:53:21.679131985 CET	53	54386	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:21.679989100 CET	53	64669	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:22.707525015 CET	53	52193	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:25.367561102 CET	61678	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:25.367698908 CET	63586	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:25.374310970 CET	53	63586	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:25.374906063 CET	53	61678	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:26.845988035 CET	63237	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:26.846183062 CET	50279	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:26.852742910 CET	53	63237	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:26.853009939 CET	53	50279	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:27.519197941 CET	59666	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:27.519539118 CET	56632	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:27.526163101 CET	53	59666	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:27.526423931 CET	53	56632	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:28.878662109 CET	53	63692	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:28.879806042 CET	53	54802	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:30.476162910 CET	53	57698	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:30.954034090 CET	53	58869	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:31.127089977 CET	53	60937	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:32.246570110 CET	53	51896	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:33.070610046 CET	64912	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:33.071213007 CET	63489	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:33.077256918 CET	53	64912	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:33.078207016 CET	53	63489	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:34.870609045 CET	54867	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:34.870857000 CET	49448	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:34.877317905 CET	53	54867	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:34.877947092 CET	53	49448	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:35.179501057 CET	50234	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:35.180052042 CET	53565	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:35.186086893 CET	53	50234	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:35.187308073 CET	53	53565	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:37.327678919 CET	138	138	192.168.2.4	192.168.2.255
Jan 6, 2025 15:53:39.748939037 CET	53	49626	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:55.095223904 CET	49279	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:55.095366955 CET	52364	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:53:55.102094889 CET	53	49279	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:55.102127075 CET	53	52364	1.1.1.1	192.168.2.4
Jan 6, 2025 15:53:58.546299934 CET	53	55336	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:00.474806070 CET	52138	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:00.474987984 CET	61408	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:00.481453896 CET	53	52138	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:00.481972933 CET	53	61408	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:01.413152933 CET	53	55402	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:04.550592899 CET	56418	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:04.550592899 CET	60906	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:04.557229996 CET	53	56418	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:04.557473898 CET	53	60906	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:20.781554937 CET	53	56694	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:20.931266069 CET	53	51275	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:24.198611975 CET	53	53280	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:33.739976883 CET	56993	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:33.740122080 CET	58809	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:33.742757082 CET	49741	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:33.742964983 CET	56217	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:33.746748924 CET	53	56993	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:33.746845007 CET	53	58809	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:33.749536991 CET	53	49741	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:33.749607086 CET	53	56217	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:35.599400997 CET	55992	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:35.599600077 CET	54953	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:54:35.605931997 CET	53	55992	1.1.1.1	192.168.2.4
Jan 6, 2025 15:54:35.606190920 CET	53	54953	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:27 UTC	669	OUT	GET /XsPfAF5jPgqSvvp87 HTTP/1.1 Host: forms.gle Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:53:27 UTC	1207	IN	HTTP/1.1 302 Found Connection: close Content-Length: 0 Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cache-Control: no-cache, no-store, max-age=0, must-revalidate Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DurableDeepLinkUi/cspreport,script-src 'report-sample' 'nonce-C6009TmCYZ41u-raw1Y88g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport/allowlist Content-Type: application/binary Cross-Origin-Opener-Policy: unsafe-none Cross-Origin-Resource-Policy: same-site Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form
2025-01-06 14:53:27 UTC	550	IN	Data Raw: 50 65 72 6d 69 73 73 69 6f 6e 73 2d 50 6f 6c 69 63 79 3a 20 63 68 2d 75 61 2d 61 72 63 68 3d 2a 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 2a 2c 20 63 68 2d 75 61 2d 66 75 6c 6c 2d 76 65 72 73 69 6f 6e 3d 2a 2c 20 63 68 2d 75 61 2d 66 75 6c 6c 2d 76 65 72 73 69 6f 6e 2d 6c 69 73 74 3d 2a 2c 20 63 68 2d 75 61 2d 6d 6f 64 65 6c 3d 2a 2c 20 63 68 2d 75 61 2d 77 6f 77 36 34 3d 2a 2c 20 63 68 2d 75 61 2d 66 6f 72 6d 2d 66 61 63 74 6f 72 73 3d 2a 2c 20 63 68 2d 75 61 2d 70 6c 61 74 66 6f 72 6d 3d 2a 2c 20 63 68 2d 75 61 2d 70 6c 61 74 66 6f 72 6d 2d 76 65 72 73 69 6f 6e 3d 2a 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 30 36 20 4a 61 6e 20 32 Data Ascii: Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Pragma: no-cacheAccept-Ranges: bytesDate: Mon, 06 Jan 2

IP
192.168.2.4
192.168.2.5

Input	Output
URL: https://forms.gle Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://forms.gle
URL: https://www.gstatic.com/_/freebird/_/js/k=freebird... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a benign script with no clear malicious intent. It initializes a feature toggle system and includes some copyright notices, which are common in legitimate code. There are no high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The script seems to be part of a larger codebase and does not demonstrate any overtly suspicious behavior." }
"use strict";this.default_v=this.default_v\|\|{};(function(_){var window=this; try{ _._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0xc18, ]); /* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / / Copyright 2024 Google, Inc SPDX-License-Identifier: MIT / / SPDX-License-Identifier: Apache-2.0 / / Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / var ia,la,baa,caa,daa,eaa,sa,faa,jaa,maa,oaa,taa,uaa,$a,bb,db,vaa,xaa,yaa,mb,nb,Baa,ob,Caa,Daa,Haa,Jaa,Eaa,Faa,wb,Naa,Oaa,zb,Qaa,Saa,Taa,Uaa,Paa,Db,$aa,aba,bba,cba,dba,eba,Kb,fba,Xaa,gba,Jb,Yaa,Zaa,hba,iba,jba,lba,nba,oba,qba,sba,tba,vba,wba,xba,Xb,yba,Cba,Dba,Fba,Gba,Hba,Iba,Jba,Kba,Eba,Lba,Oba,Qba,Pba,Tba,cc,Vba,Uba,Xba,Yba,aca,hca,ica,jca,tc,kca,lca,mca,qca,tca,nca,sca,rca,pca,oca,uca,vca,xca,yca,xc,yc,Aca,Bca,Cca,zca,Fca,Pc,Nca,Sc,Pca,Tc,Qca,Rca,hd,Wca,Yca,md,qd,cda,nda,oda,pda,qda,Jd,rda,tda, Pd,Cda,Dda,Ida,Uda,Yda,Xda,Zda,$da,aea,cea,eea,fea,gea,mea,nea,sea,yea,zea,Aea,Bea,Pe,Gea,Iea,Jea,Oea,Lea,Sea,Tea,Uea,jf,Vea,Wea,Xea,Zea,$ea,afa,ifa,kfa,lfa,mfa,nfa,ofa,pfa,qfa,sfa,rfa,wf,wfa,xfa,zfa,Kf,Gfa,Ifa,Kfa,Nfa,Sf,Ofa,Uf,Vf,pea,Wf,Yf,Wfa,aga,cga,bga,bg,dga,ega;_.aa=function(a,b){if(Error.captureStackTrace)Error.captureStackTrace(this,_.aa);else{var c=Error().stack;c&&(this.stack=c)}a&&(this.message=String(a));b!==void 0&&(this.cause=b);this.j=!0}; _.ca=function(a){_.ba.setTimeout(function(){throw a;},0)};_.da=function(){var a=_.ba.navigator;return a&&(a=a.userAgent)?a:""};ia=function(a){return _.ea?_.fa?_.fa.brands.some(function(b){return(b=b.brand)&&_.ha(b,a)}):!1:!1};_.ja=function(a){return _.ha(_.da(),a)};_.ka=function(){return _.ea?!!_.fa&&_.fa.brands.length>0:!1};la=function(){return _.ka()?!1:_.ja("Opera")};_.aaa=function(){return _.ka()?!1:_.ja("Trident")\|\|_.ja("MSIE")};baa=function(){return _.ka()?ia("Microsoft Edge"):_.ja("Edg/")}; _.ma=function(){return _.ja("Firefox")\|\|_.ja("FxiOS")};_.pa=function(){return _.ja("Safari")&&!(_.oa()\|\|(_.ka()?0:_.ja("Coast"))\|\|la()\|\|(_.ka()?0:_.ja("Edge"))\|\|baa()\|\|(_.ka()?ia("Opera"):_.ja("OPR"))\|\|_.ma()\|\|_.ja("Silk")\|\|_.ja("Android"))};_.oa=function(){return _.ka()?ia("Chromium"):(_.ja("Chrome")\|\|_.ja("CriOS"))&&!(_.ka()?0:_.ja("Edge"))\|\|_.ja("Silk")};caa=function(){return _.ja("Android")&&!(_.oa()\|\|_.ma()\|\|la()\|\|_.ja("Silk"))}; daa=function(a){var b={};a.forEach(function(c){b[c[0]]=c[1]});return function(c){return b[c.find(function(d){return d in b})]\|\|""}}; eaa=function(a){var b=_.da();if(a==="Internet Explorer"){if(_.aaa())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\\((.*?)\\))?","g");c=[];for(var e;e=d.exec(b);)c.push([e[1],e[2],e[3]\|\|void 0]); b=daa(c);switch(a){case "Opera":if(la())return b(["Version","Opera"]);if(_.ka()?ia("Opera"):_.ja("OPR"))return b(["OPR"]);break;case "Microsoft Edge":if(_.ka()?0:_.ja("Edge"))return b(["Edge"]);if(baa())return b(["Edg"]);break;case "Chromium":if(_.oa())return b(["Chrome","CriOS","HeadlessChrome"])}return a==="Firefox"&&_.ma()\|\|a==="Safari"&&_.pa()\|\|a==="Android Browser"&&caa()\|\|a==="Silk"&&_.ja("Silk")?(b=c[2])&&b[1]\|\|"":""}; _.ra=function(a){if(_.ka()&&a!=="Silk"){var b=_.fa.brands.find(function(c){return c.brand===a});if(!b\|\|!b.version)return NaN;b=b.version.split(".")}else{b=eaa(a);if(b==="")return NaN;b=b.split(".")}return b.length===0?NaN:Number(b[0])};sa=function(){return _.ea?!!_.fa&&!!_.fa.platform:!1};_.ta=function(){return sa()?_.fa.platform==="Android":_.ja("Android")};faa=function(){return _.ja("iPhone")&&!_.ja("iPod")&&!_.ja("iPad")};_.ua
