Edit tour

Windows Analysis Report
https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing

Overview

General Information

Sample URL:	https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing
Analysis ID:	1644384
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

PE file does not import any functions

PE file overlay found

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,4381653570516959322,5593433523941744867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

AdobeReader.exe (PID: 7560 cmdline: "C:\Users\user\Downloads\AdobeReader.exe" MD5: 90C805D6E27619C7480EB11BE841868E)

chrome.exe (PID: 6668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

ETPRO MALWARE BaydenRAT CnC Activity M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-20T14:48:54.163917+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	49840	135.181.152.102	443	TCP
2025-03-20T14:48:58.180826+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	49881	135.181.152.102	443	TCP
2025-03-20T14:49:00.190631+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	49900	135.181.152.102	443	TCP
2025-03-20T14:49:04.216769+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	49940	135.181.152.102	443	TCP
2025-03-20T14:49:06.228032+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	49959	135.181.152.102	443	TCP
2025-03-20T14:49:10.251018+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	49995	135.181.152.102	443	TCP
2025-03-20T14:49:12.262911+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50016	135.181.152.102	443	TCP
2025-03-20T14:49:16.279674+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50055	135.181.152.102	443	TCP
2025-03-20T14:49:18.291479+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50076	135.181.152.102	443	TCP
2025-03-20T14:49:22.322538+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50083	135.181.152.102	443	TCP
2025-03-20T14:49:24.337665+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50084	135.181.152.102	443	TCP
2025-03-20T14:49:28.362547+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50087	135.181.152.102	443	TCP
2025-03-20T14:49:30.373374+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50091	135.181.152.102	443	TCP
2025-03-20T14:49:34.399800+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50096	135.181.152.102	443	TCP
2025-03-20T14:49:36.413844+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50097	135.181.152.102	443	TCP
2025-03-20T14:49:40.441372+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50099	135.181.152.102	443	TCP
2025-03-20T14:49:42.455369+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50101	135.181.152.102	443	TCP
2025-03-20T14:49:46.483522+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50103	135.181.152.102	443	TCP
2025-03-20T14:49:48.496393+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50104	135.181.152.102	443	TCP
2025-03-20T14:49:52.524315+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50105	135.181.152.102	443	TCP
2025-03-20T14:49:54.539212+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50106	135.181.152.102	443	TCP
2025-03-20T14:49:58.571531+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50108	135.181.152.102	443	TCP
2025-03-20T14:50:00.586949+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50109	135.181.152.102	443	TCP
2025-03-20T14:50:04.614376+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50110	135.181.152.102	443	TCP
2025-03-20T14:50:06.627211+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50112	135.181.152.102	443	TCP
2025-03-20T14:50:10.654166+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50114	135.181.152.102	443	TCP
2025-03-20T14:50:12.667073+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50115	135.181.152.102	443	TCP
2025-03-20T14:50:16.693597+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50116	135.181.152.102	443	TCP
2025-03-20T14:50:18.708364+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50117	135.181.152.102	443	TCP
2025-03-20T14:50:22.739188+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50118	135.181.152.102	443	TCP
2025-03-20T14:50:24.753313+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50119	135.181.152.102	443	TCP
2025-03-20T14:50:28.781102+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50120	135.181.152.102	443	TCP
2025-03-20T14:50:30.892278+0100	2859269	1	Malware Command and Control Activity Detected	192.168.2.17	50121	135.181.152.102	443	TCP

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

Source: https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.32.110:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.228:443 -> 192.168.2.17:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.228:443 -> 192.168.2.17:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.209.150.110:443 -> 192.168.2.17:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.209.150.110:443 -> 192.168.2.17:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.142.25:443 -> 192.168.2.17:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.142.25:443 -> 192.168.2.17:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.231.203.201:443 -> 192.168.2.17:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49921 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:49840 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:49900 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:49881 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:49940 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:49959 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:49995 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50016 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50055 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50084 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50083 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50087 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50076 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50091 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50096 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50104 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50106 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50105 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50118 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50116 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50120 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50115 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50114 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50099 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50119 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50097 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50109 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50117 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50101 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50121 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50110 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50103 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50112 -> 135.181.152.102:443
Source: Network traffic	Suricata IDS: 2859269 - Severity 1 - ETPRO MALWARE BaydenRAT CnC Activity M1 : 192.168.2.17:50108 -> 135.181.152.102:443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: bitbucket.org to https://bbuseruploads.s3.amazonaws.com/09941335-82ee-4a46-9f39-491b91c71a7d/downloads/9f1aac03-26d5-4668-8e87-2a5e744b5957/adobereader.exe?response-content-disposition=attachment%3b%20filename%3d%22adobereader.exe%22&awsaccesskeyid=asia6kose3bnkezobduk&signature=bewllwtip9tpupsjz0i1f4ochnk%3d&x-amz-security-token=iqojb3jpz2lux2vjedyacxvzlwvhc3qtmsjgmeqcigxqwhbhah23xcg1v%2bclmsq3mqsnficzbclk6z0r%2fuplaiayxisaonazsxv2gpeyqpdga2c3%2bdwtrmjvzcm5n10aisqwagip%2f%2f%2f%2f%2f%2f%2f%2f%2f%2f8beaaaddk4nduyntewmte0niim%2brld%2b9nbq2h3sa4bkoqcesuojnzrbpl40kswjx%2fjuqbekmzyeucb3gmcup96jmdtnqwgsnourc%2fgn4snibqfryfyu9drqsmwf%2bmm9jeytw1vyulzl%2fqieosgrcob%2fbd68mt1%2bvxcxjiwtqvfaonkqlt4cthlp2ehl3vki4idi7t0p2%2btjrnlynxuykrgorgaym3b5qg6sucasest4nu6idqhkp960rygjyaujwcfjpqpvjayjbkg%2f0l06ddizm5bmmmbe5bpczoutvg0pzeqmz1ezfkvzxovtnhgz%2b2cxewbmh%2faakdoeiibibg06fczz1eymwok4ppxunk2bmtjkoqgz5fe9vvt9aygqfvf3efzyeswq7pwvgy6ngephl1vfmgru1c6dfrwstvf%2fjis%2f24nawarr261nk4fsvi7jeahhwbw2yzf565w1arpzbuppm2pxs%2bwjduuirr5lde18ijjizy1h5nklrlg7ivhvhlb8ekbqxm1et0ysyjbnxp7vqexv8cefaz5bl4%2fuke3pyyluzd%2b7ibeso%2bfbyywv38zuzdouu1elw6xzu5claojmts169os9jvd0q%3d%3d&expires=1742479539

Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40

Source: global traffic	HTTP traffic detected: GET /file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /drive-viewer/AKGpihYQDW1seUtlFC7VYLfF4uRTxrEetB8Ui_0Jjey-cUFUH-1xUQxg8GlIcukHGRtfj1QOnf1LA5oAPktUW12xYN54W_TSYue5i0k=s1600-rw-v1 HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharingAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
Source: global traffic	HTTP traffic detected: GET /drive-viewer/AKGpihYQDW1seUtlFC7VYLfF4uRTxrEetB8Ui_0Jjey-cUFUH-1xUQxg8GlIcukHGRtfj1QOnf1LA5oAPktUW12xYN54W_TSYue5i0k=s1600-rw-v1 HTTP/1.1Host: drive.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
Source: global traffic	HTTP traffic detected: GET /auth_warmup HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
Source: global traffic	HTTP traffic detected: GET /drivesharing/clientmodel?id=1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2&foreignService=texmex&authuser=0&origin=https%3A%2F%2Fdrive.google.com HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
Source: global traffic	HTTP traffic detected: GET /viewerng/upload?ds=APznzaaun2iLCbSGK5krodng5O7FdYrhAfmrIfxFoRxXcRtlIqqAMVdDMUHRacK3B_1fZLDyUmQaxYlRQurgcKcHf0moupD57zKCp1wJSee__jB4GCxPBiu7avs9lxXyaLJEh4LoMVTbpzQZLBL_iABT1gJ6Tn916pay8ISjAmMv1GElC41xYZSthpQRSoXsfbqHLfIhhJuXP00ULpYJuT1OiN6meu0zDrnD46ej1Qzu3arCOAYKjkJxmbhJ-X3aKRPSlSCOeyuqGgc2upE8c9HV6DkeIuQSWe6dsin43fMMHGuf1duxCgehmmwnX3wnlbnUgueAFciVcQc1zBjUOCZet5UBuJ5ZyCdQmcoD9_D6mqZWKwg5ZKuhmxjZuTj9fcAr1c5Rz2rvFuWEe6d0vhesqafVnGfT1w%3D%3D&ck=drive&p=proj&sp=W3sibWV0YSI6e319LHsicGFnZSI6eyJ3Ijo4MDAsIndlYnAiOnRydWUsInNraXBoaWdobGlnaHQiOnRydWUsInBhZ2UiOjB9fV0. HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
Source: global traffic	HTTP traffic detected: GET /viewerng/meta?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=C8O4vypYHoIB7fwU4PoDsNpa0I_9HETacUxYfm1uH-cNe0N7EkHEmSzTmWnStXRf1e2CAOJQX4p0y_EYRDMpu_rS5sfN9thVH-wNQZ3GlzEF3vigzfc2B3IEEpD4bOyD9mE1f5lXlWB-uIzDy_4nRqq1-NaXZ-WHSqRECYfVcnH5BcLI2yykAWXWFPWYzPi_Wx2MUNBknw
Source: global traffic	HTTP traffic detected: GET /viewerng/upload?ds=APznzaaun2iLCbSGK5krodng5O7FdYrhAfmrIfxFoRxXcRtlIqqAMVdDMUHRacK3B_1fZLDyUmQaxYlRQurgcKcHf0moupD57zKCp1wJSee__jB4GCxPBiu7avs9lxXyaLJEh4LoMVTbpzQZLBL_iABT1gJ6Tn916pay8ISjAmMv1GElC41xYZSthpQRSoXsfbqHLfIhhJuXP00ULpYJuT1OiN6meu0zDrnD46ej1Qzu3arCOAYKjkJxmbhJ-X3aKRPSlSCOeyuqGgc2upE8c9HV6DkeIuQSWe6dsin43fMMHGuf1duxCgehmmwnX3wnlbnUgueAFciVcQc1zBjUOCZet5UBuJ5ZyCdQmcoD9_D6mqZWKwg5ZKuhmxjZuTj9fcAr1c5Rz2rvFuWEe6d0vhesqafVnGfT1w%3D%3D&ck=drive&p=proj&sp=W3sibWV0YSI6e319LHsicGFnZSI6eyJ3Ijo4MDAsIndlYnAiOnRydWUsInNraXBoaWdobGlnaHQiOnRydWUsInBhZ2UiOjB9fV0. HTTP/1.1Host: drive.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=C8O4vypYHoIB7fwU4PoDsNpa0I_9HETacUxYfm1uH-cNe0N7EkHEmSzTmWnStXRf1e2CAOJQX4p0y_EYRDMpu_rS5sfN9thVH-wNQZ3GlzEF3vigzfc2B3IEEpD4bOyD9mE1f5lXlWB-uIzDy_4nRqq1-NaXZ-WHSqRECYfVcnH5BcLI2yykAWXWFPWYzPi_Wx2MUNBknw
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=C8O4vypYHoIB7fwU4PoDsNpa0I_9HETacUxYfm1uH-cNe0N7EkHEmSzTmWnStXRf1e2CAOJQX4p0y_EYRDMpu_rS5sfN9thVH-wNQZ3GlzEF3vigzfc2B3IEEpD4bOyD9mE1f5lXlWB-uIzDy_4nRqq1-NaXZ-WHSqRECYfVcnH5BcLI2yykAWXWFPWYzPi_Wx2MUNBknw
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /viewerng/img?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL&page=0&skiphighlight=true&w=800&webp=true HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=nKK1s3ZfUGHxOX73pFu_d1CzEwpyRY3012dSHN0bEEk4gopXRYYdVoriI-8KQ-WkO8ljVBc5Adkg0l7eEJAF-5DsoD7rKy-YW8bM9d0HoAX38MBrm_dVIMnbeiqxYDTIH8K6aMoQA2QN7_J-PsvwAaqBVesJbEiNrmd3jBOBWaLXZpEQFYz00ucXkzFiccdZQK3IotzCTg
Source: global traffic	HTTP traffic detected: GET /viewerng/presspage?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL&page=0 HTTP/1.1Host: drive.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=nKK1s3ZfUGHxOX73pFu_d1CzEwpyRY3012dSHN0bEEk4gopXRYYdVoriI-8KQ-WkO8ljVBc5Adkg0l7eEJAF-5DsoD7rKy-YW8bM9d0HoAX38MBrm_dVIMnbeiqxYDTIH8K6aMoQA2QN7_J-PsvwAaqBVesJbEiNrmd3jBOBWaLXZpEQFYz00ucXkzFiccdZQK3IotzCTg
Source: global traffic	HTTP traffic detected: GET /viewerng/meta?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL HTTP/1.1Host: drive.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=1lSyPfcklMvbOZ1a4UH7Lx8HSoJNg_d8mj1m3QpQjZ2dPcsK78FDxmsuKx-gub-uU1Gv4dVhG8co0qMdKQvJLhNZkQtS_tNA08KIStaJq9KtgzUojd6R7MRqArIPhkXslObpOeqiR629C6EbtprW27zMpUX2pC1Gk0xxUM3T9rHLHZMS6_CRLfBlGfwSgEBmsLxz-JAmtA
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /viewerng/presspage?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL&page=0 HTTP/1.1Host: drive.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /viewerng/img?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL&page=0&skiphighlight=true&w=800&webp=true HTTP/1.1Host: drive.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=nKK1s3ZfUGHxOX73pFu_d1CzEwpyRY3012dSHN0bEEk4gopXRYYdVoriI-8KQ-WkO8ljVBc5Adkg0l7eEJAF-5DsoD7rKy-YW8bM9d0HoAX38MBrm_dVIMnbeiqxYDTIH8K6aMoQA2QN7_J-PsvwAaqBVesJbEiNrmd3jBOBWaLXZpEQFYz00ucXkzFiccdZQK3IotzCTg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/docos/p/sync?resourcekey&id=1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2&reqid=0 HTTP/1.1Host: drive.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /url?sa=D&q=https://t9oyouthbaseball.com/dclg&ust=1742561580000000&usg=AOvVaw0oNnuzu8GDQHjCQBY5Ey1-&hl=en HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLf3ygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /dclg HTTP/1.1Host: t9oyouthbaseball.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: t9oyouthbaseball.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://t9oyouthbaseball.com/dclgAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: 8f2e915dd=915dd1dc5b7d
Source: global traffic	HTTP traffic detected: GET /downloadreaders/adobe_reader/downloads/AdobeReader.exe HTTP/1.1Host: bitbucket.orgConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://t9oyouthbaseball.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /09941335-82ee-4a46-9f39-491b91c71a7d/downloads/9f1aac03-26d5-4668-8e87-2a5e744b5957/AdobeReader.exe?response-content-disposition=attachment%3B%20filename%3D%22AdobeReader.exe%22&AWSAccessKeyId=ASIA6KOSE3BNKEZOBDUK&Signature=BeWLLwTiP9TPUPsJZ0i1f4ocHnk%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEDYaCXVzLWVhc3QtMSJGMEQCIGxqWhBHAh23xcG1v%2BcLmsq3mQsnFIcZbCLK6z0R%2FuPLAiAYXIsAoNazSxv2gpeyqpdgA2C3%2BdWtRMjvZcM5n10aISqwAgiP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIM%2BrLD%2B9NbQ2h3sA4BKoQCESUOjNzRbpL40KSWjx%2FJuQbeKMZYEUcB3GMcuP96JmdtnQwgSNoURC%2FgN4snibQfrYFyU9DRQsMWf%2BMM9jEytw1VyulZL%2FQiEosGrcOb%2FBd68Mt1%2BVXcXJiWtQvfaONkQLt4cthLP2EhL3VkI4IDI7T0p2%2BtJRNLynXuykRGORgAym3b5QG6SUCAsEst4nU6IdQhkP960RyGJYAujWcfjpqpVJAYJBkg%2F0L06DdIZm5BMmMBE5bpcZoUtvG0PZeqMZ1EZFkVzxovtNHgZ%2B2cXewBMH%2FaAkdOEiibiBG06FCzZ1eYmWOk4pPXunk2bMtjKoQgZ5fe9VvT9aYGqFVf3efZYEswq7PwvgY6ngEpHl1vfMGRU1C6DfRWsTVF%2FjIS%2F24NaWArR261nk4FSvi7jeahHWbw2YZf565W1ArPzbuPpm2pXS%2BwjDUuiRr5LDE18ijJiZy1h5NklrLG7IVhvHlb8EKbqXm1Et0ysYjbNXP7VQEXV8cEfaz5bl4%2FuKE3PYyLuZd%2B7ibESO%2BfbYYwV38ZUZdOUU1elw6XZu5CLAoJmTs169oS9JVd0Q%3D%3D&Expires=1742479539 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://t9oyouthbaseball.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLf3ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft

Source: chromecache_120.1.dr	String found in binary or memory: Xe=y(["https://sandbox.google.com/tools/feedback/"]),Ye=y(["https://www.google.cn/tools/feedback/"]),Ze=y(["https://help.youtube.com/tools/feedback/"]),$e=y(["https://asx-frontend-staging.corp.google.com/inapp/"]),af=y(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),bf=y(["https://localhost.corp.google.com/inapp/"]),cf=y(["https://localhost.proxy.googlers.com/inapp/"]),df=S(Ge),ef=[S(He),S(Ie)],ff=[S(Je),S(Ke),S(Le),S(Me),S(Ne),S(Oe),S(Pe),S(Qe),S(Re),S(Se)],gf=[S(Te),S(Ue)],hf= equals www.youtube.com (Youtube)
Source: chromecache_136.1.dr	String found in binary or memory: a.TS)==null?void 0:(v=t.PY)==null?void 0:v.O6)&&q.length>0&&(c.length_seconds=Oua(q[0]))}}if(O(this.context.ga(),192)){if(!a.UH\|\|!a.UH.sU)return this.context.get(WH).xb({ea:252}),c;t=a.UH.sU===ez.AVAILABLE?250:251;this.context.get(WH).xb({ea:t});a.UH.sU===ez.AVAILABLE&&(c.videoStoryboard=JSON.stringify(Mua(a.UH)))}return c};var Vkc=function(a){rO.call(this,a.ka());this.context=a;this.I=new nh};R(Vkc,rO);Vkc.prototype.C=function(){return"onYouTubeIframeAPIReady"};Vkc.prototype.F=function(){var a=qN(this.context.ga())\|\|new qO;return ZVa(z(a,1,"https://www.youtube.com"),"iframe_api")};Vkc.prototype.B=function(){return hm("YT.Player",this.ka().getWindow())};Vkc.prototype.xg=function(){return this.I};var Wkc=new Gd("hrvDb","hrvDb");var Xkc=function(){Dj.apply(this,arguments)};R(Xkc,Dj);var dQ=function(a){nh.call(this);var b=this;this.context=a;this.C=null;this.R=!1;this.D=0;this.H=null;this.na(this.context);var c=a.ga();a=a.ka();O(c,70)\|\|Sg(c,83);this.F=new eNb;var d=Ykc(c);hNb(this.F,d,function(){return smb(d)});gNb(this.F,d);this.handler=new Zj(this);this.na(this.handler);this.B=new Z4b;this.na(this.B);Zkc(this,c,a);$kc(this);var e=Ri(c);this.Ob&&e&&(this.context.get(WH).start(),this.Ob.xb({ea:1}),Lj(VWa),(c=Pj(c))&&this.context.get(WH).setEnabled(!!O(c,18)));this.root=(c=$f(this.context, equals www.youtube.com (Youtube)
Source: chromecache_88.1.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.i=this.g=null;this.h=0;this.m=!1;this.l=[];this.j=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=qa(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&rb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?lb(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_88.1.dr	String found in binary or memory: function rb(){var a=new pb,b=["https://www.youtube.com"];b=b===void 0?ob:b;oa(function(c){switch(c.g){case 1:return C(c,qb(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var f;return oa(function(e){if(e.g==1)return e.l=2,C(e,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);e.g!=2?(f=e.m,f.state==="prompt"&&a.g.push(d),e.g=0,e.l=0):(e.l=0,e.i=null,e.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_100.1.dr	String found in binary or memory: inline:{css:1},disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"}, equals www.youtube.com (Youtube)
Source: chromecache_113.1.dr	String found in binary or memory: var scriptUrl = 'https:\/\/youtube.googleapis.com\/s\/player\/82345d49\/www-widgetapi.vflset\/www-widgetapi.js';window['yt_embedsEnableIframeApiSendFullEmbedUrl'] = true ;window['yt_embedsEnableAutoplayAndVisibilitySignals'] = true ;try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: t9oyouthbaseball.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com

Source: unknown

HTTP traffic detected: POST /file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/docos/p/sync?resourcekey&id=1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2&reqid=0 HTTP/1.1Host: drive.google.comConnection: keep-aliveContent-Length: 75sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0X-Same-Domain: 1X-Client-Deadline-Ms: 20000User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36X-Build: apps-fileview.texmex_20250313.01_p0Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: https://drive.google.comX-Client-Data: CLf3ygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 20 Mar 2025 13:48:41 GMTContent-Type: text/htmlContent-Length: 552Connection: close