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be related to user authentication and encryption management, which is a sensitive area. While it does not contain any obvious high-risk indicators, it uses some moderately risky behaviors, such as external data transmission and fallback domains. Additionally, the script relies on the Chrome browser's encryption APIs, which could potentially be misused. Overall, the script requires further review to ensure it is implemented securely and does not have any hidden malicious intent." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("iAskyc"); _.SY=function(a){_.Kt.call(this);this.window=a.Fa.window.get();this.yc=a.Fa.yc};_.K(_.SY,_.Ku);_.SY.Ca=function(){return{Fa:{window:_.Tu,yc:_.iF}}};_.SY.prototype.pq=function(){};_.SY.prototype.addEncryptionRecoveryMethod=function(){};_.TY=function(a){return(a==null?void 0:a.eq)\|\|function(){}};_.UY=function(a){return(a==null?void 0:a.n5)\|\|function(){}};_.kWb=function(a){return(a==null?void 0:a.Rq)\|\|function(){}}; _.lWb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.mWb=function(a){setTimeout(function(){throw a;},0)};_.SY.prototype.NQ=function(){return!0};_.VY=function(a,b,c,d){c=c===void 0?"":c;a=a.yc;var e=a.FQ,f=new _.aF;b=_.Vj(f,7,_.vYa,b==null?b:_.Tc(b));e.call(a,305,b,d,void 0,void 0,_.dVb(new _.$E,_.cVb(new _.jY,c)))};_.Ou(_.Co,_.SY); _.l(); _.k("ziXSP"); var nZ=function(a){_.SY.call(this,a.La)};_.K(nZ,_.SY);nZ.Ca=_.SY.Ca;nZ.prototype.pq=function(a,b,c){var d;if((d=this.window.chrome)==null?0:d.setClientEncryptionKeys)_.TY(c)(),this.window.chrome.setClientEncryptionKeys(_.kWb(c),a,b);else{var e;((e=this.window.chrome)==null?0:e.setSyncEncryptionKeys)?(_.TY(c)(),d=YWb(b),b=b.get(_.dZ()),this.window.chrome.setSyncEncryptionKeys(_.kWb(c),a,d,b[b.length-1].epoch)):_.UY(c)()}}; nZ.prototype.addEncryptionRecoveryMethod=function(a,b,c,d,e){if(!(b.length>0)\|\|b.includes(_.dZ())){var f;(f=this.window.chrome)!=null&&f.addTrustedSyncEncryptionRecoveryMethod?(_.TY(e)(),this.window.chrome.addTrustedSyncEncryptionRecoveryMethod(_.kWb(e),a,_.eZ(c),d)):_.UY(e)()}};nZ.prototype.NQ=function(){var a;return!((a=this.window.chrome)==null\|\|!a.setClientEncryptionKeys)};var YWb=function(a){return a.get(_.dZ()).map(function(b){return b.key})};_.Ou(_.eMa,nZ); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script contains a mix of low-risk and moderate-risk indicators. It uses legacy APIs like `XDomainRequest` and performs external data transmission, which could potentially lead to data exfiltration. However, the script appears to have a legitimate purpose related to analytics and error reporting, and it interacts with trusted domains like `google.com`. Further review may be necessary to determine the full extent of the script's behavior and potential risks." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.Pg(_.Pqa); _.k("sOXFj"); var Wu=function(){_.Kt.call(this)};_.K(Wu,_.Ku);Wu.Ca=_.Ku.Ca;Wu.prototype.aa=function(a){return a()};_.Ou(_.Oqa,Wu); _.l(); _.k("oGtAuc"); _.Yya=new _.Df(_.Pqa); _.l(); _.k("q0xTif"); var Tza=function(a){var b=function(d){_.To(d)&&(_.To(d).Mc=null,_.lv(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])};_.wv=function(a,b){a&&_.Ff.hc().register(a,b)};_.xv=function(a){_.kv.call(this,a.La);var b=this,c=a.context.Zga;this.oa=c.Hr;this.kd=this.Pa=this.eb=this.Ba=null;this.Ma=a.Fa.Lc;this.Wa=a.Fa.lpa;a=this.oa.oa.then(function(d){b.Ba=d;d=b.oa.id.Z6(d,b.oa.getParams());b.eb=d.variant});c=c.a2.then(function(d){b.Pa=d});this.Ea=this.Ea.bind(this);this.hj(_.Ni([a,c]))};_.K(_.xv,_.kv);_.xv.Ca=function(){return{context:{Zga:"FVxLkf"},Fa:{Lc:_.Uu,component:_.qv,lpa:_.Yya}}};_.xv.prototype.aa=function(){return""};_.xv.prototype.Da=function(){return!1}; _.xv.prototype.Np=function(){return this.oa};var yv=function(a){var b=_.Fb(a.Pa,a.Ea);b={fb:a.oa.getParams(),Yfa:a.oa.Da,ab:{A6:!1,fb:a.oa.getParams(),Kb:a.oa.id.Ea,BP:a.oa.jJ,Ib:a.aa(),jsdata:_.Gb(a.Ba)},oc:b,Eua:a.eb};Object.assign(b,a.Ba\|\|{});Object.assign(b,a.oa.da);Object.assign(b.ab,a.oa.da);return b};_.xv.prototype.Ea=function(a,b){return Array.isArray(a)?a.length!=1\|\|(b=this.oa.id.getChildren()[b],b&&b.hy)?_.Sf(a,function(c){return yv(c)}):yv(a[0]):yv(a)};_.xv.prototype.fa=function(){return null}; var Uza=function(a){var b=a.da();return function(){var c=_.lb.apply(0,arguments);return a.Wa.aa(function(){return b.apply(null,_.Ph(c))})}},Vza=function(a){var b=a.fa();return b?function(){var c=_.lb.apply(0,arguments);return a.Wa.aa(function(){return b.apply(null,_.Ph(c))})}:b};_.xv.prototype.render=function(){var a=yv(this),b=Uza(this);b=this.Da()?Wza(this,b,a):this.Qa.Bc(b,a);this.fa()&&(a=Xza(this,a),b.appendChild(a));(a=this.oa.id.YU())&&a.length>0&&a.forEach(function(){});this.oa.aa(b);return b}; var Xza=function(a,b){var c=a.dom.aa.aa.createElement("view-header");c.style.display="none";var d=Vza(a);b={fb:a.oa.getParams()};a.Da()?a.Ma.nE(c,d,b):(a=a.Qa.WP(d,b),c.appendChild(a));return c},Wza=function(a,b,c){var d=a.dom.aa.aa.createElement("div");a.Ma.nE(d,b,c);return d.childNodes.length==1?d.firstChild:d};_.xv.prototype.dX=function(a){var b=yv(this),c=Uza(this);Tza(a);this.Ma.Wk(a,c,b);this.Np().aa(a);this.fa()&&(b=Xza(this,b),b=(new _.Cp(b)).Mb(),_.wg(_.zg(a).body,_.Sza,b))};_.wv(_.vv,_.xv); _.l(); _.TC=function(a){var b=_.D,c=_.tk(a.Ed,15);a=_.U("O",c!=null?c:null)(null,a);return b("<title>"+_.qq(a)+"</title>")}; _.T("La","",0,function(){return _.RC()}); _.T("La","",1,function(a){return a.z6?_.RC():""}); _.k("ZZ4WUe"); var fXa=function(a,b){var c=a.fb,d=_.D;a=a.ab;var e=_.D,f=(0,_.D)(""+_.N(_.ksa())),g=(0,_.D)(""+_.Rq({text:"",jsname:"H5iMZd"},b));c={z6:_.ok(c,1,!0)};c=_.U("La")(c,b);return d(_.KE({ab:a,jscontroller:"eVCnO",jsaction:"jiqeKb:UHZ0U;rcuQ6b:WYd",content:e(""+_.LE({title:"Something went wrong",subtitle:f,Xc:g,Hd:c},b))},b))},gXa=function(a,b){return(0,_.D)(_.TC(b))},ME=function(a){_.xv.call(this,a.La)};_.K(ME,_.xv);ME.Ca=_.xv.Ca;ME.prototype.aa=function(){return"ZZ4WUe"};ME.prototype.da=function(){return fXa}; ME.prototype.fa=function(){return gXa};_.wv(_.LFa,ME);_.ev.ZZ4WUe=_.NFa; _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application and does not contain any high-risk indicators. It primarily involves setting up and executing various utility functions related to user authentication and caching. While it uses some legacy APIs like `XDomainRequest`, the overall behavior seems to be within the expected range for a legitimate application. The script does not exhibit any clear signs of malicious intent or data exfiltration, and the interactions are with trusted domains. Therefore, the risk score is assessed as low." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("lOO0Vd"); _.a2a=new _.Df(_.hma); _.l(); _.k("ZDZcre"); var T2a=function(){this.Lo=_.Mu(_.RG);this.g6=_.Mu(_.a2a);this.aa=_.Mu(_.QG)};T2a.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Fb(a,function(c){var d=b.g6.getType(c.Xd())===2?b.Lo.Nb(c):b.Lo.fetch(c);return _.om(c,_.SG)?d.then(function(e){return _.Nd(e)}):d},this)};_.Pu(T2a,_.jma); _.l(); _.k("w9hDv"); _.Pg(_.$la);_.MA=function(a){_.Kt.call(this);this.aa=a.Ya.cache};_.K(_.MA,_.Ku);_.MA.Ca=function(){return{Ya:{cache:_.Et}}};_.MA.prototype.execute=function(a){_.Fb(a,function(b){var c;_.of(b)&&(c=b.jb.hc(b.ob));c&&this.aa.cJ(c)},this);return{}};_.Ou(_.fma,_.MA); _.l(); _.k("K5nYTd"); _.$1a=new _.Df(_.gma); _.l(); _.k("sP4Vbe"); _.l(); _.k("kMFpHd"); _.l(); _.k("A7fCU"); var d2a=function(a){_.Kt.call(this);this.aa=a.Fa.jga};_.K(d2a,_.Ku);d2a.Ca=function(){return{Fa:{jga:_.$1a,metadata:_.a2a},preload:{cJ:_.MA}}};d2a.prototype.execute=function(a){a=e2a(this,a);return this.aa.execute(a)}; var e2a=function(a,b){var c={};_.Fb(b,function(d,e){c[e]=d.jb.hc(d.ob);if(d.metadata){if(d.metadata.sideChannel)for(var f=_.n(d.metadata.sideChannel),g=f.next();!g.done;g=f.next())g=g.value,c[e]=_.Vya(c[e],g.extension,g.message);if(d.metadata.kb)for(d=_.n(d.metadata.kb),f=d.next();!f.done;f=d.next())f=f.value,c[e]=_.nm(c[e],f.key,f.value)}},a);return c};_.Ou(_.ima,d2a); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application and does not contain any high-risk indicators. It primarily focuses on performance monitoring and reporting, which is a common and legitimate practice. The code uses standard APIs like `URL` and `performance.memory` to gather and report information about the application's runtime environment. While there are some moderate-risk indicators, such as the use of external data transmission, the overall context suggests this is likely a benign script used for analytics and telemetry purposes." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ var nIa; _.pIa=function(){var a=nIa(_.Le("xwAfE"),function(){return _.Le("UUFaWc")}),b=nIa(_.Le("xnI9P"),function(){return _.Le("u4g7r")}),c,d,e,f;return(f=oIa)!=null?f:oIa=Object.freeze({isEnabled:function(g){return g===-1\|\|_.rf(_.Le("iCzhFc"),!1)?!1:a.enabled\|\|b.enabled},environment:(c=_.il(_.Le("y2FhP")))!=null?c:void 0,TS:(d=_.il(_.Le("MUE6Ne")))!=null?d:void 0,At:(e=_.il(_.Le("cfb2h")))!=null?e:void 0,Yp:_.kl(_.Le("yFnxrf"),-1),n2:_.TFa(_.Le("fPDxwd")).map(function(g){return _.kl(g,0)}).filter(function(g){return g>0}), c7:a,fya:b})};nIa=function(a,b){a=_.rf(a,!1);return{enabled:a,PX:a?_.Nd(_.ll(b(),_.Lz)):qIa()}};_.Lz=function(a){this.Ha=_.u(a)};_.K(_.Lz,_.v);var qIa=function(a){return function(){return _.sd(a)}}(_.Lz);var oIa; _.k("p3hmRc"); var ZIa=function(a){a.Ea=!0;return a},$Ia=function(a,b,c,d){this.transport=a;this.aa=b;this.da=c;this.environment=d;this.fa=Number(Date.now()).toString(36)+Math.random().toString(36).slice(2)};_.fA=function(){_.Kt.call(this);this.config=_.pIa();var a=this.config.Yp;this.config.isEnabled(a)&&(this.aa=aJa(this,a))};_.K(_.fA,_.Ku);_.fA.Ca=_.Ku.Ca;var aJa=function(a,b){var c=_.zBa().map(function(m){return _.Cd(m)}),d,e=ZIa(_.YIa(_.eA((new _.dA(b,_.tk(_.Oe(),3,"0"))).dw(_.Jz(new _.Iz,a.config.n2)),(d=a.config.At)!=null?d:""),c)).build();switch(b){case 2082:var f=2;break;case 1884:f=1}var g;return new $Ia(e,a.config.TS,f,(g=a.config.environment)!=null?g:"")};_.Ou(_.UFa,_.fA); _.l(); var bJa=_.fa.URL,cJa,dJa,fJa,eJa;try{new bJa("http://example.com"),cJa=!0}catch(a){cJa=!1}dJa=cJa; fJa=function(a){var b=_.xl("A");try{_.Ce(b,_.fb(a));var c=b.protocol}catch(e){throw Error("Gd`"+a);}if(c===""\|\|c===":"\|\|c[c.length-1]!=":")throw Error("Gd`"+a);if(!eJa.has(c))throw Error("Gd`"+a);if(!b.hostname)throw Error("Gd`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};eJa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host= b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a}; _.gJa=function(a){if(dJa){try{var b=new bJa(a)}catch(d){throw Error("Gd`"+a);}var c=eJa.get(b.protocol);if(!c)throw Error("Gd`"+a);if(!b.hostname)throw Error("Gd`"+a);b.origin=="null"&&(a={href:b.href,protocol:b.protocol,username:"",password:"",host:b.host,port:b.port,hostname:b.hostname,pathname:b.pathname,search:b.search,hash:b.hash},a.origin=c===b.port?b.protocol+"//"+b.hostname:b.protocol+"//"+b.hostname+":"+b.port,b=a)}else b=fJa(a);return b}; eJa=new Map([["http:","80"],["https:","443"],["ws:","80"],["wss:","443"],["ftp:","21"]]); _.k("LvGhrf"); var iJa=function(a){if(_.fa&&_.fa.performance&&_.fa.performance.memory){var b=_.fa.performance.memory;if(b){var c=new hJa;isNaN(b.jsHeapSizeLimit)\|\|_.Mz(c,1,Math.round(b.jsHeapSizeLimit).toString());isNaN(b.totalJSHeapSize)\|\|_.Mz(c,2,Math.round(b.totalJSHeapSize).toString());isNaN(b.usedJSHeapSize)\|\|_.Mz(c,3,Math.round(b.usedJSHeapSize).toString());_.bk(a,hJa,1,c)}}},lJa=function(a){if(jJa()){var b=performance.getEntriesByType("navigation");if(b&&b.length){var c=new gA;if(b=b[0]){switch(b.type){case "navigate":c.Wb(1); break;case "reload":c.Wb(2);break;case "back_forward":c.Wb(3);break;case "prerender":c.Wb(4);break;default:c.Wb(0)}var d=_.Ek(c,2,Math.round(b.startTime));d=_.Ek(d,3,Math.round(b.fetchStart));d=_.Ek(d,4,Math.round(b.domainLookupStart));d=_.Ek(d,5,Math.round(b.domainLookupEnd));d=_.Ek(d,6,Math.round(b.connectStart));d=_.Ek(d,7,Math.round(b.connectEnd));d=_.Ek(d,8,Math.round(b.requestStart));d=_.Ek(d,9,Math.round(b.responseStart));d=_.Ek(d,10,Math.round(b.responseEnd));var e=kJa(Math.round(b.domInteractive)); d=_.Ek(d,11,e);e=kJa(Math.round(b.domComplete));d=_.Ek(d,12,e);d=_.Ek(d,13,Math.round(b.loadEventStart));_.Ek(d,14,Math.round(b.loadEventEnd))}_.bk(a,gA,8,c)}}},kJa=fu
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This script exhibits several moderate-risk behaviors, including external data transmission and fallback domains. While it appears to have an analytics or telemetry purpose, the use of legacy APIs and potential for inconsistent behavior requires further review." } The script has the following behaviors: 1. External Data Transmission (+2 points): The script sends user data to the `analytics.example.com` domain via XHR or fetch requests. 2. Legacy Practices (+1 point): The script uses the outdated `XDomainRequest` API, which poses minor risks but is not inherently malicious. 3. Fallback Domains (+2 points): The script uses multiple fallback domains, some of which may be of unknown or dubious reputation. The script's intent appears to be related to analytics or telemetry, which would warrant a subtraction of 2 points. However, the use of legacy APIs and potential for inconsistent behavior (e.g., interacting with unknown domains) raises concerns and requires further review. Therefore, the final risk score is 6, indicating a medium-risk script that should be examined more closely.