Source: chromecache_136.1.dr, chromecache_129.1.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_120.1.dr	String found in binary or memory: http://localhost.corp.google.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: http://localhost.proxy.googlers.com/inapp/
Source: chromecache_136.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_126.1.dr, chromecache_95.1.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: chromecache_126.1.dr, chromecache_95.1.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch/ns
Source: chromecache_136.1.dr, chromecache_93.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_129.1.dr	String found in binary or memory: https://accounts.google.com/gsi/ottoken
Source: chromecache_129.1.dr	String found in binary or memory: https://accounts.google.com/o/fedcm/config.json
Source: chromecache_129.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_129.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: chromecache_131.1.dr, chromecache_100.1.dr, chromecache_97.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_136.1.dr	String found in binary or memory: https://angular.dev/license
Source: chromecache_100.1.dr, chromecache_97.1.dr, chromecache_93.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_136.1.dr, chromecache_114.1.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_136.1.dr, chromecache_120.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_100.1.dr	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js
Source: chromecache_117.1.dr	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js?onload=startup
Source: chromecache_136.1.dr	String found in binary or memory: https://apps-drive-picker-dev.corp.google.com/picker/minpick/main
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.com/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.google.de/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_90.1.dr	String found in binary or memory: https://bitbucket.org/downloadreaders/adobe_reader/downloads/AdobeReader.exe
Source: chromecache_136.1.dr	String found in binary or memory: https://calendar.google.com/calendar
Source: chromecache_136.1.dr	String found in binary or memory: https://calendar.google.com/calendar/u/
Source: chromecache_100.1.dr	String found in binary or memory: https://classroom.google.com/sharewidget?usegapi=1
Source: chromecache_100.1.dr	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1
Source: chromecache_136.1.dr	String found in binary or memory: https://clients5.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://clients5.google.com/webstore/wall/widget
Source: chromecache_131.1.dr, chromecache_100.1.dr, chromecache_97.1.dr, chromecache_129.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://cloud.google.com/bigquery/docs/connected-sheets
Source: chromecache_136.1.dr	String found in binary or memory: https://cloud.google.com/terms/cloud-privacy-notice
Source: chromecache_129.1.dr	String found in binary or memory: https://console.developers.google.com/
Source: chromecache_131.1.dr, chromecache_100.1.dr, chromecache_97.1.dr, chromecache_129.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_136.1.dr, chromecache_129.1.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_100.1.dr	String found in binary or memory: https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1
Source: chromecache_129.1.dr	String found in binary or memory: https://developers.google.com/
Source: chromecache_129.1.dr	String found in binary or memory: https://developers.google.com/api-client-library/javascript/reference/referencedocs
Source: chromecache_129.1.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/gis-migration)
Source: chromecache_88.1.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: chromecache_129.1.dr	String found in binary or memory: https://developers.googleblog.com/2018/03/discontinuing-support-for-json-rpc-and.html
Source: chromecache_136.1.dr	String found in binary or memory: https://docs.google.com/document/d/1kganm9BHI3TsF8ogVulX2o4DzzO8XA4gu8aIKneTTNU/preview
Source: chromecache_131.1.dr, chromecache_97.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_136.1.dr	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/
Source: chromecache_136.1.dr	String found in binary or memory: https://drive.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://drive.google.com/drive/my-drive
Source: chromecache_136.1.dr	String found in binary or memory: https://drive.google.com/picker/minpick/main
Source: chromecache_136.1.dr	String found in binary or memory: https://drive.google.com/requestreview?id=
Source: chromecache_100.1.dr	String found in binary or memory: https://drive.google.com/savetodrivebutton?usegapi=1
Source: chromecache_136.1.dr	String found in binary or memory: https://drive.google.com/viewer
Source: chromecache_136.1.dr	String found in binary or memory: https://drive.usercontent.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://drivemetadata.clients6.google.com
Source: chromecache_100.1.dr	String found in binary or memory: https://families.google.com/webcreation?usegapi=1&usegapi=1
Source: chromecache_120.1.dr	String found in binary or memory: https://feedback-pa.clients6.google.com
Source: chromecache_120.1.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/annotator.css
Source: chromecache_120.1.dr	String found in binary or memory: https://feedback.googleusercontent.com/resources/render_frame2.html
Source: chromecache_120.1.dr	String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_120.1.dr	String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_120.1.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_120.1.dr	String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_92.1.dr, chromecache_125.1.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_136.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: chromecache_115.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Google
Source: chromecache_136.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_114.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/e/notoemoji/
Source: chromecache_125.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlematerialicons/v143/Gw6kwdfw6UnXLJCcmafZyFRXb3BL9rvi0QZG3Q.woff2)
Source: chromecache_92.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_93.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_93.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_93.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_93.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_136.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialiconsfilled/close/v19/gm_grey200-24dp/1x/gm_filled_close
Source: chromecache_120.1.dr	String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_120.1.dr	String found in binary or memory: https://help.youtube.com/tools/feedback/
Source: chromecache_114.1.dr	String found in binary or memory: https://lh3.googleusercontent.com/a/default-user
Source: chromecache_120.1.dr	String found in binary or memory: https://localhost.corp.google.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://localhost.proxy.googlers.com/inapp/
Source: chromecache_136.1.dr	String found in binary or memory: https://mygoogle.corp.google.com/help/answer/9011840
Source: chromecache_136.1.dr	String found in binary or memory: https://onepick-autopush.sandbox.google.com/picker/minpick/main
Source: chromecache_136.1.dr	String found in binary or memory: https://onepick-preprod.sandbox.google.com/picker/minpick/main
Source: chromecache_136.1.dr	String found in binary or memory: https://onepick-staging-drivequal.sandbox.google.com/picker/minpick/main
Source: chromecache_136.1.dr	String found in binary or memory: https://onepick-staging.sandbox.google.com/picker/minpick/main
Source: chromecache_100.1.dr	String found in binary or memory: https://pay.google.com/gp/v/widget/save
Source: chromecache_136.1.dr	String found in binary or memory: https://play.google.com
Source: chromecache_93.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_100.1.dr	String found in binary or memory: https://play.google.com/work/embedded/search?usegapi=1&usegapi=1
Source: chromecache_97.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_131.1.dr, chromecache_100.1.dr, chromecache_97.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_136.1.dr	String found in binary or memory: https://policies.google.com/privacy
Source: chromecache_136.1.dr	String found in binary or memory: https://policies.google.com/terms
Source: chromecache_136.1.dr	String found in binary or memory: https://punctual-dev.corp.google.com
Source: chromecache_120.1.dr	String found in binary or memory: https://sandbox.google.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_120.1.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_120.1.dr	String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://signaler-pa.clients6.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://signaler-pa.googleapis.com
Source: chromecache_136.1.dr	String found in binary or memory: https://signaler-pa.youtube.com
Source: chromecache_136.1.dr	String found in binary or memory: https://signaler-staging.sandbox.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://ssl.gstatic.com/docs/common/cleardot.gif
Source: chromecache_129.1.dr	String found in binary or memory: https://ssl.gstatic.com/gb/js/
Source: chromecache_100.1.dr	String found in binary or memory: https://ssl.gstatic.com/microscope/embed/
Source: chromecache_120.1.dr	String found in binary or memory: https://stagingqual-feedback-pa-googleapis.sandbox.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com
Source: chromecache_120.1.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/a/answer/9275380
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/a?p=advanced-settings-data-regions
Source: chromecache_114.1.dr	String found in binary or memory: https://support.google.com/contacts/answer/7345608
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/13447609
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/148505
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/14925782
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/15001094
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/2494893
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/2494893?co=GENIE.Platform%3DDesktop#zippy=%2Cprevent-people-f
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/37603
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs/answer/49114
Source: chromecache_114.1.dr	String found in binary or memory: https://support.google.com/docs/answer/65129
Source: chromecache_114.1.dr	String found in binary or memory: https://support.google.com/docs/answer/65129?hl=en
Source: chromecache_114.1.dr	String found in binary or memory: https://support.google.com/docs?p=comments_guide
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/docs?p=editors_encryption
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/drive/answer/13447401
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/drive/answer/2407404?hl=en
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/drive/answer/2423485?hl=%s
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/drive/answer/2423694
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/drive/answer/7650301
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/drive?p=gemini_drive_pdf
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/google-workspace-individual/?p=esignature_signer_terms
Source: chromecache_120.1.dr	String found in binary or memory: https://support.google.com/inapp/
Source: chromecache_120.1.dr	String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/legal/answer/3110420
Source: chromecache_136.1.dr	String found in binary or memory: https://support.google.com/mail?p=workspace-smart-features-settings
Source: chromecache_138.1.dr	String found in binary or memory: https://t9oyouthbaseball.com/dclg
Source: chromecache_100.1.dr	String found in binary or memory: https://talkgadget.google.com/:session_prefix:talkgadget/_/widget
Source: chromecache_136.1.dr	String found in binary or memory: https://tasks.google.com/
Source: chromecache_120.1.dr	String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_136.1.dr	String found in binary or memory: https://workspace.google.com
Source: chromecache_131.1.dr, chromecache_100.1.dr, chromecache_97.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_136.1.dr	String found in binary or memory: https://workspace.google.com/terms/google-workspace-individual-terms/esignature-signer/
Source: chromecache_136.1.dr	String found in binary or memory: https://workspacevideo-pa.googleapis.com
Source: chromecache_120.1.dr	String found in binary or memory: https://www.google.cn/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_136.1.dr, chromecache_88.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true
Source: chromecache_100.1.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/badge?usegapi=1
Source: chromecache_100.1.dr	String found in binary or memory: https://www.google.com/shopping/customerreviews/optin?usegapi=1
Source: chromecache_120.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_120.1.dr	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chromecache_120.1.dr	String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_120.1.dr	String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_129.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.login
Source: chromecache_97.1.dr, chromecache_129.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_97.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_129.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: chromecache_129.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: chromecache_136.1.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_93.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_136.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/productlogos/calendar_2020q4/v13/192px.svg
Source: chromecache_136.1.dr	String found in binary or memory: https://www.gstatic.com/images/branding/productlogos/tasks/v10/192px.svg
Source: chromecache_93.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_93.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chromecache_93.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chromecache_93.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chromecache_114.1.dr	String found in binary or memory: https://www.gstatic.com/lamda/images/bard_sparkle_v2_advanced.svg
Source: chromecache_100.1.dr	String found in binary or memory: https://www.gstatic.com/partners/badge/templates/badge.html?usegapi=1
Source: chromecache_114.1.dr	String found in binary or memory: https://www.gstatic.com/people/peoplekit/icons/
Source: chromecache_114.1.dr	String found in binary or memory: https://www.gstatic.com/people/peoplekit/icons/light_theme/domain_disabled_grey900.svg
Source: chromecache_120.1.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_120.1.dr	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: chromecache_88.1.dr	String found in binary or memory: https://www.youtube.com
Source: chromecache_100.1.dr	String found in binary or memory: https://www.youtube.com/subscribe_embed?usegapi=1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443

Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.32.110:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.228:443 -> 192.168.2.17:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.228:443 -> 192.168.2.17:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.209.150.110:443 -> 192.168.2.17:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.209.150.110:443 -> 192.168.2.17:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.142.25:443 -> 192.168.2.17:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.142.25:443 -> 192.168.2.17:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.231.203.201:443 -> 192.168.2.17:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.17:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.206:443 -> 192.168.2.17:49921 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7096_1320118057

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7096_1320118057

Jump to behavior

Source: a9f37d9a-812c-476d-86c0-d8f68e5e624e.tmp.0.dr

Static PE information: No import functions for PE file found

Source: a9f37d9a-812c-476d-86c0-d8f68e5e624e.tmp.0.dr

Static PE information: Data appended to the last section found

Source: classification engine

Classification label: mal48.win@30/96@94/12

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\a9f37d9a-812c-476d-86c0-d8f68e5e624e.tmp

Jump to behavior

Source: C:\Users\user\Downloads\AdobeReader.exe

Mutant created: \Sessions\1\BaseNamedObjects\mt551

Source: C:\Users\user\Downloads\AdobeReader.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,4381653570516959322,5593433523941744867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\AdobeReader.exe "C:\Users\user\Downloads\AdobeReader.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,4381653570516959322,5593433523941744867,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\AdobeReader.exe "C:\Users\user\Downloads\AdobeReader.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Downloads\AdobeReader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Downloads\AdobeReader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\AdobeReader.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Downloads\AdobeReader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\AdobeReader.exe	Section loaded: mswsock.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 24310.crdownload	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 105	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\a9f37d9a-812c-476d-86c0-d8f68e5e624e.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\AdobeReader.exe (copy)	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 105
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 105			Jump to dropped file

Source: C:\Users\user\Downloads\AdobeReader.exe

Last function: Thread delayed

Source: AdobeReader.exe, 0000000C.00000002.2325184947.000001B2B13DC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: AdobeReader.exe, 0000000C.00000000.1353970022.00007FF78E021000.00000002.00000001.01000000.00000007.sdmp, chromecache_105.1.dr, Unconfirmed 24310.crdownload.0.dr	Binary or memory string: Shell_TrayWnd
Source: AdobeReader.exe, 0000000C.00000000.1353970022.00007FF78E021000.00000002.00000001.01000000.00000007.sdmp, chromecache_105.1.dr, Unconfirmed 24310.crdownload.0.dr	Binary or memory string: U3U=UnA=UnM=VXE=VHU=Mi0fXSE=1.3.1JiQOeyQTMx9WJTEzFVs0EjIzXA==MikfVD0kOR9bJBUkOw==IjMfWSUEBxNUNCA=JSQWXSUEBxNUNCA=MyQbXBcILR8=Ii0VSzQpIBRcPQQ=IjMfWSUEEQhXMgQyCXk=JiUTC2NPJRZUIygOej0VJSQWXSUEDhhSNAI1NDIfSmJTbx5UPQ==MyQWXTASJD57IjMfWSUEAhVVIQA1E1o9BAU5JiQOaygSNR9VHAQ1CFEyEg==JiUTSD0UMlRcPQ0=JiUTSD0UMilMMBM1D0g=JiQOfBI=MiQObDkTJBtcFREoO08wEyQUXSISAhVWJQQ5Dg==NigeXRIJIAhsPiw0Fkw4IzgOXQ==MiQWXTIVDhhSNAI1IjMfWSUEAhVVIQA1E1o9BAMTTDwAMQ==BiUTSD0UMlRcPQ0=JiUTSBYENTNVMAYkP1YyDiUfSiI=Li0fC2NPJRZUIjMfWSUEEg5KNAAsNVYZJi0VWjANJiUTSBYENTNVMAYkP1YyDiUfSiIyKABdShell_TrayWndCCwbXzROKwpdNg==JiQOez4MMQ9MNBMPG1U0Ng==MyQbXAETLhldIhIMH1U+Ezg=NSQIVTgPIA5dARMuGV0iEg==NygITCQALTtUPQ4iJiQObDkTJBtcEg4vDl0pFQ==NygITCQALTtUPQ4iP0A=NjMTTDQxMxVbNBIyN108DjMDKDESVCEAMRMWNQ0tJiQOeTUAMQ5dIxIIFF4+JiQOdT4FNBZdGQAvHlQ0IA==MiQOdDASNT9KIw4zJiQOdDASNT9KIw4zMyQWXTASJDdNJQQ5264MiQObDkTJBtcEg4vDl0pFQ==MyQJTTwEFRJKNAAlNigUUT8ENVRcPQ0=KC8OXSMPJA53IQQvOw==KC8OXSMPJA53IQQvL0o9IA==KC8OXSMPJA5qNAAlPFE9BA==KC8OXSMPJA57PQ4yH3AwDyUWXQ==IikIVzwEFiwTW3ECMgpKPgU0GUxxBiQOGAQ0CD4=JDMIVyM=JDkTTAETLhldIhI=`

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	21 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
blobcomments-pa.clients6.google.com	142.250.80.106	true	false	high
bitbucket.org	104.192.142.25	true	false	high
beacons3.gvt2.com	142.251.41.3	true	false	high
google.com	142.250.81.238	true	false	high
plus.l.google.com	142.251.40.238	true	false	high
beacons-handoff.gcp.gvt2.com	172.253.124.94	true	false	high
beacons2.gvt2.com	216.239.32.3	true	false	high
peoplestackwebexperiments-pa.clients6.google.com	142.251.40.106	true	false	high
beacons.gvt2.com	172.253.124.94	true	false	high
s3-w.us-east-1.amazonaws.com	54.231.203.201	true	false	high
play.google.com	142.250.81.238	true	false	high
t9oyouthbaseball.com	213.209.150.110	true	false	unknown
drive.google.com	142.250.176.206	true	false	high
www.google.com	142.250.65.228	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://otelrules.svc.static.microsoft/rules/rule701151v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule704001v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702151v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700151v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703151v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120630v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120663v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120627v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700901v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700400v2s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule701901v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120635v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702901v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703000v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703450v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700700v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702000v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702450v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703750v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703300v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700450v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule701700v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702700v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700851v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703701v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule701851v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702851v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120619v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120622v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120647v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule224900v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120668v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120128v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120650v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703051v3s19.xml	false	high
https://drive.google.com/drive-viewer/AKGpihYQDW1seUtlFC7VYLfF4uRTxrEetB8Ui_0Jjey-cUFUH-1xUQxg8GlIcukHGRtfj1QOnf1LA5oAPktUW12xYN54W_TSYue5i0k=s1600-rw-v1	false	high
https://otelrules.svc.static.microsoft/rules/rule120655v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120614v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120639v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702200v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule704050v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120648v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702500v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703500v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703950v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700200v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700500v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule701650v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule224902v2s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700950v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120651v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120642v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702950v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702651v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120623v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702201v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule703951v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120676v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700651v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule700201v1s19.xml	false	high
https://drive.google.com/viewerng/meta?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL	false	high
https://otelrules.svc.static.microsoft/rules/rule120670v0s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120610v0s19.xml	false	high
https://bitbucket.org/downloadreaders/adobe_reader/downloads/AdobeReader.exe	false	high
https://otelrules.svc.static.microsoft/rules/rule701701v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule702401v1s19.xml	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://apis.google.com/js/googleapis.proxy.js?onload=startup	chromecache_117.1.dr	false	high
https://signaler-staging.sandbox.google.com	chromecache_136.1.dr	false	high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_120.1.dr	false	high
https://apis.google.com/js/client.js	chromecache_136.1.dr, chromecache_120.1.dr	false	high
https://support.google.com	chromecache_136.1.dr	false	high
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_120.1.dr	false	high
https://pay.google.com/gp/v/widget/save	chromecache_100.1.dr	false	high
https://support.google.com/docs/answer/49114	chromecache_136.1.dr	false	high
https://drive-thirdparty.googleusercontent.com/	chromecache_136.1.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_120.1.dr	false	high
https://sandbox.google.com/inapp/%	chromecache_120.1.dr	false	high
https://tasks.google.com/	chromecache_136.1.dr	false	high
https://www.google.com/recaptcha/api.js?trustedtypes=true	chromecache_136.1.dr	false	high
https://apis.google.com/js/api.js	chromecache_136.1.dr, chromecache_114.1.dr	false	high
https://support.google.com/docs?p=editors_encryption	chromecache_136.1.dr	false	high
https://www.youtube.com/subscribe_embed?usegapi=1	chromecache_100.1.dr	false	high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_120.1.dr	false	high
https://drive.google.com/requestreview?id=	chromecache_136.1.dr	false	high
https://support.google.com/docs/answer/13447609	chromecache_136.1.dr	false	high
https://play.google.com	chromecache_136.1.dr	false	high
https://support.google.com/inapp/%	chromecache_120.1.dr	false	high
https://support.google.com/docs/answer/15001094	chromecache_136.1.dr	false	high
https://angular.dev/license	chromecache_136.1.dr	false	high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_88.1.dr	false	high
https://www.google.com/shopping/customerreviews/badge?usegapi=1	chromecache_100.1.dr	false	high
https://lh3.googleusercontent.com/a/default-user	chromecache_114.1.dr	false	high
https://support.google.com/inapp/	chromecache_120.1.dr	false	high
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_120.1.dr	false	high
https://drive.usercontent.google.com	chromecache_136.1.dr	false	high
https://apis.google.com	chromecache_100.1.dr, chromecache_97.1.dr, chromecache_93.1.dr	false	high
https://domains.google.com/suggest/flow	chromecache_131.1.dr, chromecache_97.1.dr	false	high
https://apps-drive-picker-dev.corp.google.com/picker/minpick/main	chromecache_136.1.dr	false	high
https://feedback2-test.corp.google.com/inapp/%	chromecache_120.1.dr	false	high
https://workspace.google.com/terms/google-workspace-individual-terms/esignature-signer/	chromecache_136.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.176.206	drive.google.com	United States	15169	GOOGLEUS	false
142.251.40.228	unknown	United States	15169	GOOGLEUS	false
135.181.152.102	unknown	Germany	24940	HETZNER-ASDE	true
213.209.150.110	t9oyouthbaseball.com	Germany	197706	KEMINETAL	false
54.231.203.201	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.65.228	www.google.com	United States	15169	GOOGLEUS	false
142.251.32.110	unknown	United States	15169	GOOGLEUS	false
104.192.142.25	bitbucket.org	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.17
192.168.2.7
192.168.2.6
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1644384
Start date and time:	2025-03-20 14:47:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@30/96@94/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.41.14, 142.250.81.227, 172.253.62.84, 142.250.64.110, 142.251.41.3, 142.250.65.170, 142.250.80.35, 142.250.65.234, 172.217.165.138, 142.251.40.202, 142.251.40.234, 142.250.64.74, 142.251.41.10, 142.250.81.234, 142.251.32.106, 142.251.40.170, 142.251.40.106, 142.251.40.138, 142.250.64.106, 142.250.72.106, 142.251.35.170, 142.250.65.202, 142.250.65.174, 142.250.80.42, 142.250.176.202, 142.250.80.10, 142.250.80.106, 142.250.80.74, 142.251.40.99, 142.250.80.67, 199.232.210.172, 142.250.80.78, 142.251.40.206, 142.251.40.110, 142.250.65.238, 142.251.40.195, 142.250.176.195, 172.253.63.84, 142.250.81.238, 142.250.65.206, 142.250.80.99, 142.251.40.238, 20.12.23.50, 104.71.167.26
Excluded domains from analysis (whitelisted): clients1.google.com, fonts.googleapis.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, youtube.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, otelrules.svc.static.microsoft, content.googleapis.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, c.pki.goog
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing

Simulations

Behavior and APIs

Time	Type	Description
09:48:53	API Interceptor	1x Sleep call for process: AdobeReader.exe modified