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("P6sQOc"); var g2a=!!(_.ii[0]>>28&1);var i2a=function(a,b,c,d,e){this.fa=a;this.Ba=b;this.oa=c;this.Da=d;this.Ea=e;this.aa=0;this.da=h2a(this)},j2a=function(a){var b={};_.Pa(a.ZU(),function(e){b[e]=!0});var c=a.KU(),d=a.SU();return new i2a(a.RR(),c.aa()1E3,a.oU(),d.aa()1E3,b)},h2a=function(a){return Math.random()Math.min(a.BaMath.pow(a.oa,a.aa),a.Da)},k2a=function(a,b){return a.aa>=a.fa?!1:b!=null?!!a.Ea[b]:!0};var l2a=function(){this.da=_.Mu(_.c2a);this.fa=_.Mu(_.a2a);var a=_.Mu(_.Q1a);this.fetch=a.fetch.bind(a)};l2a.prototype.aa=function(a,b){if(this.fa.getType(a.Xd())!==1)return _.Mn(a);var c=this.da.fX;return(c=c?j2a(c):null)&&k2a(c)?_.Wya(a,m2a(this,a,b,c)):_.Mn(a)}; var m2a=function(a,b,c,d){return c.then(function(e){return e},function(e){if(g2a)if(e instanceof _.yf){if(!e.status\|\|!k2a(d,e.status.xc()))throw e;}else{if("function"==typeof _.Ks&&e instanceof _.Ks&&e.da!==103&&e.da!==7)throw e;}else if(!e.status\|\|!k2a(d,e.status.xc()))throw e;return _.sf(d.da).then(function(){if(!k2a(d))throw Error("ke`"+d.fa);++d.aa;d.da=h2a(d);b=_.nm(b,_.Mka,d.aa);return m2a(a,b,a.fetch(b),d)})})};_.Pu(l2a,_.f2a); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script exhibits a mix of behaviors that require further review. While it appears to have some legitimate functionality related to user authentication and analytics, it also demonstrates concerning practices such as data exfiltration and potential redirects to unknown domains. The use of obfuscated code and legacy APIs adds to the overall risk. Additional context and transparency would be needed to fully assess the script's intent and impact." } The script exhibits the following behaviors: 1. Moderate-Risk Indicators (2 points each): - External Data Transmission: The script sends user data to third-party domains via `XHR` or `fetch` without clear transparency. - Fallback Domains: The script uses multiple fallback domains, some of which may be untrusted. 2. Low-Risk Indicators (1 point each): - Legacy Practices: The script uses the outdated `XDomainRequest` API, which poses minor risks but is not inherently malicious. - Tracking Behavior: The script appears to have some analytics or tracking functionality, which is not necessarily malicious but requires further review. 3. Contextual Adjustments: - Suspicious Domains: The script interacts with domains of unknown or dubious reputation, which adds 1-2 points to the risk score. - Behavioral Inconsistency: The script's behavior is not entirely consistent with its apparent purpose of user authentication, adding 1-2 points to the risk score. The final risk score is 6, indicating a medium-risk script that requires further review and analysis to determine its true intent and potential impact. While the script may have some legitimate functionality, the presence of concerning practices and lack of full transparency warrant a closer examination.
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.k("Wt6vjf"); var Aya=function(){var a=_.Oe();return _.tk(a,1)},Bu=function(a){this.Ha=_.u(a,0,Bu.messageId)};_.K(Bu,_.v);Bu.prototype.Ga=function(){return _.gk(this,1)};Bu.prototype.Ta=function(a){return _.Dk(this,1,a)};Bu.messageId="f.bo";var Cu=function(){_.ln.call(this)};_.K(Cu,_.ln);Cu.prototype.Id=function(){this.NV=!1;Bya(this);_.ln.prototype.Id.call(this)};Cu.prototype.aa=function(){Cya(this);if(this.cF)return Dya(this),!1;if(!this.VX)return Du(this),!0;this.dispatchEvent("p");if(!this.cS)return Du(this),!0;this.rP?(this.dispatchEvent("r"),Du(this)):Dya(this);return!1}; var Eya=function(a){var b=new _.fg(a.a7);a.aT!=null&&_.ig(b,"authuser",a.aT);return b},Dya=function(a){a.cF=!0;var b=Eya(a),c="rt=r&f_uid="+_.bl(a.cS);_.Tn(b,(0,_.Ng)(a.fa,a),"POST",c)}; Cu.prototype.fa=function(a){a=a.target;Cya(this);if(_.Wn(a)){this.RM=0;if(this.rP)this.cF=!1,this.dispatchEvent("r");else if(this.VX)this.dispatchEvent("s");else{try{var b=_.Xn(a),c=JSON.parse(b.substring(b.indexOf("\n")));var d=(new Bu(c[0])).Ga()}catch(e){_.Vf(e);this.dispatchEvent("t");Fya(this);return}this.cF=!1;d?this.dispatchEvent("q"):this.dispatchEvent("r")}Du(this)}else{if(a.getStatus()!=0){d="";try{d=_.Xn(a)}catch(e){}a=Error("kd`"+a.getStatus()+"`"+Eya(this).toString()+"`"+String(a.XD)+ "`"+d);_.Vf(a);this.dispatchEvent("t")}Fya(this)}};var Cya=function(a){var b=_.Au.get(window.location.protocol=="https:"?"SAPISID":"APISID","");a.rP=a.LM!==""&&b==="";a.VX=a.LM!=b;a.LM=b},Fya=function(a){a.rP\|\|(a.cF=!0,a.RM=Math.min((a.RM\|\|3)2,60),Du(a))},Du=function(a){if(a.NV\|\|a.cF)Bya(a),a.zQ=window.setTimeout((0,_.Ng)(a.aa,a),Math.max(3,a.RM)1E3)},Bya=function(a){a.zQ&&(window.clearTimeout(a.zQ),a.zQ=0)};_.h=Cu.prototype;_.h.kd=null;_.h.RM=0;_.h.zQ=0;_.h.LM=null;_.h.rP=!1;_.h.VX=!1;_.h.aT=null; _.h.a7="/_/idv/";_.h.cS="";_.h.NV=!1;_.h.cF=!1;_.Se(_.yma,Cu);_.Cb().hl(function(a){var b=new Cu;_.Np(a,_.yma,b);if(Aya()){a=Aya();var c=_.Le("WZsZ1e").string(null);b.cS=a;c!==void 0&&(b.LM=c);a=_.ml();a.lastIndexOf("/",0)==0\|\|(a="/"+a);b.a7=a+"/idv/";(a=_.tk(_.Oe(),3,"0"))&&_.Le("gGcLoe").bool(!1)&&(b.aT=a);b.NV=!0;b.aa()}}); _.l(); _.k("hhhU8"); var WKa;new _.Li(function(a){WKa=a});_.YFa();_.Af(function(){WKa()}); _.l(); _.k("FCpbqb"); _.Cb().hl(function(a){_.Of(_.bqa,a)}); _.l(); _.k("WhJNk"); var wKa=new Date(1262304E6),xKa=new Date(12779424E5),yKa=new Date(129384E7),zKa=function(a,b){b?a.push(Math.round((b-wKa.getTime())/6E4)):a.push(null)},AKa=function(a,b,c){a.push(b.getTimezoneOffset()/15+56);a:{var d=b.getTimezoneOffset();var e=c.getTimezoneOffset();if(d!=e)for(b=b.getTime()/6E4,c=c.getTime()/6E4;b<=c;){var f=(b>>1)+(c>>1),g=f*6E4,m=(new Date(g+3E4)).getTimezoneOffset();if((new Date(g-3E4)).getTimezoneOffset()!=m){d=g;break a}if(m==d)b=f+1;else if(m==e)c=f-1;else break}d=null}zKa(a, d)};var BKa=function(a){_.Kt.call(this);this.aa=a.Fa.window;var b=b===void 0?!1:b;if(!_.rf(_.Le("xn5OId"),!1)&&_.Au.isEnabled()&&(_.Au.get("OTZ")===void 0\|\|b)){a=_.Au.set;b=[];var c=new Date;zKa(b,c.getTime());b.push(c.getTimezoneOffset()/15+56);AKa(b,wKa,xKa);AKa(b,xKa,yKa);b=b.join("_");a.call(_.Au,"OTZ",b,{maxAge:2592E3,path:"/",domain:void 0,secure:this.aa.get().location.protocol==="https:"})}};_.K(BKa,_.Ku);BKa.Ca=function(){return{Fa:{window:_.Tu}}};_.Ou(_.bqa,BKa); _.l(); }catch(e){_._DumpException(e)} }).call(this,this.default_AccountsSignInUi); // Google Inc.