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376832
Entropy (8bit):	6.299869631154029
Encrypted:	false
SSDEEP:	6144:xaOznA2qGo82HyJf/a+ziSOwskLwNw/BxZYbsC52+V:MOz0B4OwskzBxZ252+V
MD5:	90C805D6E27619C7480EB11BE841868E
SHA1:	7003F1E58D4D5903B7781452E719BAC7E7115CA8
SHA-256:	7E8681C26A8FA7D9B7578A6157BD072E608F68E9DD8505757E5EB3F87654685D
SHA-512:	C5504E9F1FDEDE48B9F5045854209ADC44980220D373A2E8B210B4CDEE8F7C395D4A973BC988583D5E11122C0467F4B813A462C850CD5028C25E41647C8488F7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%8.<aY@oaY@oaY@o!CndY@o!En.Y@o!DnqY@op.CnkY@op.DnpY@op.En:Y@o..DnhY@o!AnlY@oaYAo.Y@o..IneY@o..o`Y@oaY.o`Y@o..Bn`Y@oRichaY@o........PE..d......g.........."....*............`1.........@............................. ............`..................................................h...................6..............\|.......8...............................@............................................text............................... ..`.rdata...e.......f..................@..@.data...<;...........`..............@....pdata...6.......8...v..............@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 14:48:26.906054974 CET	53	58679	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:26.960155010 CET	53	61471	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:27.548170090 CET	53	60883	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:27.688783884 CET	53	55487	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:27.774480104 CET	57432	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:27.774660110 CET	58277	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:27.878500938 CET	53	57432	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:27.881059885 CET	53	58277	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:28.652373075 CET	53	55622	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:28.683455944 CET	53	51561	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:29.030822992 CET	59342	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:29.031182051 CET	63838	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:29.132191896 CET	53	59342	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:29.134371996 CET	53	63838	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:30.766230106 CET	53	59635	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:30.846995115 CET	61486	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:30.848088980 CET	55762	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:30.890111923 CET	58517	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:30.890429974 CET	59705	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:30.946712017 CET	53	61486	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:30.952013016 CET	53	55762	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:30.991889000 CET	53	55591	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:30.994297981 CET	53	59705	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:30.996748924 CET	53	58517	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:31.546962023 CET	55407	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:31.547117949 CET	65409	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:31.648031950 CET	53	65409	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:31.650166035 CET	53	55407	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:31.788084030 CET	53	62106	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:31.900548935 CET	63109	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:31.900707006 CET	53758	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:31.903048038 CET	53	65068	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.000545025 CET	53	63109	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.000901937 CET	53	52553	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.058144093 CET	53	53758	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.063360929 CET	61470	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:32.063512087 CET	63577	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:32.166316986 CET	53	61470	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.171734095 CET	53	63577	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.187345982 CET	53	55789	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.307945013 CET	53	59328	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.767936945 CET	52157	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:32.768091917 CET	54188	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:32.870985985 CET	53	54188	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:32.871336937 CET	53	52157	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:33.167376995 CET	63341	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:33.167526007 CET	63616	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:33.314265966 CET	53	63616	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:33.315567970 CET	53	63341	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:34.534771919 CET	54108	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:34.534957886 CET	53260	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:34.638905048 CET	53	54108	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:34.682527065 CET	53	53260	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:35.713207960 CET	55202	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:35.715311050 CET	55903	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:35.817594051 CET	53	55202	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:35.857743979 CET	53	55903	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:38.569046021 CET	56741	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:38.569278955 CET	65386	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:38.833852053 CET	53	56741	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:38.846776009 CET	53	65386	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:40.736943007 CET	53169	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:40.737226009 CET	53064	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:40.837053061 CET	53	53169	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:40.864083052 CET	53	53064	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:41.424015045 CET	53799	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:41.424235106 CET	64655	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:48:41.558634043 CET	53	64655	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:41.561218977 CET	53	53799	1.1.1.1	192.168.2.17
Mar 20, 2025 14:48:44.612817049 CET	53	52646	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:03.332168102 CET	53	60836	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:25.923609972 CET	53	54596	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:26.870323896 CET	53	53530	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:29.506103039 CET	63783	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:29.506366014 CET	65090	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:29.606914997 CET	53	63783	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:29.607579947 CET	53	65090	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:30.013299942 CET	53	57527	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:30.531960964 CET	55514	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:30.532111883 CET	56748	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:30.647845030 CET	53	56748	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:30.668040037 CET	53	55514	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:32.563455105 CET	50712	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:32.662754059 CET	53	50712	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:32.998716116 CET	57193	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:32.998716116 CET	61150	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:33.108809948 CET	53	57193	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:33.109622955 CET	53	61150	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:33.110044003 CET	53	60372	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:33.567722082 CET	50712	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:33.669609070 CET	53	50712	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:34.573687077 CET	50712	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:34.681504965 CET	53	50712	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:35.022754908 CET	58673	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:35.022903919 CET	50882	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:35.123449087 CET	53	58673	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:35.142535925 CET	53	50882	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:36.043935061 CET	63357	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:36.044087887 CET	56878	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:36.145761967 CET	53	56878	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:36.148432970 CET	53	63357	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:36.587735891 CET	50712	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:36.702307940 CET	53	50712	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:40.599694014 CET	50712	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:40.706815004 CET	53	50712	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:45.001442909 CET	49383	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:45.001812935 CET	55427	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:45.002255917 CET	52336	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:45.002388000 CET	62338	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:45.103199959 CET	53	55427	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:45.103627920 CET	53	62338	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:45.104032040 CET	53	52336	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:45.104072094 CET	53	49383	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:46.018156052 CET	52498	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:46.018378973 CET	52490	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:46.018625021 CET	65233	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:46.124144077 CET	53	52498	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:46.124167919 CET	53	65233	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:46.124731064 CET	53	52490	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:48.047277927 CET	56431	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:48.134429932 CET	138	138	192.168.2.17	192.168.2.255
Mar 20, 2025 14:49:48.150456905 CET	53	56431	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:49.054537058 CET	56431	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:49.157733917 CET	53	56431	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:50.061551094 CET	56431	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:50.162771940 CET	53	56431	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:52.075551987 CET	56431	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:52.176517963 CET	53	56431	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:56.089534998 CET	56431	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:49:56.192708015 CET	53	56431	1.1.1.1	192.168.2.17
Mar 20, 2025 14:49:56.992352962 CET	53	49405	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:00.106378078 CET	51735	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:00.106584072 CET	62378	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:00.206193924 CET	53	62378	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:00.207458019 CET	53	51735	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:01.004421949 CET	52084	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:01.004582882 CET	58771	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:01.005039930 CET	51757	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:01.005172014 CET	53271	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:01.108320951 CET	53	58771	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:01.108352900 CET	53	51757	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:01.108371019 CET	53	52084	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:01.108386993 CET	53	53271	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:01.129409075 CET	58504	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:01.129616022 CET	56110	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:01.232004881 CET	53	56110	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:01.234035969 CET	53	58504	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:02.023833036 CET	52704	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:02.024020910 CET	64700	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:02.125675917 CET	53	52704	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:02.125921965 CET	53	64700	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:03.160183907 CET	55319	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:03.267766953 CET	53	55319	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:04.052957058 CET	64789	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:04.157176018 CET	53	64789	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:04.164448023 CET	55319	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:04.268994093 CET	53	55319	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:05.060457945 CET	64789	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:05.161793947 CET	53	64789	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:05.171469927 CET	55319	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:05.277266026 CET	53	55319	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:06.067440033 CET	64789	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:06.167232037 CET	53	64789	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:06.200278997 CET	53	63999	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:06.712655067 CET	53	49430	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:07.185456991 CET	55319	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:07.291784048 CET	53	55319	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:08.081545115 CET	64789	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:08.187179089 CET	53	64789	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:11.196422100 CET	55319	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:11.300935030 CET	53	55319	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:12.092461109 CET	64789	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:12.194056034 CET	53	64789	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:16.101156950 CET	53559	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:16.101356983 CET	57011	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:16.206398010 CET	53	53559	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:16.207145929 CET	53	57011	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:16.999181986 CET	55224	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:16.999330997 CET	54111	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:16.999707937 CET	50110	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:16.999842882 CET	60403	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:17.103899002 CET	53	55224	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:17.104005098 CET	53	50110	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:17.105190039 CET	53	54111	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:17.123631001 CET	53683	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:17.145831108 CET	53	60403	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:17.228718996 CET	53	53683	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:18.019700050 CET	61591	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:18.019887924 CET	53399	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:18.119771957 CET	53	61591	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:18.122198105 CET	53	53399	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:19.154938936 CET	60270	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:19.255348921 CET	53	60270	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:20.050977945 CET	59985	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:20.157838106 CET	53	59985	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:20.162400961 CET	60270	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:20.264911890 CET	53	60270	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:21.058356047 CET	59985	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:21.159843922 CET	53	59985	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:21.170353889 CET	60270	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:21.272612095 CET	53	60270	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:22.066375971 CET	59985	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:22.171502113 CET	53	59985	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:23.185386896 CET	60270	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:23.293791056 CET	53	60270	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:24.080431938 CET	59985	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:24.179795980 CET	53	59985	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:27.196366072 CET	60270	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:27.297226906 CET	53	60270	1.1.1.1	192.168.2.17
Mar 20, 2025 14:50:28.092351913 CET	59985	53	192.168.2.17	1.1.1.1
Mar 20, 2025 14:50:28.193291903 CET	53	59985	1.1.1.1	192.168.2.17

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 20, 2025 14:48:28.683584929 CET	192.168.2.17	1.1.1.1	c230	(Port unreachable)	Destination Unreachable
Mar 20, 2025 14:48:32.058219910 CET	192.168.2.17	1.1.1.1	c238	(Port unreachable)	Destination Unreachable
Mar 20, 2025 14:48:34.682774067 CET	192.168.2.17	1.1.1.1	c245	(Port unreachable)	Destination Unreachable
Mar 20, 2025 14:48:35.857812881 CET	192.168.2.17	1.1.1.1	c239	(Port unreachable)	Destination Unreachable
Mar 20, 2025 14:48:40.864147902 CET	192.168.2.17	1.1.1.1	c244	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:28 UTC	919	OUT	GET /file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CLf3ygE= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:48:28 UTC	1338	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:28 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: script-src 'report-sample' 'nonce-1aovzcr8n-qX4JaebGQQ3A' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/viewer/ Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g; expires=Fri, 19-Sep-2025 13:48:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 37 30 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 31 61 6f 76 7a 63 72 38 6e 2d 71 58 34 4a 61 65 62 47 51 51 33 41 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 3d 7b 7d 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 31 61 6f 76 7a 63 72 38 6e 2d 71 58 34 4a 61 65 62 47 51 51 33 41 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 5b 27 74 66 73 27 5d 3d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 69 64 3d 22 74 65 78 6d 65 78 2d 74 68 75 6d 62 22 20 72 65 6c 3d 22 70 Data Ascii: 7006<!DOCTYPE html><html><head><script nonce="1aovzcr8n-qX4JaebGQQ3A"> window['_DRIVE_VIEWER_ctiming']={}; </script><script nonce="1aovzcr8n-qX4JaebGQQ3A"> window['_DRIVE_VIEWER_ctiming']['tfs']=performance.now(); </script><link id="texmex-thumb" rel="p
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 49 7a 49 46 4b 77 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 37 30 2d 30 33 37 37 2c 55 2b 30 33 37 41 2d 30 33 37 46 2c 55 2b 30 33 38 34 2d 30 33 38 41 2c 55 2b 30 33 38 43 2c 55 2b 30 33 38 45 2d 30 33 41 31 2c 55 2b 30 33 41 33 2d 30 33 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6b 43 6e 71 45 75 39 32 46 72 31 4d 75 35 31 78 48 49 7a 49 46 4b 77 2e 77 6f 66 66 32 29 66 6f 72 6d Data Ascii: IzIFKw.woff2)format('woff2');unicode-range:U+0370-0377,U+037A-037F,U+0384-038A,U+038C,U+038E-03A1,U+03A3-03FF;}@font-face{font-family:'Roboto';font-style:italic;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)form
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 53 55 35 66 41 42 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 30 31 2c 55 2b 30 34 30 30 2d 30 34 35 46 2c 55 2b 30 34 39 30 2d 30 34 39 31 2c 55 2b 30 34 42 30 2d 30 34 42 31 2c 55 2b 32 31 31 36 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 Data Ascii: -face{font-family:'Roboto';font-style:normal;font-weight:300;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)format('woff2');unicode-range:U+0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116;}@font-face{font-family:'Roboto';font-s
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 53 55 35 66 42 42 63 34 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 30 30 30 2d 30 30 46 46 2c 55 2b 30 31 33 31 2c 55 2b 30 31 35 32 2d 30 31 35 33 2c 55 2b 30 32 42 42 2d 30 32 42 43 2c 55 2b 30 32 43 36 2c 55 2b 30 32 44 41 2c 55 2b 30 32 44 43 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 32 30 30 30 2d 32 30 36 46 2c 55 2b 32 30 41 43 2c 55 2b 32 31 32 32 2c 55 2b 32 31 39 31 2c 55 2b 32 Data Ascii: nt-style:normal;font-weight:300;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)format('woff2');unicode-range:U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+20AC,U+2122,U+2191,U+2
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 31 31 30 2d 30 31 31 31 2c 55 2b 30 31 32 38 2d 30 31 32 39 2c 55 2b 30 31 36 38 2d 30 31 36 39 2c 55 2b 30 31 41 30 2d 30 31 41 31 2c 55 2b 30 31 41 46 2d 30 31 42 30 2c 55 2b 30 33 30 30 2d 30 33 30 31 2c 55 2b 30 33 30 33 2d 30 33 30 34 2c 55 2b 30 33 30 38 2d 30 33 30 39 2c 55 2b 30 33 32 33 2c 55 2b 30 33 32 39 2c 55 2b 31 45 41 30 2d 31 45 46 39 2c 55 2b 32 30 41 42 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f Data Ascii: 110-0111,U+0128-0129,U+0168-0169,U+01A0-01A1,U+01AF-01B0,U+0300-0301,U+0303-0304,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB;}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKO
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 31 46 30 30 2d 31 46 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 Data Ascii: atic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)format('woff2');unicode-range:U+1F00-1FFF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:500;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)format('woff2')
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 57 55 6c 66 43 52 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 34 36 30 2d 30 35 32 46 2c 55 2b 31 43 38 30 2d 31 43 38 41 2c 55 2b 32 30 42 34 2c 55 2b 32 44 45 30 2d 32 44 46 46 2c 55 2b 41 36 34 30 2d 41 36 39 46 2c 55 2b 46 45 32 45 2d 46 45 32 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f Data Ascii: t-family:'Roboto';font-style:normal;font-weight:700;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)format('woff2');unicode-range:U+0460-052F,U+1C80-1C8A,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F;}@font-face{font-family:'Roboto
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 30 2d 30 32 42 41 2c 55 2b 30 32 42 44 2d 30 32 43 35 2c 55 2b 30 32 43 37 2d 30 32 43 43 2c 55 2b 30 32 43 45 2d 30 32 44 37 2c 55 2b 30 32 44 44 2d 30 32 46 46 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 31 44 30 30 2d 31 44 42 46 2c 55 2b 31 45 30 30 2d 31 45 39 46 2c 55 2b 31 45 46 32 2d 31 45 46 46 2c 55 2b 32 30 32 30 2c 55 2b 32 30 41 30 2d 32 30 41 42 2c 55 2b 32 30 41 44 2d 32 30 43 30 2c 55 2b 32 31 31 33 2c 55 2b 32 43 36 30 2d 32 43 37 46 2c 55 2b 41 37 32 30 2d 41 37 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 Data Ascii: );unicode-range:U+0100-02BA,U+02BD-02C5,U+02C7-02CC,U+02CE-02D7,U+02DD-02FF,U+0304,U+0308,U+0329,U+1D00-1DBF,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF;}@font-face{font-family:'Roboto';font-style:normal;font-weig
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 30 30 2c 34 30 30 2c 35 30 30 2c 37 30 30 22 20 6e 6f 6e 63 65 3d 22 48 56 37 54 54 77 61 64 4b 32 4c 36 38 48 44 39 45 5a 79 35 43 41 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 5f 2f 61 70 70 73 2d 66 69 6c 65 76 69 65 77 2f 5f 2f 73 73 2f 6b 3d 61 70 70 73 2d 66 69 6c 65 76 69 65 77 2e 76 2e 72 64 65 49 6b 4d 48 6b 72 35 6b 2e 4c 2e 57 2e 4f 2f 61 6d 3d 41 42 67 2f 64 3d 30 2f 72 73 3d 41 4f 30 30 33 39 73 7a 37 65 55 67 38 6e 63 6b 4b 34 46 5f 72 4a 50 66 4b 59 37 36 51 39 50 4f 56 77 22 20 64 61 74 61 2d 69 64 3d 22 5f 63 6c 22 20 6e 6f 6e 63 65 3d 22 48 56 37 54 54 77 61 64 4b 32 4c 36 38 48 44 39 45 5a 79 35 43 41 22 3e 3c 6c 69 Data Ascii: 00,400,500,700" nonce="HV7TTwadK2L68HD9EZy5CA"><link rel="stylesheet" href="https://www.gstatic.com/_/apps-fileview/_/ss/k=apps-fileview.v.rdeIkMHkr5k.L.W.O/am=ABg/d=0/rs=AO0039sz7eUg8nckK4F_rJPfKY76Q9POVw" data-id="_cl" nonce="HV7TTwadK2L68HD9EZy5CA"><li
2025-03-20 13:48:28 UTC	1338	IN	Data Raw: 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 65 51 68 31 6a 66 5c 22 5d 2c 5b 34 35 36 38 34 31 30 38 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 49 48 77 68 44 62 5c 22 5d 2c 5b 34 35 36 37 34 32 38 35 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 7a 52 6f 47 58 63 5c 22 5d 2c 5b 34 35 36 37 39 37 31 33 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 45 45 5a 31 64 64 5c 22 5d 2c 5b 34 35 36 38 31 33 36 36 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 64 33 6d 71 79 65 5c 22 5d 2c 5b 34 35 36 34 34 36 34 32 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 58 2d 57 53 20 65 78 70 Data Ascii: ,null,null,null,\"eQh1jf\"],[45684108,null,false,null,null,null,\"IHwhDb\"],[45674285,null,false,null,null,null,\"zRoGXc\"],[45679713,null,false,null,null,null,\"EEZ1dd\"],[45681366,null,false,null,null,null,\"d3mqye\"],[45644642,null,null,null,\"X-WS exp