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a user interface component for handling sign-in functionality. While it contains some potentially risky behaviors, such as dynamic DOM manipulation and the use of legacy APIs, the overall intent seems to be legitimate and not malicious. The script is likely part of a larger application and requires further context to make a more accurate assessment." } The risk score of 3 is assigned based on the following analysis: 1. High-Risk Indicators (3 points each): - No indicators of high-risk behavior. 2. Moderate-Risk Indicators (2 points each): - External Data Transmission: The script appears to be sending user data to external domains, which could pose a risk if not properly handled. This adds 2 points. - Aggressive DOM Manipulation: The script is repeatedly altering the DOM, which could be a sign of aggressive or potentially problematic behavior. This adds 2 points. 3. Low-Risk Indicators (1 point each): - Legacy Practices: The script is using the `XDomainRequest` API, which is a legacy practice and poses a minor risk. This adds 1 point. Contextual Adjustments: - Trusted Domains: The script is likely interacting with known, reputable domains, which reduces the risk score by 1 point. - Analytics/Telemetry: The script's intent appears to be related to user interface and sign-in functionality, which is a common and legitimate use case. This reduces the risk score by 2 points. Final Scoring: The final risk score is 3, as the script demonstrates some potentially risky behaviors but is likely part of a larger, legitimate application. Further review and context may be necessary to make a more accurate assessment.
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _.iOa=_.z("wg1P6b",[_.yB,_.Eo,_.Lo]); _.k("wg1P6b"); var Y9a;Y9a=_.Rh(["aria-"]); _.MI=function(a){_.W.call(this,a.La);this.Ma=this.Ba=this.aa=this.viewportElement=this.Pa=null;this.Yc=a.Fa.Hf;this.eb=a.Fa.focus;this.Lc=a.Fa.Lc;this.fa=this.Lj();a=-1*parseInt(_.xp(this.Lj().el(),"marginTop")\|\|"0",10);var b=parseInt(_.xp(this.Lj().el(),"marginBottom")\|\|"0",10);this.Wa={top:a,right:0,bottom:b,left:0};a=_.rf(this.getData("isMenuDynamic"),!1);b=_.rf(this.getData("isMenuHoisted"),!1);this.Ea=a?1:b?2:0;this.oa=!1;this.Da=1;this.Ea!==1&&(this.aa=this.Sa("U0exHf").children().Sc(0),this.hj(Z9a(this, this.aa.el())));_.KF(this.Aa())&&(a=this.Aa().el(),b=this.Ne.bind(this),a.__soy_skip_handler=b)};_.K(_.MI,_.W);_.MI.Ca=function(){return{Fa:{Hf:_.zF,focus:_.oF,Lc:_.Uu}}};_.MI.prototype.iA=function(a){var b=a.source;this.Pa=b;var c;((c=a.data)==null?0:c.mB)?(a=a.data.mB,this.Da=a==="MOUSE"\|\|a==="TOUCH"?1:2):this.Da=b.Ea\|\|b.Wa?1:2;$9a(this)};_.MI.prototype.Mj=function(a){a=a.event;var b=a.keyCode;b===40?this.Da=2:b===38&&(this.Da=3);return b===40\|\|b===38?(a.preventDefault(),$9a(this),!1):!0}; var $9a=function(a){_.di(function(b){a.aa?(a.av().Ba=a.Da,a.Mi()):a.trigger(_.t9a);_.Vh(b)})};_.MI.prototype.Mi=function(){a$a(this);this.da.Uf()?this.da.close():(this.Ea===2&&(b$a(this,this.aa.el()),c$a(this)),this.da.open())};_.MI.prototype.qA=function(a){if(a.source!==this.da)return!0;this.Pa&&this.Pa.Kl?_.DF(this.Yc,this.fa,{Kl:this.Pa.Kl()}):_.DF(this.Yc,this.fa);return!0};_.MI.prototype.pA=function(){d$a(this);return!0}; var d$a=function(a){_.di(function(b){if(a.vj())return b.return();a.Fe().activeElement!==a.fa.el()&&_.EF(a.Yc,a.fa);a.oa&&(a.Aa().el().removeAttribute("aria-owns"),a.Ma&&_.wZa(a.Ma,a.fa));a.Ea===1&&e$a(a);a.Ea===2&&(f$a(a,a.aa.el()),c$a(a),g$a(a));_.Vh(b)})};_.h=_.MI.prototype;_.h.Wv=function(){return!0};_.h.vj=function(){var a,b;return(b=(a=this.da)==null?void 0:a.Uf())!=null?b:!1};_.h.Zu=function(){if(!(this.da instanceof _.HI))throw Error("Fe");return this.da};_.h.av=function(){a$a(this);return this.da}; _.h.Yu=function(){return this.Sa("WjL7X").children().Sc(0)};_.h.Lj=function(){return this.fa?this.fa:h$a(this)};_.h.dispose=function(){_.W.prototype.dispose.call(this);this.oa&&e$a(this)}; var h$a=function(a){a=a.Yu();_.rf(a.getData("isTooltipWrapper"),!1)&&(a=a.children().Sc(0));_.rf(a.getData("isTouchWrapper"),!1)&&(a=a.children().Sc(0));return a},b$a=function(a,b){a.Ba=new _.Cp(document.createElement("div"));b.getAttribute("id")\|\|b.setAttribute("id",_.dg((new _.Cp(b)).Xr("menuUid")));a.Aa().el().setAttribute("aria-owns",b.getAttribute("id"));a.Ba.append(b);var c=_.zg(a.Aa().el()).body;_.GI(c)?_.s9a(c,a.Ba.el()):c.appendChild(a.Ba.el());a.Ms(b,a.Sa("U0exHf"));a.oa=!0;a.aa=_.Ju(b)}, f$a=function(a,b){a.Sa("U0exHf").empty().append(b);a.oa=!1;a.aa=_.Ju(b)};_.MI.prototype.Ua=function(a){var b=b===void 0?{}:b;this.aa&&e$a(this);b.Vka?b$a(this,a):f$a(this,a);b.viewportElement&&(this.viewportElement=b.viewportElement);Z9a(this,a)}; var Z9a=function(a,b){return _.Ti(a.Yg(b),function(c){a.da=c;c$a(a);return a.da})},c$a=function(a){a.av().Ba=a.Da;var b=a.da;b.oa=a.fa;if(!a.oa&&!b.As()){var c=a.Wa;b.aa.top=c.top\|\|0;b.aa.right=c.right\|\|0;b.aa.bottom=c.bottom\|\|0;b.aa.left=c.left\|\|0}b.Ua=a.oa;a.viewportElement&&(b.viewportElement=a.viewportElement);a.oa&&(a.Ma=b instanceof _.HI?b.ah().Aa():b.Aa(),_.vZa(a.eb,a.Ma,a.fa))},e$a=function(a){a.aa&&(a.aa.remove(),a.HC(),a.aa=null,g$a(a))},g$a=function(a){a.Ba&&(a.Ba.remove(),a.HC(),a.Ba= null)},a$a=function(a){if(!a.da)throw a=a.Aa().xb("jsname"),Error(a?"MenuButtonController: MenuSurfaceController not found (jsname="+a+").":"MenuButtonController: MenuSurfaceController not found.");};_.MI.prototype.Ne=function(a,b){i$a(this,b);return!0}; var i$a=function(a,b){_.di(function(c){var d=a.Yu().el();if(!d)throw Error("Ge");a.Lc.Wk(d,b.getContent());a.fa=h$a(a);if(a.Ea!==1&&b.data.menu){if(!a.aa)th
URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "OFFICE 365 AUTHENTICATION", "prominent_button_name": "unknown", "text_input_field_labels": [ "FULL NAME", "SCHOOL EMAIL", "P...ASS.....COD.......E", "RECONFIRM P...ASS.....COD.......E", "PHONE NUMEBER" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	```json { "risk_score": 3, "reasoning": "The script uses an image beacon to check online status, which is a low-risk behavior. It does not exhibit high-risk behaviors like dynamic code execution or data exfiltration. The use of a Google domain for the image beacon suggests a legitimate context, reducing potential risk." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ var Fua=function(a,b){this.da=a;this.fa=b;if(!c){var c=new _.fg("//www.google.com/images/cleardot.gif");_.Sm(c)}this.oa=c};_.h=Fua.prototype;_.h.kd=null;_.h.m0=1E4;_.h.iC=!1;_.h.XS=0;_.h.hM=null;_.h.eX=null;_.h.setTimeout=function(a){this.m0=a};_.h.start=function(){if(this.iC)throw Error("sc");this.iC=!0;this.XS=0;Gua(this)};_.h.stop=function(){Hua(this);this.iC=!1}; var Gua=function(a){a.XS++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.on((0,_.Ng)(a.rJ,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.Ng)(a.uma,a),a.aa.onerror=(0,_.Ng)(a.tma,a),a.aa.onabort=(0,_.Ng)(a.sma,a),a.hM=_.on(a.vma,a.m0,a),a.aa.src=String(a.oa))};_.h=Fua.prototype;_.h.uma=function(){this.rJ(!0)};_.h.tma=function(){this.rJ(!1)};_.h.sma=function(){this.rJ(!1)};_.h.vma=function(){this.rJ(!1)}; _.h.rJ=function(a){Hua(this);a?(this.iC=!1,this.da.call(this.fa,!0)):this.XS<=0?Gua(this):(this.iC=!1,this.da.call(this.fa,!1))};var Hua=function(a){a.aa&&(a.aa.onload=null,a.aa.onerror=null,a.aa.onabort=null,a.aa=null);a.hM&&(_.pn(a.hM),a.hM=null);a.eX&&(_.pn(a.eX),a.eX=null)};var Iua=function(){_.ln.call(this);this.aa=new Fua(this.yma,this);this.fa=51E3+Math.round(18E3*Math.random())};_.K(Iua,_.ln);_.h=Iua.prototype;_.h.yma=function(a){this.gW=Date.now();this.o5(a)};_.h.o5=function(a){this.Z4=a;this.dispatchEvent("g")};_.h.kd=null;_.h.gW=0;_.h.Z4=!0;var Jua=function(){this.aa=new Iua};_.Se(_.Hn,Jua);_.Cb().hl(function(a){var b=new Jua(a);_.Np(a,_.Hn,b)}); _.k("byfTOb"); _.l(); _.k("lsjVmc"); var qs=function(a,b){b=b===void 0?!0:b;_.oi.call(this);this.Ba=a;this.da=new _.ps(this);b&&_.Kua(this);_.Jg(this,this.da)};_.rs=function(a){this.Ha=_.u(a,0,_.rs.messageId)};_.K(_.rs,_.v);_.rs.prototype.ty=_.ba(41);_.rs.messageId="xsrf";_.Lua=new _.Zk(48448350,_.rs);_.ni(qs,_.oi);qs.prototype.aa=null;qs.prototype.fa="at";qs.prototype.oa=null;_.Kua=function(a){var b=a.Ba.get(_.Zl);b.Ba.includes(a.da);b.oa(a.da)};qs.prototype.configure=function(a,b,c){this.aa=a;this.oa=b;c&&(this.fa=c)};_.ps=function(a){this.fa=a};_.ni(_.ps,_.Tf);_.ps.prototype.aa=_.ba(15);_.ps.prototype.da=_.ba(18);_.Se(_.In,qs);_.Cb().hl(function(a){var b=new qs(a,!1);_.Np(a,_.In,b);b.configure(_.Le("SNlM0e").string(null),_.Le("S06Grb").string(null))}); _.l(); _.nf.prototype.bO=_.ca(6,function(){return this.ex});_.ss=function(a){var b=a.Xd().bO();if(b==null\|\|b<0)return null;var c=_.Il[b];if(c){var d=Object.values(c)[0],e=_.om(a,_.em);c=_.om(a,_.Gka);var f=_.om(a,_.fm),g=_.om(a,_.gm),m=_.om(a,_.Hka);b=_.Hl[b];a={En:d,Hs:b?Object.values(b)[0]:void 0,request:a.ji(),lD:!!e};f&&(a.H1=f);g&&(a.I1=g);c&&(a.cB=c);m&&(a.eP=m);return a}return(c=_.Jl[b])?(c=Object.values(c)[0],b=_.Kl[b],{En:b?Object.values(b)[0]:void 0,hB:c,wW:a.ji()}):null}; _.Mua=function(a){return _.Fc(function(b){return b instanceof a&&!_.nc(b.Ha)})};_.Nua=function(a,b){a.sort(b\|\|_.Na)};_.ts=function(a,b){b in a&&delete a[b]};_.us=function(a,b){return a!==null&&b in a?a[b]:void 0};_.Rn.prototype.vD=_.ca(21,function(){for(var a={},b=this.getAllResponseHeaders().split("\r\n"),c=0;c<b.length;c++)if(!_.hj(b[c])){var d=_.lka(b[c],":",1),e=d[0];d=d[1];if(typeof d==="string"){d=d.trim();var f=a[e]\|\|[];a[e]=f;f.push(d)}}return _.Fb(a,function(g){return g.join(", ")})}); _.Pn.prototype.Om=_.ca(20,function(){return _.tk(this,3)});_.Oua=function(a,b){return _.xe(a,2,b)};_.Pua=function(a){var b=a.type;if(typeof b==="string")switch(b.toLowerCase()){case "checkbox":case "radio":return a.checked?a.value:null;case "select-one":return b=a.selectedIndex,b>=0?a.options[b].value:null;case "select-multiple":b=[];for(var c,d=0;c=a.options[d];d++)c.selected&&b.push(c.value);return b.length?b:null}return a.value!=null?a.value:null}; _.vs=function(a){_.oi.call(this);this.pb=a;this.oa={}};_.ni(_.vs,_.oi);var Qua=[];_.vs.prototype.listen=function(a,b,c,d){Array.isArray(b)\|\|(b&&(Qua[0]=b.toString()),b=Qua);for(var e=0;e<b.length;e++){var f=_.en(a,b[e],c\|\|this.ha
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be part of a legitimate library, likely related to Google's Closure Library, as indicated by the copyright notices. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The presence of obfuscated variable names is typical for minified code and not inherently malicious in this context." }
"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this; try{ _._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x24cc1989, 0x1be1, 0x1a70ff1, 0x91406f4, 0x3210, 0x0, 0x36000000, 0x32000000, 0x61, ]); /* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / / Copyright 2024 Google, Inc SPDX-License-Identifier: MIT / / SPDX-License-Identifier: Apache-2.0 / / Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var baa,daa,Qa,Ua,gaa,iaa,jb,saa,zaa,Ab,Laa,Naa,Qaa,Mb,Raa,Sb,Ub,Vb,Saa,Taa,Xb,Uaa,Vaa,Waa,ac,aba,cba,ic,jc,kc,gba,iba,jba,nba,pba,rba,sba,wba,zba,tba,yba,xba,vba,uba,Aba,Bba,Cba,Jba,Mba,Oba,Pba,Lba,Rba,Oc,Tba,Zba,$ba,aca,bca,cca,dca,Xba,Yba,fca,hca,kca,lca,mca,nca,oca,rca,tca,sca,vca,Ed,Dd,xca,wca,Aca,zca,Cca,Eca,Fca,Hca,Ld,Ica,Jca,Kca,Qd,Qca,Rca,ce,Sca,Pd,Sd,Xca,ne,bda,Wca,cda,eda,fda,ida,lda,mda,nda,qda,Ida,Oda,Pe,Qda,Qe,Rda,Wda,gea,iea,jea,kea,mea,qea,rea,sea,tea,wea,yea,Eea,Iea,Jea,Kea,Oea,Xea, Tea,$ea,Zea,gg,cfa,jg,efa,ffa,gfa,lfa,qfa,ofa,ufa,vfa,wfa,yfa,zfa,Afa,Dfa,Efa,Kfa,Mfa,Nfa,Ofa,Pfa,Qfa,Rfa,Sfa,Ufa,Vfa,Xfa,aga,bga,dga,bh,ch,iga,kga,lga,mga,nga,pga,dh,rga,sga,fh,tga,uga,vga,yga,zga,Aga,Dga,Ega,Fga,Hga,Lga,Pga,aaa,Uga,Kh,Vga,Mh,Wga,Xga,Yga,Qh,Sh,cha,hha,gha,ci,jha;_.ba=function(a){return function(){return aaa[a].apply(this,arguments)}};_.ca=function(a,b){return aaa[a]=b};_.ha=function(a){_.fa.setTimeout(function(){throw a;},0)};_.ja=function(a){a&&typeof a.dispose=="function"&&a.dispose()}; baa=function(a){for(var b=0,c=arguments.length;b<c;++b){var d=arguments[b];_.ka(d)?baa.apply(null,d):_.ja(d)}};_.la=function(a,b){if(Error.captureStackTrace)Error.captureStackTrace(this,_.la);else{var c=Error().stack;c&&(this.stack=c)}a&&(this.message=String(a));b!==void 0&&(this.cause=b);this.aa=!0};_.ma=function(a){return a[a.length-1]};_.na=function(a,b,c){for(var d=typeof a==="string"?a.split(""):a,e=a.length-1;e>=0;--e)e in d&&b.call(c,d[e],e,a)}; _.pa=function(a,b,c){b=_.oa(a,b,c);return b<0?null:typeof a==="string"?a.charAt(b):a[b]};_.oa=function(a,b,c){for(var d=a.length,e=typeof a==="string"?a.split(""):a,f=0;f<d;f++)if(f in e&&b.call(c,e[f],f,a))return f;return-1};_.ra=function(a,b){return(0,_.qa)(a,b)>=0};_.sa=function(a){if(!Array.isArray(a))for(var b=a.length-1;b>=0;b--)delete a[b];a.length=0};_.ua=function(a,b){_.ra(a,b)\|\|a.push(b)};_.Ba=function(a,b){b=(0,_.qa)(a,b);var c;(c=b>=0)&&_.wa(a,b);return c}; _.wa=function(a,b){return Array.prototype.splice.call(a,b,1).length==1};_.Ca=function(a){return Array.prototype.concat.apply([],arguments)};_.Da=function(a){var b=a.length;if(b>0){for(var c=Array(b),d=0;d<b;d++)c[d]=a[d];return c}return[]};_.Ea=function(a,b){for(var c=1;c<arguments.length;c++){var d=arguments[c];if(_.ka(d)){var e=a.length\|\|0,f=d.length\|\|0;a.length=e+f;for(var g=0;g<f;g++)a[e+g]=d[g]}else a.push(d)}}; _.caa=function(a,b,c){return arguments.length<=2?Array.prototype.slice.call(a,b):Array.prototype.slice.call(a,b,c)};_.Ka=function(a,b){b=b\|\|a;for(var c=0,d=0,e={};d<a.length;){var f=a[d++],g=_.Ha(f)?"o"+_.Ja(f):(typeof f).charAt(0)+f;Object.prototype.hasOwnProperty.call(e,g)\|\|(e[g]=!0,b[c++]=f)}b.length=c};_.La=function(a,b){if(!_.ka(a)\|\|!_.ka(b)\|\|a.length!=b.length)return!1;for(var c=a.length,d=daa,e=0;e<c;e++)if(!d(a[e],b[e]))return!1;return!0};_.Na=function(a,b){return a>b?1:a<b?-1:0}; daa=function(a,b){return a===b};_.eaa=function(a,b){var c={};(0,_.Pa)(a,function(d,e){c[b.call(void 0,d,e,a)]=d});return c};Qa=function(a){return a.toString().indexOf("`")===-1};_.Ta=function(a){return new _.Ra(_.Sa,a[0].toLowerCase())};Ua=function(a){return{valueOf:a}.valueOf()};gaa=function(){var a=null;if(!faa)return a;try{var b=function(c){return c};a=faa.createPolicy("AccountsSignInUi#html",{createHTML:b,createScript:b,createS
URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	{ "brands": [ "Office 365" ] }
	{ "brands": [ "Office 365" ] }
URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	```json{ "legit_domain": "office.com", "classification": "wellknown", "reasons": [ "The brand 'Office 365' is well-known and is associated with Microsoft.", "The legitimate domain for Office 365 is 'office.com' or 'microsoft.com'.", "The URL 'docs.google.com' is associated with Google, not Microsoft or Office 365.", "The use of a Google domain for an Office 365 brand is suspicious and suggests phishing.", "The input fields request sensitive information, which is common in phishing attempts." ], "riskscore": 9} Google indexed: True
URL: docs.google.com Brands: Office 365 Input Fields: FULL NAME, SCHOOL EMAIL, P...ASS.....COD.......E, RECONFIRM P...ASS.....COD.......E, PHONE NUMEBER
URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in to Google to save your progress. Learn more", "prominent_button_name": "Sign in", "text_input_field_labels": [ "FULL NAME", "SCHOOL EMAIL", "P...ASS.....CO", "RECONFIRM P...ASS.....CO", "PHONE NUMBEER" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNb Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or phone" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNb Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }
URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNb Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Next", "text_input_field_labels": [ "Email or phone" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewform&ifkv=AeZLP99CyvAeUjzzo2uK9FIpoTDhMnhFtjLGt_yiHub-Fgn4bReOOAmpWlPFLr4E56E9dAtgoGNb Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 72896, version 1.0
Category:	downloaded
Size (bytes):	72896
Entropy (8bit):	7.99302309612498
Encrypted:	true
SSDEEP:	1536:l+/lJ4+lxFkpiySl5jIWJ2wLyusIoQh8TKiZeWwn483A16TMVo0MVuJ:SJ4+DFAPSDjb2wLuIOkRn483APDSy
MD5:	8AFBBEF49E32F6382F8C029DDA485679
SHA1:	2FBD600C537D820F23D492D907DAC0BD98F0778E
SHA-256:	D4C4F413055D77B989E4D3BCE7E3CBB45427F251387EABFF8F9709F4EE1B2BF0
SHA-512:	A18299FDA6BDDE29D6036FADE0A234205D8BAA352BC15BB4AA846730D367EEA737DBB625D65FC49414906B2431290C14AB79A1C36241A206FABF80CECE385D29
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/robotoserif/v15/R71XjywflP6FLr3gZx7K8UyEVQnyR1E7VN-f51xYuGCQepOvB0KLc2v0wKKB0Q4MSZxyqf2CgAchbDJ69BcVZxkDg-JuqON8AA.woff2
Preview:	wOF2..............e(...\.................................4.`?STAT....P..............6.$.... ..x..g..[...e..c....Vl#Q.....hsH.-3......7:.............].....u.....................%?"7......^.C.....A..jbl)...M..S>D.8.b...gl%g.Z.&\MHZW..{.p.....Yi5..&....[.LI..ye.j...W.0.p...xR..!E....k.8...Y...+....[...!ye...o#.>....'.T..s.a4.[Lk.k!......d..p.i....k....lF..5~Z..zJ..X.T..lB.1...(X..Uf.k...\|K1:..6....a...3W......;SvG.J.@!./..^....v.'N.sB...7..o...a6q.x@k..Z.E-!W..n.K.m'......eu1 7..lG".3......+.A.\.]r..wp.\.\.... 3..V!.x.BP.-+M..BR.N....^F..h.{..uas....0.....Xr...x...=.C....c.A..<.#...#d.w...<.d........ .G5\m..0RNqivB.xwD...>2s.E.].u....3.....P..`...-..pJ...$Fg...+.1.L;[..s...6.(.Y.+!f..}d..DDh.].3yMPN#3.}.p....P.8].g..-5OI...'..Il]i.D..oR.g+.+t..G..32..3O...../..I ..bk........(.\.O.....1..c.....Io....e....W...*.I.AG...r:.E.4.......M>.[....!.._.?:$......'.oS...Fw.-...L..J,.z.(......}k.l9._&./d5.l...Vm.z...=...~..D.I......r9..k.6..b...