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:28 UTC	1006	OUT	GET /drive-viewer/AKGpihYQDW1seUtlFC7VYLfF4uRTxrEetB8Ui_0Jjey-cUFUH-1xUQxg8GlIcukHGRtfj1QOnf1LA5oAPktUW12xYN54W_TSYue5i0k=s1600-rw-v1 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
2025-03-20 13:48:28 UTC	831	IN	HTTP/1.1 200 OK Content-Type: image/webp Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: sandbox X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length ETag: "v1" Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private, max-age=86400, no-transform Content-Disposition: inline;filename="Case_ 21-50826 (105).pdf.webp" Date: Thu, 20 Mar 2025 13:48:28 GMT Server: fife Content-Length: 30512 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-20 13:48:28 UTC	389	IN	Data Raw: 52 49 46 46 28 77 00 00 57 45 42 50 56 50 38 20 1c 77 00 00 b0 1b 03 9d 01 2a 00 04 a6 05 3e b5 5a a6 4f a7 24 b4 2d a1 b3 b9 0a 80 16 89 69 6e ff a8 b9 5f 96 75 8b 8b 72 73 ce e6 4f dd 6c 5f a9 bc e1 3c 11 7a ed d2 8d fe 0f 64 dd 97 76 92 a8 ed ff 3f 99 62 3f db 9a cb ed 27 8e 48 71 e5 bf 07 7d f5 a6 25 a8 7d fd d3 9e 7c bd 1b ff 57 f5 08 fd 4c fd 42 eb b5 fb ad ea 7b ce 4b d4 0f f8 8f 52 bf eb dd 53 7e 89 7d 32 7f bb 3e 92 1a aa 1e 88 ff 25 fe 27 f6 73 c2 7f f3 5f de bf 6d ff be 7a 7b f9 3f d1 ff 97 fe fb fe 6b fd f7 f8 3f da 8f 8b 8f f2 7f ca 79 6e f4 af ec 3f e5 ff a6 f5 3f f9 4f dd 4f d4 7f 73 ff 2d ff 77 fc 8f cd 3f e6 3f e1 fd ce 7a 3f f2 17 fc 3f ef ff 91 5f 21 1f 94 7f 3b ff 5b fd c7 f7 87 fc 3f 11 9e e1 ff 1b fe 97 a8 2f b1 ff 5d ff 8f fe 1f fd Data Ascii: RIFF(wWEBPVP8 w*>ZO$-in_ursOl_<zdv?b?'Hq}%}\|WLB{KRS~}2>%'s_mz{?k?yn??OOs-w??z??_!;[?/]
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: 02 b9 e4 0b 26 be 98 ac 0f 3a 61 af a9 6c c8 ba 04 7c 66 e3 2f dd 81 a4 f2 10 37 d7 81 e3 94 98 ed ce 96 ce c9 51 5d a9 a5 13 ce 5e a6 fa b8 f1 fc 41 03 96 bb 45 10 80 e2 36 01 fe bc 35 db de cc 3f db 42 c9 df b9 29 97 53 1a 4a 74 c9 25 45 c9 16 f4 31 a6 bd 4d 4a e3 02 10 ac c8 fe 85 16 8f cd 88 a4 4b 72 34 0a 53 2f fe c5 1e e1 22 ad b1 47 b0 41 04 58 a8 0d f6 d6 b8 f5 da b8 bb b2 14 a1 f7 ff 3d 36 36 9b e4 7b ce 38 59 41 eb 25 4c 46 e0 0f 5f 36 02 a2 7e 27 69 4e bb 97 ad e6 78 b6 97 8d 3b af 87 0c 2d c8 f1 50 de a9 54 4f b3 36 55 f1 a4 20 65 e3 dc 5c 36 14 18 75 80 48 d2 4b e9 4d 7a ac 51 1c 65 33 c9 4e 96 14 22 92 14 53 0d fe 44 ec a7 6f d2 7f 04 3f b2 7f c7 2a 4b 3a b0 32 50 44 09 d6 03 b6 51 28 3c ec 28 7c c7 4e 72 6f 9a ee 4b 26 4e 69 bb 82 1f 48 8a Data Ascii: &:al\|f/7Q]^AE65?B)SJt%E1MJKr4S/"GAX=66{8YA%LF_6~'iNx;-PTO6U e\6uHKMzQe3N"SDo?*K:2PDQ(<(\|NroK&NiH
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: 8c 7b c8 71 c3 72 36 df e7 17 f8 c6 58 59 82 f5 dd 5b f0 a0 b7 a0 cf 9f 2c ad 13 a2 4d 40 72 ff a6 e7 ac 7a 8b ad 27 63 58 66 d5 fc 4e 2b 59 ce 43 c7 19 f7 8c 5e 01 20 6f 27 2f d7 73 59 82 5e 28 d9 71 31 8f ea 26 0d 4a e9 b5 b7 32 89 90 64 a3 c2 de 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7b c8 74 b9 af 87 bb 18 f4 81 a9 86 52 89 b2 13 b5 27 04 ac b7 bf e1 75 11 b6 f6 5c 9a ee ee af 37 d2 61 43 58 30 7c 15 5a 30 7b d2 9c 9f 46 5a fe 60 19 b6 27 b1 29 37 80 db bf 0f b9 a4 68 65 6c 47 4d d4 33 fe 9a c0 b7 7b fc 54 b4 40 dc 87 76 31 ef 21 d2 e6 be 1e ec 63 de 43 a5 cd 7c 3d d8 c7 bc 87 4b b5 68 41 b7 27 2c 2f 35 f0 f7 63 1e f2 1d 2e 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7b c8 74 b9 af 87 bb 18 f7 90 e9 73 5f 0f 76 31 ef 21 d2 e6 be 1e ec 63 de 43 a5 cd 7c 3d d8 c7 Data Ascii: {qr6XY[,M@rz'cXfN+YC^ o'/sY^(q1&J2dk=:\{tR'u\7aCX0\|Z0{FZ`')7helGM3{T@v1!cC\|=KhA',/5c.k=:\{ts_v1!cC\|=
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: c3 7a 15 06 05 5b b1 8f 79 0e 97 35 f0 f7 63 1e f2 1d 2e 6b e1 ee c5 bd 9e 63 44 28 47 72 93 8c 25 af 85 ba 66 96 11 bf 14 e0 12 fc be c3 4b 26 67 9a 42 13 06 f1 7b f9 ba 21 e8 e4 36 5b a5 a9 bb 21 30 bb 18 67 9b b1 f3 aa b2 46 e3 c3 dd 8c 7b c8 74 b9 af 87 bb 18 d7 5d 91 8e 81 f3 79 df b4 8c 12 93 c7 85 49 c6 28 f1 39 5f 94 7d 13 5c 78 02 40 ae f4 3c 91 38 bb 46 e5 1f da 27 66 05 d2 74 7a f6 39 3a 9a 61 d7 76 e8 4c e4 b5 a5 15 51 71 2e 97 e0 58 e1 5d 57 4a 6d f6 93 24 b5 1b c6 02 93 1c de 2d 29 c0 25 f0 c3 5c 7a cf a4 20 b1 8e 16 87 0e 97 35 f0 f7 63 1e f2 1d 2e 6c 26 41 7d 5f 1e ad fd 6a c7 a4 c2 a4 e3 16 50 c0 52 13 3c f4 ea 4e c9 c5 ed 3b c2 3f 63 33 03 49 9c 80 21 12 6e 8f af 41 82 91 dd 37 fe a7 de d3 f6 34 f4 37 87 48 15 c6 4a 7e d1 f7 2c fc 90 97 Data Ascii: z[y5c.kcD(Gr%fK&gB{!6[!0gF{t]yI(9_}\x@<8F'ftz9:avLQq.X]WJm$-)%\z 5c.l&A}_jPR<N;?c3I!nA747HJ~,
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: 0f 76 31 ef 21 d2 e6 be 1e ec 63 5c 8d 69 97 b9 0f 3b 6d 53 f3 1f 1a dc 82 47 1e 94 98 e6 f1 69 4e 01 49 8e 6f 16 94 e0 14 98 e6 f1 69 4e 01 49 8e 6f 16 94 e0 14 98 cc 2e 81 c2 35 eb 22 c5 0a 7a 7f 21 d2 e6 be 1e ec 63 de 43 a5 cc 03 89 50 7e fd 6a 31 05 1d b7 0e ba 92 a4 62 15 da 26 da ab de 78 30 c0 28 36 dc 21 70 50 3b ef 98 e8 29 a1 db 3d d1 98 26 5b 70 19 b9 bd 5d 63 8b d5 36 0a e6 20 9a 9f 57 c9 67 92 8a 7a 77 9d 82 ad 0d f0 6f 09 4a cd ef 3b 60 2e 40 7a 6b c8 10 f1 57 93 dc c6 7b 52 49 a3 d1 84 e2 28 be 13 0e b1 9c 8d 38 23 13 8e db 00 af 0f 91 49 f5 07 bb 18 f7 90 e9 73 5f 0f 76 31 ef 21 c8 c9 be 6c 91 16 e3 86 74 30 45 40 01 22 65 6f d1 e3 2c f7 8c 33 cd 1f f7 e3 75 2d f4 f1 ff 7e 37 50 5c 8c 6f 5b b9 b3 fe 01 f4 ad fa 6b 7d 27 bf f1 21 98 6f 7c Data Ascii: v1!c\i;mSGiNIoiNIo.5"z!cCP~j1b&x0(6!pP;)=&[p]c6 WgzwoJ;`.@zkW{RI(8#Is_v1!lt0E@"eo,3u-~7P\o[k}'!o\|
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7a 33 51 b3 f7 bc 0a 32 2a 06 a2 f8 1b 39 4f 19 e7 1c 58 80 d4 07 e1 ea 28 8c 3d c1 6f 88 85 e3 5c 81 38 e3 ae 0c c7 b1 62 86 7d b7 92 e8 74 3f 53 54 eb b8 06 50 fe da 43 9c eb 87 cc d3 0a bd 52 e3 1e f2 1d 2e 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7b c8 74 b9 af 86 cb c8 dd ad 1c cc 21 a7 f9 f6 bb 88 6e 68 8c 07 18 f8 ba d6 03 d7 c5 23 b2 9a 2f f9 ae 55 cb dd 0f fc 07 9d 06 20 bb 33 52 c3 f5 bc 67 80 e9 3e 23 b7 a0 e1 f3 d6 08 63 d6 c6 84 c7 86 f1 0e 97 35 f0 f7 63 1e f2 1d 2e 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7a 31 20 da 90 99 d2 c1 be ae 40 c7 67 8e 37 a1 57 e8 22 a9 89 41 d2 df b8 de e7 6d ae 10 0c e4 b6 45 84 76 fe 4f 8d 55 6a e2 46 a9 a4 01 53 5c 7c 2f 0f 08 09 1f 9f d2 ae c0 76 fe 1e ec 63 de 43 a5 cd 7c 3d d8 c7 Data Ascii: k=:\z3Q2*9OX(=o\8b}t?STPCR.k=:\{t!nh#/U 3Rg>#c5c.k=:\z1 @g7W"AmEvOUjFS\\|/vcC\|=
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: bb e8 d1 77 95 ff 06 7e 26 f3 12 6e 00 1a 4d a9 d2 31 5d e2 d5 41 91 a2 e4 36 ab 50 34 6a bc e2 7c cf e8 d6 ed d8 7f 1d 59 60 71 7d f1 cb 49 18 71 5e 26 3c 29 12 fb 24 29 3e 1c 0d b9 ab e2 35 5c 5b 49 98 da fb 6f f1 c3 59 df 4b 1f fd e4 76 f0 1e 23 67 79 32 0c fd 13 56 c6 75 c9 68 0f a8 ea 85 36 41 19 dd b6 3c 37 b6 02 f2 b4 fe a0 ec ba 56 bd 7f 8d 18 07 87 23 66 ff f4 ec 6d 24 5c 6a 80 7a 45 9b cc f5 57 c6 44 c2 9c 34 ef 39 05 9c 82 97 55 94 66 b8 51 f3 2e 36 8b aa a0 3e 2c bc 16 8f e7 14 36 08 c8 e8 79 84 5e 52 00 e2 24 15 f8 ed a9 0c 59 ca 31 9d a6 ad 14 b1 60 6e bc 1f 08 cb 41 95 3e 25 8b ea d8 d7 18 7d 8e 45 dc 6a be 52 68 25 f5 f3 b8 60 3c 12 e6 2a 43 36 ff bd da 32 4f 7a 49 85 5b 67 b8 87 52 8f ce 99 fe 63 7f 46 a7 27 54 42 21 b5 9d 96 26 d1 3d 2e Data Ascii: w~&nM1]A6P4j\|Y`q}Iq^&<)$)>5\[IoYKv#gy2Vuh6A<7V#fm$\jzEWD49UfQ.6>,6y^R$Y1`nA>%}EjRh%`<*C62OzI[gRcF'TB!&=.
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: 82 e5 d2 bb 44 ed 4e ad 63 05 ed ed c4 90 44 d4 40 7f f5 b7 d1 76 e4 90 47 46 91 4a 1a 6e aa 94 ee 56 ae e2 78 ce e8 1a db d7 70 e2 a2 82 67 10 35 2b 8c 6d 0d fb 24 5f 0e 20 39 fc e6 f2 e1 a5 67 00 46 85 23 1f f7 2e 35 39 1b b8 76 e6 e0 b8 70 01 a0 ce 6c 30 1d c8 69 db 8c 0c 40 79 e7 43 c7 e0 95 8a 72 2a e4 c4 7b d1 9e 9d b1 8c 8d d4 75 3b cd fa 60 18 c5 ca 69 54 f4 da e5 55 a3 ed 8f 24 98 74 8e 6a e5 f3 d6 bc b3 fa 3b f9 1d 8f 97 ea 0d a2 e0 f5 5f f2 e7 d1 d5 4d 55 70 9b 75 46 95 17 15 cc 38 c8 00 3c a4 22 cc 74 e4 e4 b4 18 1a 03 63 62 ee c5 00 b8 dc 2a cc 85 8c 46 a8 88 6c d2 fc 5b db 23 6d 92 a8 95 31 dd c9 11 44 0d 44 e5 31 99 3a 7c 02 c4 a4 7a 3e 7d 60 84 c0 bf b8 0a 35 69 49 8e 80 2a 9d 13 78 59 0b 49 82 38 25 2d ae af 24 9b 2a b9 8e d1 e1 f6 13 e4 Data Ascii: DNcD@vGFJnVxpg5+m$_ 9gF#.59vpl0i@yCr{u;`iTU$tj;_MUpuF8<"tcbFl[#m1DD1:\|z>}`5iIxYI8%-$
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: dd d3 1a 0f f2 42 02 68 5f 1c 33 90 be 99 21 3a 36 7f 75 c0 f6 f6 b2 1f cf f0 f3 a7 96 a9 98 05 d5 93 95 77 be 6b 3a 88 58 6d 5b 9e c1 46 ac 75 1d d5 69 da 44 d3 8c 57 e6 3c f7 c0 8e 62 f6 fe 19 73 7a cf 2e 32 a7 95 bc 0a f3 ca a0 29 40 c3 11 bc e9 5e 48 f4 26 a6 f3 cf f4 11 a9 eb 26 d2 13 67 11 52 30 35 6d c2 95 fe 8a 87 c9 f0 51 a1 7e b2 16 7b 8a 37 e9 06 06 50 80 94 df 74 a0 8e 4c 02 57 4f c0 91 ae 79 0c b9 1f 0a e1 f7 d5 6e 1f 19 5a 54 56 81 d4 8c d9 06 11 3e 8b 5c cc d6 8a af e8 53 90 ec fb 07 dd d3 59 05 50 8b e6 bc 37 b3 9f e4 33 f1 63 c1 07 f0 fa c2 82 a8 8e 4a 60 69 5d 32 ba c7 b0 d7 7f c7 b0 aa e6 0b f9 da 3c 3c a8 f7 73 20 b4 07 19 dd d7 3b 92 c0 9d ec e8 f1 f7 02 9f e2 10 b7 4a e8 ab 18 7e 2f 66 10 c0 12 99 20 dc 86 26 44 b9 fc 4b c1 ae 56 d4 Data Ascii: Bh_3!:6uwk:Xm[FuiDW<bsz.2)@^H&&gR05mQ~{7PtLWOynZTV>\SYP73cJ`i]2<<s ;J~/f &DKV
2025-03-20 13:48:28 UTC	1220	IN	Data Raw: 94 00 43 1d 02 3d f0 4e 10 85 37 b0 a3 fe b5 52 a4 87 ba 66 de 81 c5 23 53 f5 60 df 33 d2 f4 4f 0e 0e a3 b8 ac 77 75 8d 49 53 8b 88 0b 32 e1 84 1b c4 07 35 54 c5 ea 4b a8 3a b7 23 ca b3 52 53 04 1b d6 82 9e a9 bf df e2 7e eb 9d 31 d2 f6 07 77 48 67 82 3d 13 02 7f 32 34 5e f5 8f bc c7 32 5b 5c a6 70 b5 96 82 11 7e cd 1b df e5 db 92 c3 22 f7 08 4f 46 9c 9a 3f 8d 5d 0b 55 8f 3f 6c 1f f7 c4 ea b1 d9 bf be eb b7 61 0e b0 4b d1 6f 98 5c bc 8b c9 18 3b a7 1d f7 02 99 70 8c ee 0d b9 79 a9 a5 46 6a 84 55 61 d1 10 bf e1 1d 5b 18 c4 4b 47 f3 ea 3f 10 5c be 79 1e 7a 61 bc f1 7b 67 6c d7 7b 13 40 96 51 4a d0 eb 02 d1 ac 4c 66 d9 53 02 ad 56 2e 87 60 17 00 d8 3f 63 e8 ee c7 1d b9 fe ba 9b d6 9f 17 e9 b8 f3 f4 09 35 59 03 40 f9 9c ca 95 c1 a3 a8 1a 40 53 26 f9 e5 95 5c Data Ascii: C=N7Rf#S`3OwuIS25TK:#RS~1wHg=24^2[\p~"OF?]U?laKo\;pyFjUa[KG?\yza{gl{@QJLfSV.`?c5Y@@S&\