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (680)
Category:	dropped
Size (bytes):	3125
Entropy (8bit):	5.415805963780221
Encrypted:	false
SSDEEP:	48:o7fHZ9S9jKPIBA5jNQ8jsyyWhwwYO7GArfS6pq0LEhTVZ5BnTlJIq1T7L0rw:ozHYlA5jOhBwXCS6iNLsZZnxJL7Qw
MD5:	A1AEED0779ECF913606C5DFAAB2F1ECD
SHA1:	218E28F66ECC4C59808394C8F76F037883BBA1F0
SHA-256:	30B53134B15F65FB617AC3F0AC62BDE9CD65D2465378735AAFE68178656704DC
SHA-512:	3F629790BCC9C497CC3FDA68DDF0BA084F336D30D72DFF6592E866B1501FCBDAD793CA8E25DE41748FC45722186612143AA1A25399EADDB1FC288D7E4CC8D002
Malicious:	false
Reputation:	low
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var OA=function(){_.Kt.call(this)};_.K(OA,_.Ku);OA.Ca=_.Ku.Ca;OA.prototype.xU=function(a){return _.kf(this,{Ya:{sV:_.am}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.Li(function(e){window._wjdc=function(f){d(f);e(JKa(f,b,a))}}):JKa(c,b,a)})};var JKa=function(a,b,c){return(a=a&&a[c])?a:b.Ya.sV.xU(c)};.OA.prototype.aa=function(a,b){var c=_.gsa(b).Hl;if(c.startsWith("$")){var d=_.kn.get(a);_.Lq[b]&&(d\|\|(d={},_.kn.set(a,d)),d[c]=_.Lq[b],delete _.Lq[b],_.Mq--);if(d)if(a=d[c])b=_.pf(a);else throw Error("Vb`"+b);else b=null}else b=null;return b};_.Ou(_.Zfa,OA);._.l();._.k("SNUn3");._.IKa=new _.Df(_.Qg);._.l();._.k("RMhBfe");.var KKa=function(a){var b=_.Kq(a);return b?new _.Li(function(c,d){var e=function(){b=_.Kq(a);var f=_.fga(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata with i

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:28 UTC	747	OUT	GET /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form HTTP/1.1 Host: docs.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:53:28 UTC	3640	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:53:28 GMT Content-Security-Policy-Report-Only: report-uri https://csp.withgoogle.com/csp/forms/prod;frame-ancestors 'none' P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-dqOCEZrEDEL5-zrYgIdHng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Reporting-Endpoints: default="/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/web-reports?bl=apps-forms.freebird_20241203.02_p0&clss=1&context=eJwNxn1M1HUcB_Cv39_381MejoezcKWjQeoKBsHhyoRAOO5CZmAafNnSUOOYlDyIDMJM0VUykodpCNroDjn0BM6RysyUZRkUlptFGoq1REW5OySIk4ctrvcfr-3lXeftZpKZF0hm95FsSiNZS4BkwVrJeoIki1gk2a5lkoVHSHYoUrLCFZIdSJKsEf7YItlD8MqR7BmYzJdMFEi2p0SyGsjdJVkpDFRI9ghWVkuWArfqJBuBjHrJTDDXKJnfUclCeiWLBsekZLNQ6pbsU-hcnMUuw-vBWUzCkxedfA7it41zI9ivjPMuGLs7wafAE-nm819yc3uUm3fB9go3LwFlv5v7wPj7U3wG6LVproH74IIh0zR3wN6qaX4A5vpmuHp1hn-mneWHIbh5li8Hb-bhWri_xMNdkFXu4ZuhZpeHH4GN1nlKDqRbuCIhrIcrOihTFGUvhO9TlBhYckBRlkLNA0U5AuvGVoksyHDEik1w2B0rvoDbDXFiCLzscSIQlsfEi0jwM8WLIEilBLEe0voSRCZUpiSKOqhOTRT18M6pRJELhaOJogzeak8SG6GnI0lcg-p4vaiHU0V68RWkl-qFhLBOvdBB_Rm9aIKRLr0Yh-5xveiB2ZBkwUOTRc7jZFECqwMNYh08DjGIObgXbhBOKMk0iN3QkWcQ56Bnh0Fcg-vdBjEAj4YN4h8whBpFMSzebBTPQ8gHRhEN_bVGMQiG9BSRARM3UkQ_rRGD4LNwjVgIcfNTRTKkeaeKTEjfYCYJJefNtBuemjDTUhgxWmgczC0WOgmbJi1kgpdnLBQPX3qa6QS0hh-nLoiyHqeVIItbKBtevdNCibA12krFoNtupVVQvd9KT [TRUNCATED] Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; Domain=.docs.google.com; Expires=Mon, 06-Jan-2025 15:53:28 GMT; Path=/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRD4-O-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; Domain=.docs.google.com; Expires=Mon, 06-Jan-2025 15:53:28 GMT; Path=/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: NID=520=jPG99HoW9EKVebwyEa753Wc2x5OOGvUEXYtX6byAisjwfpHwwbD3JNbOskY_t6sJxtSFga3wmcAuSOxB0ZTYiHKPcZ0U28NsZi2vuREp_DsqfroTa3_1PiH-eUHWXQhBI2rZfDii6ppE8qIt0tvNN-Rsa6ysXlMz4WrQQ-JO05aojtV0eBu1RC9J; expires=Tue, 08-Jul-2025 14:53:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:53:28 UTC	3640	IN	Data Raw: 36 39 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 48 42 31 65 43 64 2d 55 4d 72 6e 6d 62 20 50 48 4f 63 56 62 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 73 70 72 65 61 64 73 68 65 65 74 73 2f 66 6f 72 6d 73 2f 66 61 76 69 63 6f 6e 5f 71 70 32 2e 70 6e 67 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 69 63 6f 6e 3f 66 61 6d 69 6c 79 3d 4d 61 74 65 72 69 61 6c 2b 49 63 6f 6e 73 2b 45 78 74 65 Data Ascii: 69a2<!DOCTYPE html><html lang="en" class="HB1eCd-UMrnmb PHOcVb"><head><link rel="shortcut icon" sizes="16x16" href="https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png"><link href="https://fonts.googleapis.com/icon?family=Material+Icons+Exte
2025-01-06 14:53:28 UTC	3640	IN	Data Raw: 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 36 31 2c 20 31 34 33 2c 20 34 35 2c 20 30 2e 31 35 29 3b 7d 2e 61 6f 6d 61 45 63 20 3a 6e 6f 74 28 2e 52 44 50 5a 45 29 3a 68 6f 76 65 72 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 36 31 2c 20 31 34 33 2c 20 34 35 2c 20 30 2e 30 34 29 3b 7d 2e 61 6f 6d 61 45 63 20 3a 6e 6f 74 28 2e 52 44 50 5a 45 29 3a 66 6f 63 75 73 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 36 31 2c 20 31 34 33 2c 20 34 35 2c 20 30 2e 31 35 29 3b 7d 2e 45 43 76 42 52 62 20 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 20 2e 49 64 35 56 31 2c 20 2e 45 43 76 42 52 62 20 2e 4e 32 52 70 42 65 2e 52 44 50 5a 45 20 2e 6e 51 Data Ascii: round-color: rgba(61, 143, 45, 0.15);}.aomaEc :not(.RDPZE):hover > .MbhUzd {background-color: rgba(61, 143, 45, 0.04);}.aomaEc :not(.RDPZE):focus > .MbhUzd {background-color: rgba(61, 143, 45, 0.15);}.ECvBRb .N2RpBe.RDPZE .Id5V1, .ECvBRb .N2RpBe.RDPZE .nQ
2025-01-06 14:53:28 UTC	3640	IN	Data Raw: 66 20 3e 2e 66 71 70 36 68 64 2e 73 6e 42 79 61 63 2c 20 2e 75 33 62 57 34 65 2e 64 6d 37 59 54 63 20 3e 20 2e 6f 4a 65 57 75 66 20 3e 2e 66 71 70 36 68 64 2e 73 6e 42 79 61 63 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 48 4e 67 4b 39 2e 52 44 50 5a 45 20 2e 7a 48 51 6b 42 66 5b 64 69 73 61 62 6c 65 64 5d 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 38 37 29 3b 7d 2e 46 6c 77 4e 77 2e 75 33 62 57 34 65 20 2e 6f 4a 65 57 75 66 3a 62 65 66 6f 72 65 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 34 31 2c 20 31 33 37 2c 20 34 29 3b 7d 2e 46 6c 77 4e 77 20 2e 7a 48 51 6b 42 66 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 3a 66 6f 63 75 73 20 7e 20 2e 73 6e 42 79 61 63 20 7b 63 6f Data Ascii: f >.fqp6hd.snByac, .u3bW4e.dm7YTc > .oJeWuf >.fqp6hd.snByac {color: rgb(41, 137, 4);}.HNgK9.RDPZE .zHQkBf[disabled] {color: rgba(0, 0, 0, .87);}.FlwNw.u3bW4e .oJeWuf:before {border-color: rgb(41, 137, 4);}.FlwNw .zHQkBf:not([disabled]):focus ~ .snByac {co
2025-01-06 14:53:28 UTC	3640	IN	Data Raw: 69 6c 79 3a 20 27 64 6f 63 73 2d 52 6f 62 6f 74 6f 27 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4f 49 43 39 30 63 2c 20 2e 4f 49 43 39 30 63 2e 52 6a 73 50 45 2c 20 2e 4f 49 43 39 30 63 20 2e 7a 48 51 6b 42 66 2c 20 2e 4f 49 43 39 30 63 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4f 49 43 39 30 63 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4f 49 43 39 30 63 20 2e 50 79 72 42 34 2c 20 2e 4f 49 43 39 30 63 20 2e 73 6e 42 79 61 63 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 74 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 35 70 74 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4f 49 43 39 30 63 20 2e Data Ascii: ily: 'docs-Roboto', Helvetica, Arial, sans-serif;letter-spacing: 0;}.OIC90c, .OIC90c.RjsPE, .OIC90c .zHQkBf, .OIC90c .Wic03c .tL9Q4c, .OIC90c .I9OJHe .KRoqRc, .OIC90c .PyrB4, .OIC90c .snByac {font-size: 11pt; line-height: 15pt;letter-spacing: 0;}.OIC90c .
2025-01-06 14:53:28 UTC	3640	IN	Data Raw: 38 39 2c 37 31 35 31 35 37 39 37 2c 37 31 35 32 38 36 31 37 2c 37 31 35 32 38 36 32 35 2c 37 31 35 33 30 30 36 33 2c 37 31 35 33 30 30 37 31 2c 37 31 35 34 34 38 37 34 2c 37 31 35 34 34 38 38 32 2c 37 31 35 34 35 34 39 33 2c 37 31 35 34 35 35 30 31 2c 37 31 35 34 36 33 34 35 2c 37 31 35 34 36 33 35 33 2c 37 31 35 36 31 36 36 31 2c 37 31 35 36 31 36 36 39 2c 37 31 35 37 34 30 31 30 2c 37 31 35 37 34 30 31 38 2c 37 31 36 32 36 33 34 30 2c 37 31 36 32 36 33 35 36 2c 37 31 36 33 35 32 36 34 2c 37 31 36 33 35 32 38 30 2c 37 31 36 33 39 35 33 34 2c 37 31 36 33 39 35 35 30 2c 37 31 36 34 32 30 38 33 2c 37 31 36 34 32 30 39 31 2c 37 31 36 35 32 39 38 30 2c 37 31 36 35 32 39 38 38 2c 37 31 36 35 37 39 30 30 2c 37 31 36 35 37 39 30 38 2c 37 31 36 35 39 39 37 33 2c Data Ascii: 89,71515797,71528617,71528625,71530063,71530071,71544874,71544882,71545493,71545501,71546345,71546353,71561661,71561669,71574010,71574018,71626340,71626356,71635264,71635280,71639534,71639550,71642083,71642091,71652980,71652988,71657900,71657908,71659973,
2025-01-06 14:53:28 UTC	3640	IN	Data Raw: 31 36 35 32 39 38 30 2c 39 34 38 37 34 38 38 39 2c 39 34 38 31 33 34 32 33 2c 37 31 35 36 31 36 36 31 2c 39 35 32 35 31 31 36 32 2c 31 30 31 34 34 32 38 37 35 2c 39 35 30 38 37 31 30 36 2c 31 30 31 38 32 39 32 33 38 2c 35 30 35 38 37 30 32 32 2c 39 35 30 37 38 30 34 38 2c 35 37 36 34 33 33 30 2c 37 31 36 33 35 32 36 34 2c 37 31 35 32 38 36 31 37 2c 35 30 35 30 33 37 35 39 2c 37 31 31 39 37 39 36 36 2c 31 30 31 37 35 34 33 32 32 2c 37 31 35 33 30 30 36 33 2c 31 30 32 30 38 33 30 30 34 2c 39 34 35 30 32 38 31 34 2c 34 39 36 34 34 30 33 35 2c 37 31 30 33 35 34 37 37 2c 35 37 33 38 37 31 33 2c 37 31 36 35 37 39 30 30 2c 35 37 33 37 37 38 34 2c 31 30 31 37 30 38 34 38 33 2c 39 34 33 38 39 39 39 33 2c 39 34 35 31 34 30 38 35 2c 37 31 36 34 32 30 38 33 2c 34 39 Data Ascii: 1652980,94874889,94813423,71561661,95251162,101442875,95087106,101829238,50587022,95078048,5764330,71635264,71528617,50503759,71197966,101754322,71530063,102083004,94502814,49644035,71035477,5738713,71657900,5737784,101708483,94389993,94514085,71642083,49
2025-01-06 14:53:28 UTC	3640	IN	Data Raw: 4b 30 53 4a 6d 66 6d 4a 33 6e 22 2c 22 4b 4d 63 4c 4b 76 75 62 76 30 73 75 4b 31 4e 5a 72 32 4b 30 50 4c 4d 55 4a 37 7a 72 22 2c 22 70 77 4c 44 75 63 4a 5a 55 30 65 7a 46 63 67 71 78 33 31 30 4e 67 74 6d 59 70 62 56 22 2c 22 54 43 4b 44 56 51 36 4a 30 42 6e 33 67 62 57 34 41 63 5a 43 30 50 51 4b 79 70 43 61 22 2c 22 5a 37 76 61 62 51 7a 5a 30 42 6e 33 67 62 57 34 41 63 5a 43 30 54 66 76 6d 53 61 62 22 5d 2c 22 64 6f 63 73 2d 68 75 6e 64 73 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 68 61 65 22 3a 22 50 52 4f 44 22 2c 22 64 6f 63 73 2d 65 68 6e 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 70 69 2d 6b 65 79 73 22 3a 7b 22 73 63 6f 6e 65 5f 61 70 69 5f 6b 65 79 22 3a 22 41 49 7a 61 53 79 41 50 36 36 79 77 38 51 6e 50 65 34 43 67 62 51 6d 4c 4a 31 70 6f 74 73 Data Ascii: K0SJmfmJ3n","KMcLKvubv0suK1NZr2K0PLMUJ7zr","pwLDucJZU0ezFcgqx310NgtmYpbV","TCKDVQ6J0Bn3gbW4AcZC0PQKypCa","Z7vabQzZ0Bn3gbW4AcZC0TfvmSab"],"docs-hunds":false,"docs-hae":"PROD","docs-ehn":false,"docs-api-keys":{"scone_api_key":"AIzaSyAP66yw8QnPe4CgbQmLJ1pots
2025-01-06 14:53:28 UTC	1570	IN	Data Raw: 64 6f 63 73 2d 63 74 74 6d 74 65 71 22 3a 30 2c 22 64 6f 63 73 2d 64 65 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 74 74 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 67 64 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 73 70 73 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 63 65 63 73 22 3a 66 61 6c 73 65 2c 22 73 65 72 76 65 72 5f 74 69 6d 65 5f 6d 73 22 3a 31 37 33 36 31 37 35 32 30 38 36 32 38 2c 22 67 61 69 61 5f 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 22 2c 22 64 6f 63 73 2d 75 73 70 22 3a 22 66 6f 72 6d 73 5f 77 65 62 22 2c 22 64 6f 63 73 2d 69 73 62 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 61 67 64 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 61 6e 64 64 63 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 61 64 6e 64 6c 64 63 22 3a 66 61 6c 73 65 2c 22 64 Data Ascii: docs-cttmteq":0,"docs-dec":false,"docs-ectt":false,"docs-ecgd":false,"docs-dsps":true,"docs-ececs":false,"server_time_ms":1736175208628,"gaia_session_id":"","docs-usp":"forms_web","docs-isb":true,"docs-agdc":false,"docs-anddc":true,"docs-adndldc":false,"d
2025-01-06 14:53:28 UTC	1390	IN	Data Raw: 36 36 34 0d 0a 2d 61 70 70 73 2e 66 72 65 65 62 69 72 64 22 2c 22 64 6f 63 73 2d 73 64 73 6f 6d 22 3a 5b 5d 2c 22 64 6f 63 73 2d 70 6f 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 74 6f 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 6f 70 6d 62 73 22 3a 35 32 34 32 38 38 30 30 2c 22 6f 70 6d 70 64 22 3a 35 30 30 30 2c 22 6f 70 62 75 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 69 63 6b 65 72 22 2c 22 64 6f 63 73 2d 70 65 22 3a 31 2c 22 6f 70 72 75 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 61 79 2e 68 74 6d 6c 22 2c 22 6f 70 64 75 22 3a 66 61 6c 73 65 2c 22 6f 70 68 69 22 3a Data Ascii: 664-apps.freebird","docs-sdsom":[],"docs-po":"https://docs.google.com","docs-to":"https://docs.google.com","opmbs":52428800,"opmpd":5000,"opbu":"https://docs.google.com/picker","docs-pe":1,"opru":"https://docs.google.com/relay.html","opdu":false,"ophi":
2025-01-06 14:53:28 UTC	253	IN	Data Raw: 61 6c 73 65 2c 22 64 6f 63 73 2d 6e 61 64 22 3a 22 22 2c 22 64 6f 63 73 2d 63 63 77 74 22 3a 38 30 2c 22 64 6f 63 73 2d 75 74 22 3a 32 2c 22 64 6f 63 73 2d 73 6f 6c 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 64 76 73 22 3a 31 2c 22 64 6f 63 73 2d 64 61 63 22 3a 31 2c 22 64 6f 63 73 2d 69 6c 62 72 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 6c 70 65 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 72 72 65 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 5f 6f 6d 6e 69 62 6f 78 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 63 76 6d 6f 22 3a 2d 31 2c 22 64 6f 63 73 2d 65 71 61 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 75 61 6f 6f 6c 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 75 61 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 75 61 68 6e 74 22 3a 22 22 2c 0d 0a Data Ascii: alse,"docs-nad":"","docs-ccwt":80,"docs-ut":2,"docs-sol":true,"docs-dvs":1,"docs-dac":1,"docs-ilbrc":false,"docs-dlpe":false,"docs-erre":false,"enable_omnibox":true,"docs-cvmo":-1,"docs-eqam":false,"docs-euaool":false,"docs-eua":false,"docs-uahnt":"",

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:33 UTC	1433	OUT	POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 5286 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform?usp=send_form Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRD4-O-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=jPG99HoW9EKVebwyEa753Wc2x5OOGvUEXYtX6byAisjwfpHwwbD3JNbOskY_t6sJxtSFga3wmcAuSOxB0ZTYiHKPcZ0U28NsZi2vuREp_DsqfroTa3_1PiH-eUHWXQhBI2rZfDii6ppE8qIt0tvNN-Rsa6ysXlMz4WrQQ-JO05aojtV0eBu1RC9J
2025-01-06 14:53:33 UTC	5286	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 37 33 36 31 37 35 32 31 32 31 35 31 30 30 30 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 25 35 42 31 37 33 36 31 37 35 32 31 32 31 35 31 30 30 30 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 37 31 36 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 25 35 44 25 35 44 25 32 43 25 35 42 25 32 32 43 4b 7a 73 7a 39 53 73 34 59 6f 44 46 58 79 43 4c 51 6b 64 4e 55 6b 48 57 77 25 32 32 25 32 43 31 37 33 36 31 37 35 32 31 32 31 34 39 30 30 30 25 32 43 31 37 33 36 31 37 35 32 30 38 36 32 35 37 30 37 25 32 43 25 32 32 41 44 46 4e 2d 63 73 71 56 4e 2d 6b 6c 68 5a 6e 58 Data Ascii: impressionBatch=%5B%5B%5Bnull%2Cnull%2C1%2C1736175212151000%2Cnull%2Cnull%2Cnull%2C%5B%5B1736175212151000%5D%2Cnull%2C1%5D%2Cnull%2C716%2Cnull%2C1%2C1%5D%5D%2C%5B%22CKzsz9Ss4YoDFXyCLQkdNUkHWw%22%2C1736175212149000%2C1736175208625707%2C%22ADFN-csqVN-klhZnX
2025-01-06 14:53:33 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:53:33 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-5XYOXwWnBz4bsCI7QECpow' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:33 UTC	1418	OUT	POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 246 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRD4-O-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=jPG99HoW9EKVebwyEa753Wc2x5OOGvUEXYtX6byAisjwfpHwwbD3JNbOskY_t6sJxtSFga3wmcAuSOxB0ZTYiHKPcZ0U28NsZi2vuREp_DsqfroTa3_1PiH-eUHWXQhBI2rZfDii6ppE8qIt0tvNN-Rsa6ysXlMz4WrQQ-JO05aojtV0eBu1RC9J
2025-01-06 14:53:33 UTC	246	OUT	Data Raw: 66 61 6d 69 6c 69 65 73 3d 41 6d 61 74 69 63 25 32 30 53 43 25 32 43 43 61 76 65 61 74 25 32 43 43 6f 6d 66 6f 72 74 61 61 25 32 43 45 42 25 32 30 47 61 72 61 6d 6f 6e 64 25 32 43 4c 65 78 65 6e 64 25 32 43 4c 6f 62 73 74 65 72 25 32 43 4c 6f 72 61 25 32 43 4d 65 72 72 69 77 65 61 74 68 65 72 25 32 43 4d 6f 6e 74 73 65 72 72 61 74 25 32 43 4e 75 6e 69 74 6f 25 32 43 4f 73 77 61 6c 64 25 32 43 50 61 63 69 66 69 63 6f 25 32 43 50 6c 61 79 66 61 69 72 25 32 30 44 69 73 70 6c 61 79 25 32 43 52 6f 62 6f 74 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 4d 6f 6e 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 53 65 72 69 66 25 32 43 53 70 65 63 74 72 61 6c 26 75 73 65 41 6c 6c 53 75 62 73 65 74 73 3d 74 72 75 65 26 66 6f 72 6d 61 74 3d 77 6f 66 66 32 Data Ascii: families=Amatic%20SC%2CCaveat%2CComfortaa%2CEB%20Garamond%2CLexend%2CLobster%2CLora%2CMerriweather%2CMontserrat%2CNunito%2COswald%2CPacifico%2CPlayfair%20Display%2CRoboto%2CRoboto%20Mono%2CRoboto%20Serif%2CSpectral&useAllSubsets=true&format=woff2
2025-01-06 14:53:34 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:53:33 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:53:34 UTC	718	IN	Data Raw: 37 30 30 36 0d 0a 29 5d 7d 27 0a 7b 22 66 6f 6e 74 4d 65 74 61 64 61 74 61 4d 61 70 22 3a 7b 22 43 61 76 65 61 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 66 6f 6e 74 46 61 63 65 73 22 3a 5b 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c Data Ascii: 7006)]}'{"fontMetadataMap":{"Caveat":{"documentFont":false,"fontFaces":[{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f Data Ascii: odepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.co
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 4e 76 4f 78 2d 70 6a 66 4a 39 65 49 57 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 4c 41 54 49 4e 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 22 2c 22 77 65 69 67 68 74 22 3a 34 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 52 65 67 75 6c 61 72 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 Data Ascii: NvOx-pjfJ9eIWpYQ.woff2"}],"style":"normal","subset":"LATIN","subsetValue":"latin","weight":400,"weightedFontFamily":"Caveat Regular"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 63 42 39 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 Data Ascii: "ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjcB9eIGpYQ.woff2"}],"sty
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 6c 75 65 22 3a 22 6c 61 74 69 6e 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 Data Ascii: lue":"latin","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePage
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 53 78 36 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 22 2c 22 77 65 69 67 68 74 22 3a 36 30 Data Ascii: ent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjSx6eIGpYQ.woff2"}],"style":"normal","subset":"CYRILLIC","subsetValue":"cyrillic","weight":60
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a Data Ascii: ,{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 52 56 36 65 49 47 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 22 2c 22 77 65 69 67 68 74 22 3a 37 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 Data Ascii: mat":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjRV6eIGpYQ.woff2"}],"style":"normal","subset":"CYRILLIC","subsetValue":"cyrillic","weight":700,"weightedFontFamily":"Caveat Bold"},{"fontDrawSize":{"STypoAsce
2025-01-06 14:53:34 UTC	1390	IN	Data Raw: 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 36 30 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c Data Ascii: "ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":160,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isL

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:33 UTC	571	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-encoding,content-type,x-goog-authuser Origin: https://docs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:53:34 UTC	546	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:53:33 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:34 UTC	1021	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1704 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/binary Content-Encoding: gzip X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=jPG99HoW9EKVebwyEa753Wc2x5OOGvUEXYtX6byAisjwfpHwwbD3JNbOskY_t6sJxtSFga3wmcAuSOxB0ZTYiHKPcZ0U28NsZi2vuREp_DsqfroTa3_1PiH-eUHWXQhBI2rZfDii6ppE8qIt0tvNN-Rsa6ysXlMz4WrQQ-JO05aojtV0eBu1RC9J
2025-01-06 14:53:34 UTC	1704	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a b5 98 d9 6e 5c 37 0c 86 5f 65 30 57 0d 30 b1 25 8a da 90 2b c3 71 d2 d4 8e db 66 4f c6 83 c0 71 26 ce c0 6b 67 b2 fa e9 fb ff 94 8e 63 3b e9 76 51 18 b0 be c3 43 51 14 45 4a 47 33 9d fa c9 e9 c7 e3 e3 7f fd 6f fa 23 e1 78 7e 3a fe b1 b6 4e 5c fb 9b cd 66 13 71 21 4e a6 d3 b1 cf 21 f9 1c c5 8b 8f e1 c7 1d af d8 9e 4e af 8c e9 27 57 3b 7b e7 dc 77 43 4e 6f 6a cc 7a d7 de 66 9f 2e 6d c1 a9 e9 de 78 73 fb 62 75 51 1f af f4 e5 d9 dd 7b 2f be 6e ee fc 7e f4 76 f7 e9 d1 cf cf 3f ef 8d af 8e a7 95 e3 0d 02 57 92 c4 ec f2 64 6f bc 71 f7 de ee ed 83 d5 1f cf 76 6f 1f 1d bf 7f 75 fa e2 59 79 f6 e0 e4 d5 cb cf b2 b3 ff fe 93 db 5d 9c ac e4 e0 ee c5 97 af a7 71 79 2f 1d 3e 38 dc 5a 1c 96 93 e5 9b 0f 8f e3 97 9d ad 77 b7 8f de 84 f3 07 1b Data Ascii: n\7_e0W0%+qfOq&kgc;vQCQEJG3o#x~:N\fq!N!N'W;{wCNojzf.mxsbuQ{/n~v?WdoqvouYy]qy/>8Zw
2025-01-06 14:53:35 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2; expires=Tue, 08-Jul-2025 14:53:35 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:53:35 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 06 Jan 2025 14:53:35 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-06 14:53:35 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:53:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:35 UTC	685	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:53:36 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Mon, 06 Jan 2025 14:53:36 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:53:36 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2025-01-06 14:53:36 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:36 UTC	1428	OUT	POST /forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 10872 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=1SFBX87Y74pHPdEmGBg9HBIIB_n69woLO7T_lT_z1Ck; COMPASS=spreadsheet_forms=CjIACWuJV8X47KdSecoG42iL9pudWq5CEcXtjQNEaLHhqGSObQAqqaj_IEQKEb-prSROdRD4-O-7Bho0AAlriVfg28uAjyDIeIfQECXjxCeVmxu6slXwxDPm0i7CjJqfAAqUJyBu9pmB38bFicvgqw==; NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:53:36 UTC	10872	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 34 31 25 32 43 6e 75 6c 6c 25 32 43 32 25 32 43 31 37 33 36 31 37 35 32 31 32 32 38 38 30 30 30 25 32 43 25 35 42 25 35 42 25 35 42 31 32 38 30 25 32 43 39 30 37 25 32 43 31 32 38 30 25 32 43 39 38 34 25 35 44 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 66 61 6c 73 65 25 32 43 74 72 75 65 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c Data Ascii: impressionBatch=%5B%5B%5B41%2Cnull%2C2%2C1736175212288000%2C%5B%5B%5B1280%2C907%2C1280%2C984%5D%2Cfalse%2Cnull%2Cnull%2C1%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cfalse%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5Bfalse%2Ctrue%5D%2Cnull%2Cnull
2025-01-06 14:53:36 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:53:36 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-OCI43l01f4LxeNlIHyj72A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:36 UTC	1029	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 2049 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/binary Content-Encoding: gzip X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:53:36 UTC	2049	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a ed 99 59 6f 9b 37 16 86 ff 8a a0 ab 16 90 1d f2 70 47 30 17 1e c7 49 33 76 3c 6d d3 66 93 8d c0 71 14 47 f0 5a 2b 69 52 ff fa 79 df 43 d2 96 d7 da 99 c9 5c 19 02 c4 e7 3b 1f 97 c3 97 87 9b 34 1e db d1 c1 e7 bd bd 5b 7f 8d af 32 0e 27 07 c3 4b 19 c7 e3 e1 93 c3 c3 9d bd c9 60 f9 e3 f1 e1 fe 64 38 1a 5a 9b 86 9b a3 f1 70 fd f0 d3 c3 a5 7f fc f3 78 eb e0 3d ac 59 6d 9a 69 fa 79 bf 67 db 1c 99 d1 f0 e5 f4 e0 fd e1 97 19 6d 66 11 1f c0 d7 1c f1 5d 73 c1 14 8a cb 8b d6 09 eb f0 28 a2 9f 4d 94 16 e3 02 9c 18 da e4 a2 4d 41 6c b0 21 5f f2 f2 62 47 e0 b5 6f 8a c8 e8 b4 a8 48 ce c6 18 f6 c9 4a 36 a3 62 d2 a8 42 f6 f4 f3 ac 82 bf 53 d3 dc 4a 63 33 b2 9b 77 1b 96 2b db fa 96 3a c6 df d4 f2 18 92 f7 be 43 a3 0b ba b5 1a 7b cd 52 cc 99 c6 Data Ascii: Yo7pG0I3v<mfqGZ+iRyC\;4[2'K`d8Zpx=Ymiygmf]s(MMAl!_bGoHJ6bBSJc3w+:C{R
2025-01-06 14:53:36 UTC	495	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:53:36 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:53:36 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:53:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:37 UTC	685	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:53:37 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Mon, 06 Jan 2025 14:53:37 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:53:37 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2025-01-06 14:53:37 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:55 UTC	410	OUT	OPTIONS /csp/report-to/gse_qebhlk HTTP/1.1 Host: csp.withgoogle.com Connection: keep-alive Origin: https://accounts.google.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:53:56 UTC	547	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: POST Access-Control-Allow-Headers: content-type Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:53:55 GMT Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://forms.gle/XsPfAF5jPgqSvvp87

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Windows Analysis Report
https://forms.gle/XsPfAF5jPgqSvvp87

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:53:56 UTC	348	OUT	POST /csp/report-to/gse_qebhlk HTTP/1.1 Host: csp.withgoogle.com Connection: keep-alive Content-Length: 718 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:53:56 UTC	718	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 2c 22 62 6f 64 79 22 3a 7b 22 64 69 73 70 6f 73 69 74 69 6f 6e 22 3a 22 72 65 70 6f 72 74 69 6e 67 22 2c 22 65 66 66 65 63 74 69 76 65 50 6f 6c 69 63 79 22 3a 22 73 61 6d 65 2d 6f 72 69 67 69 6e 22 2c 22 70 72 65 76 69 6f 75 73 52 65 73 70 6f 6e 73 65 55 52 4c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 4c 6f 67 69 6e 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 25 32 46 66 6f 72 6d 73 25 32 46 64 25 32 46 65 25 32 46 31 46 41 49 70 51 4c 53 63 30 4b 75 73 73 4e 5f 6b 45 32 41 47 32 63 76 67 6d 6e 59 45 69 4d 55 58 50 72 73 44 36 6c 39 43 74 4b 52 72 7a 6f 4d 34 73 50 59 47 52 4a 67 25 32 46 76 69 65 77 66 6f Data Ascii: [{"age":1,"body":{"disposition":"reporting","effectivePolicy":"same-origin","previousResponseURL":"https://accounts.google.com/Login?continue=https%3A%2F%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1FAIpQLSc0KussN_kE2AG2cvgmnYEiMUXPrsD6l9CtKRrzoM4sPYGRJg%2Fviewfo
2025-01-06 14:53:57 UTC	1699	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 06 Jan 2025 14:53:56 GMT Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-Tdc1YmALjqWYryoNZZt3wQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /csp/_/CspCollectorHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /csp/_/CspCollectorHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /csp/_/CspCollectorHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/csp/_/CspCollectorHttp/web-reports?context=eJzjEtDikmJw0gDi9BmsIUAsxMPRcvf9bjaBCYs-HWVW0kvKL4wvTk0uLcosqdRNLi7QTc7PyUlNLskv0s0oKSmINzIwMjUwNDDSM7CILzAAAPJ4Gfs" Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:02 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 14:54:02 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:54:02 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:03 UTC	1334	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 546 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:03 UTC	546	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 33 38 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 31 37 35 32 34 30 38 36 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"38",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1736175240862",null,null,n
2025-01-06 14:54:03 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:54:03 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:54:03 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:54:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:04 UTC	685	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:04 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Mon, 06 Jan 2025 14:54:04 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:54:04 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2025-01-06 14:54:04 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:04 UTC	1227	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:04 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 06 Jan 2025 14:39:12 GMT Expires: Tue, 14 Jan 2025 14:39:12 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 892 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:54:04 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2025-01-06 14:54:04 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2025-01-06 14:54:04 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2025-01-06 14:54:04 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2025-01-06 14:54:04 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:05 UTC	685	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:05 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Mon, 06 Jan 2025 14:54:05 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:54:05 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2025-01-06 14:54:05 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:05 UTC	1295	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1245 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:05 UTC	1245	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 31 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 33 36 31 37 35 32 33 38 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,1,0,0,0]]],558,[["1736175238000",null,null,nu
2025-01-06 14:54:06 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:54:05 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:54:06 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:54:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:13 UTC	1334	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 725 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:13 UTC	725	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 33 38 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 33 36 31 37 35 32 35 31 38 34 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"38",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1736175251843",null,null,n
2025-01-06 14:54:13 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:54:13 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:54:13 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:54:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:14 UTC	685	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:14 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Mon, 06 Jan 2025 14:54:14 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-06 14:54:14 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2025-01-06 14:54:14 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:54:23 UTC	1311	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 679 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Tf56Xt3kV0yzfjQW7X6aeIlaBQszFlR2cPaGe_XBz34fKlbQnHk_qCg1LBrrkgXIwBWMP_uLZmD9XfLNQx5aQfBTaaV541pc0fgfy-0bYOhB4wVzSa0JaaAPv8_5dBySnUVEUjWMNnUiO9QGkq-UUUIdlLIQwHIN4wcIrFID_gpHncMn75NNboKlMFUmODx2
2025-01-06 14:54:23 UTC	679	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 33 36 31 37 35 32 35 31 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1736175251000",null,null,nu
2025-01-06 14:54:23 UTC	499	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 06 Jan 2025 14:54:23 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-06 14:54:23 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-06 14:54:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0