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:29 UTC	745	OUT	GET /drive-viewer/AKGpihYQDW1seUtlFC7VYLfF4uRTxrEetB8Ui_0Jjey-cUFUH-1xUQxg8GlIcukHGRtfj1QOnf1LA5oAPktUW12xYN54W_TSYue5i0k=s1600-rw-v1 HTTP/1.1 Host: drive.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
2025-03-20 13:48:29 UTC	831	IN	HTTP/1.1 200 OK Content-Type: image/webp Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: sandbox X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length ETag: "v1" Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private, max-age=86400, no-transform Content-Disposition: inline;filename="Case_ 21-50826 (105).pdf.webp" Date: Thu, 20 Mar 2025 13:48:29 GMT Server: fife Content-Length: 30512 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-20 13:48:29 UTC	389	IN	Data Raw: 52 49 46 46 28 77 00 00 57 45 42 50 56 50 38 20 1c 77 00 00 b0 1b 03 9d 01 2a 00 04 a6 05 3e b5 5a a6 4f a7 24 b4 2d a1 b3 b9 0a 80 16 89 69 6e ff a8 b9 5f 96 75 8b 8b 72 73 ce e6 4f dd 6c 5f a9 bc e1 3c 11 7a ed d2 8d fe 0f 64 dd 97 76 92 a8 ed ff 3f 99 62 3f db 9a cb ed 27 8e 48 71 e5 bf 07 7d f5 a6 25 a8 7d fd d3 9e 7c bd 1b ff 57 f5 08 fd 4c fd 42 eb b5 fb ad ea 7b ce 4b d4 0f f8 8f 52 bf eb dd 53 7e 89 7d 32 7f bb 3e 92 1a aa 1e 88 ff 25 fe 27 f6 73 c2 7f f3 5f de bf 6d ff be 7a 7b f9 3f d1 ff 97 fe fb fe 6b fd f7 f8 3f da 8f 8b 8f f2 7f ca 79 6e f4 af ec 3f e5 ff a6 f5 3f f9 4f dd 4f d4 7f 73 ff 2d ff 77 fc 8f cd 3f e6 3f e1 fd ce 7a 3f f2 17 fc 3f ef ff 91 5f 21 1f 94 7f 3b ff 5b fd c7 f7 87 fc 3f 11 9e e1 ff 1b fe 97 a8 2f b1 ff 5d ff 8f fe 1f fd Data Ascii: RIFF(wWEBPVP8 w*>ZO$-in_ursOl_<zdv?b?'Hq}%}\|WLB{KRS~}2>%'s_mz{?k?yn??OOs-w??z??_!;[?/]
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: 02 b9 e4 0b 26 be 98 ac 0f 3a 61 af a9 6c c8 ba 04 7c 66 e3 2f dd 81 a4 f2 10 37 d7 81 e3 94 98 ed ce 96 ce c9 51 5d a9 a5 13 ce 5e a6 fa b8 f1 fc 41 03 96 bb 45 10 80 e2 36 01 fe bc 35 db de cc 3f db 42 c9 df b9 29 97 53 1a 4a 74 c9 25 45 c9 16 f4 31 a6 bd 4d 4a e3 02 10 ac c8 fe 85 16 8f cd 88 a4 4b 72 34 0a 53 2f fe c5 1e e1 22 ad b1 47 b0 41 04 58 a8 0d f6 d6 b8 f5 da b8 bb b2 14 a1 f7 ff 3d 36 36 9b e4 7b ce 38 59 41 eb 25 4c 46 e0 0f 5f 36 02 a2 7e 27 69 4e bb 97 ad e6 78 b6 97 8d 3b af 87 0c 2d c8 f1 50 de a9 54 4f b3 36 55 f1 a4 20 65 e3 dc 5c 36 14 18 75 80 48 d2 4b e9 4d 7a ac 51 1c 65 33 c9 4e 96 14 22 92 14 53 0d fe 44 ec a7 6f d2 7f 04 3f b2 7f c7 2a 4b 3a b0 32 50 44 09 d6 03 b6 51 28 3c ec 28 7c c7 4e 72 6f 9a ee 4b 26 4e 69 bb 82 1f 48 8a Data Ascii: &:al\|f/7Q]^AE65?B)SJt%E1MJKr4S/"GAX=66{8YA%LF_6~'iNx;-PTO6U e\6uHKMzQe3N"SDo?*K:2PDQ(<(\|NroK&NiH
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: 8c 7b c8 71 c3 72 36 df e7 17 f8 c6 58 59 82 f5 dd 5b f0 a0 b7 a0 cf 9f 2c ad 13 a2 4d 40 72 ff a6 e7 ac 7a 8b ad 27 63 58 66 d5 fc 4e 2b 59 ce 43 c7 19 f7 8c 5e 01 20 6f 27 2f d7 73 59 82 5e 28 d9 71 31 8f ea 26 0d 4a e9 b5 b7 32 89 90 64 a3 c2 de 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7b c8 74 b9 af 87 bb 18 f4 81 a9 86 52 89 b2 13 b5 27 04 ac b7 bf e1 75 11 b6 f6 5c 9a ee ee af 37 d2 61 43 58 30 7c 15 5a 30 7b d2 9c 9f 46 5a fe 60 19 b6 27 b1 29 37 80 db bf 0f b9 a4 68 65 6c 47 4d d4 33 fe 9a c0 b7 7b fc 54 b4 40 dc 87 76 31 ef 21 d2 e6 be 1e ec 63 de 43 a5 cd 7c 3d d8 c7 bc 87 4b b5 68 41 b7 27 2c 2f 35 f0 f7 63 1e f2 1d 2e 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7b c8 74 b9 af 87 bb 18 f7 90 e9 73 5f 0f 76 31 ef 21 d2 e6 be 1e ec 63 de 43 a5 cd 7c 3d d8 c7 Data Ascii: {qr6XY[,M@rz'cXfN+YC^ o'/sY^(q1&J2dk=:\{tR'u\7aCX0\|Z0{FZ`')7helGM3{T@v1!cC\|=KhA',/5c.k=:\{ts_v1!cC\|=
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: c3 7a 15 06 05 5b b1 8f 79 0e 97 35 f0 f7 63 1e f2 1d 2e 6b e1 ee c5 bd 9e 63 44 28 47 72 93 8c 25 af 85 ba 66 96 11 bf 14 e0 12 fc be c3 4b 26 67 9a 42 13 06 f1 7b f9 ba 21 e8 e4 36 5b a5 a9 bb 21 30 bb 18 67 9b b1 f3 aa b2 46 e3 c3 dd 8c 7b c8 74 b9 af 87 bb 18 d7 5d 91 8e 81 f3 79 df b4 8c 12 93 c7 85 49 c6 28 f1 39 5f 94 7d 13 5c 78 02 40 ae f4 3c 91 38 bb 46 e5 1f da 27 66 05 d2 74 7a f6 39 3a 9a 61 d7 76 e8 4c e4 b5 a5 15 51 71 2e 97 e0 58 e1 5d 57 4a 6d f6 93 24 b5 1b c6 02 93 1c de 2d 29 c0 25 f0 c3 5c 7a cf a4 20 b1 8e 16 87 0e 97 35 f0 f7 63 1e f2 1d 2e 6c 26 41 7d 5f 1e ad fd 6a c7 a4 c2 a4 e3 16 50 c0 52 13 3c f4 ea 4e c9 c5 ed 3b c2 3f 63 33 03 49 9c 80 21 12 6e 8f af 41 82 91 dd 37 fe a7 de d3 f6 34 f4 37 87 48 15 c6 4a 7e d1 f7 2c fc 90 97 Data Ascii: z[y5c.kcD(Gr%fK&gB{!6[!0gF{t]yI(9_}\x@<8F'ftz9:avLQq.X]WJm$-)%\z 5c.l&A}_jPR<N;?c3I!nA747HJ~,
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: 0f 76 31 ef 21 d2 e6 be 1e ec 63 5c 8d 69 97 b9 0f 3b 6d 53 f3 1f 1a dc 82 47 1e 94 98 e6 f1 69 4e 01 49 8e 6f 16 94 e0 14 98 e6 f1 69 4e 01 49 8e 6f 16 94 e0 14 98 cc 2e 81 c2 35 eb 22 c5 0a 7a 7f 21 d2 e6 be 1e ec 63 de 43 a5 cc 03 89 50 7e fd 6a 31 05 1d b7 0e ba 92 a4 62 15 da 26 da ab de 78 30 c0 28 36 dc 21 70 50 3b ef 98 e8 29 a1 db 3d d1 98 26 5b 70 19 b9 bd 5d 63 8b d5 36 0a e6 20 9a 9f 57 c9 67 92 8a 7a 77 9d 82 ad 0d f0 6f 09 4a cd ef 3b 60 2e 40 7a 6b c8 10 f1 57 93 dc c6 7b 52 49 a3 d1 84 e2 28 be 13 0e b1 9c 8d 38 23 13 8e db 00 af 0f 91 49 f5 07 bb 18 f7 90 e9 73 5f 0f 76 31 ef 21 c8 c9 be 6c 91 16 e3 86 74 30 45 40 01 22 65 6f d1 e3 2c f7 8c 33 cd 1f f7 e3 75 2d f4 f1 ff 7e 37 50 5c 8c 6f 5b b9 b3 fe 01 f4 ad fa 6b 7d 27 bf f1 21 98 6f 7c Data Ascii: v1!c\i;mSGiNIoiNIo.5"z!cCP~j1b&x0(6!pP;)=&[p]c6 WgzwoJ;`.@zkW{RI(8#Is_v1!lt0E@"eo,3u-~7P\o[k}'!o\|
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7a 33 51 b3 f7 bc 0a 32 2a 06 a2 f8 1b 39 4f 19 e7 1c 58 80 d4 07 e1 ea 28 8c 3d c1 6f 88 85 e3 5c 81 38 e3 ae 0c c7 b1 62 86 7d b7 92 e8 74 3f 53 54 eb b8 06 50 fe da 43 9c eb 87 cc d3 0a bd 52 e3 1e f2 1d 2e 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7b c8 74 b9 af 86 cb c8 dd ad 1c cc 21 a7 f9 f6 bb 88 6e 68 8c 07 18 f8 ba d6 03 d7 c5 23 b2 9a 2f f9 ae 55 cb dd 0f fc 07 9d 06 20 bb 33 52 c3 f5 bc 67 80 e9 3e 23 b7 a0 e1 f3 d6 08 63 d6 c6 84 c7 86 f1 0e 97 35 f0 f7 63 1e f2 1d 2e 6b e1 ee c6 3d e4 3a 5c d7 c3 dd 8c 7a 31 20 da 90 99 d2 c1 be ae 40 c7 67 8e 37 a1 57 e8 22 a9 89 41 d2 df b8 de e7 6d ae 10 0c e4 b6 45 84 76 fe 4f 8d 55 6a e2 46 a9 a4 01 53 5c 7c 2f 0f 08 09 1f 9f d2 ae c0 76 fe 1e ec 63 de 43 a5 cd 7c 3d d8 c7 Data Ascii: k=:\z3Q2*9OX(=o\8b}t?STPCR.k=:\{t!nh#/U 3Rg>#c5c.k=:\z1 @g7W"AmEvOUjFS\\|/vcC\|=
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: bb e8 d1 77 95 ff 06 7e 26 f3 12 6e 00 1a 4d a9 d2 31 5d e2 d5 41 91 a2 e4 36 ab 50 34 6a bc e2 7c cf e8 d6 ed d8 7f 1d 59 60 71 7d f1 cb 49 18 71 5e 26 3c 29 12 fb 24 29 3e 1c 0d b9 ab e2 35 5c 5b 49 98 da fb 6f f1 c3 59 df 4b 1f fd e4 76 f0 1e 23 67 79 32 0c fd 13 56 c6 75 c9 68 0f a8 ea 85 36 41 19 dd b6 3c 37 b6 02 f2 b4 fe a0 ec ba 56 bd 7f 8d 18 07 87 23 66 ff f4 ec 6d 24 5c 6a 80 7a 45 9b cc f5 57 c6 44 c2 9c 34 ef 39 05 9c 82 97 55 94 66 b8 51 f3 2e 36 8b aa a0 3e 2c bc 16 8f e7 14 36 08 c8 e8 79 84 5e 52 00 e2 24 15 f8 ed a9 0c 59 ca 31 9d a6 ad 14 b1 60 6e bc 1f 08 cb 41 95 3e 25 8b ea d8 d7 18 7d 8e 45 dc 6a be 52 68 25 f5 f3 b8 60 3c 12 e6 2a 43 36 ff bd da 32 4f 7a 49 85 5b 67 b8 87 52 8f ce 99 fe 63 7f 46 a7 27 54 42 21 b5 9d 96 26 d1 3d 2e Data Ascii: w~&nM1]A6P4j\|Y`q}Iq^&<)$)>5\[IoYKv#gy2Vuh6A<7V#fm$\jzEWD49UfQ.6>,6y^R$Y1`nA>%}EjRh%`<*C62OzI[gRcF'TB!&=.
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: 82 e5 d2 bb 44 ed 4e ad 63 05 ed ed c4 90 44 d4 40 7f f5 b7 d1 76 e4 90 47 46 91 4a 1a 6e aa 94 ee 56 ae e2 78 ce e8 1a db d7 70 e2 a2 82 67 10 35 2b 8c 6d 0d fb 24 5f 0e 20 39 fc e6 f2 e1 a5 67 00 46 85 23 1f f7 2e 35 39 1b b8 76 e6 e0 b8 70 01 a0 ce 6c 30 1d c8 69 db 8c 0c 40 79 e7 43 c7 e0 95 8a 72 2a e4 c4 7b d1 9e 9d b1 8c 8d d4 75 3b cd fa 60 18 c5 ca 69 54 f4 da e5 55 a3 ed 8f 24 98 74 8e 6a e5 f3 d6 bc b3 fa 3b f9 1d 8f 97 ea 0d a2 e0 f5 5f f2 e7 d1 d5 4d 55 70 9b 75 46 95 17 15 cc 38 c8 00 3c a4 22 cc 74 e4 e4 b4 18 1a 03 63 62 ee c5 00 b8 dc 2a cc 85 8c 46 a8 88 6c d2 fc 5b db 23 6d 92 a8 95 31 dd c9 11 44 0d 44 e5 31 99 3a 7c 02 c4 a4 7a 3e 7d 60 84 c0 bf b8 0a 35 69 49 8e 80 2a 9d 13 78 59 0b 49 82 38 25 2d ae af 24 9b 2a b9 8e d1 e1 f6 13 e4 Data Ascii: DNcD@vGFJnVxpg5+m$_ 9gF#.59vpl0i@yCr{u;`iTU$tj;_MUpuF8<"tcbFl[#m1DD1:\|z>}`5iIxYI8%-$
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: dd d3 1a 0f f2 42 02 68 5f 1c 33 90 be 99 21 3a 36 7f 75 c0 f6 f6 b2 1f cf f0 f3 a7 96 a9 98 05 d5 93 95 77 be 6b 3a 88 58 6d 5b 9e c1 46 ac 75 1d d5 69 da 44 d3 8c 57 e6 3c f7 c0 8e 62 f6 fe 19 73 7a cf 2e 32 a7 95 bc 0a f3 ca a0 29 40 c3 11 bc e9 5e 48 f4 26 a6 f3 cf f4 11 a9 eb 26 d2 13 67 11 52 30 35 6d c2 95 fe 8a 87 c9 f0 51 a1 7e b2 16 7b 8a 37 e9 06 06 50 80 94 df 74 a0 8e 4c 02 57 4f c0 91 ae 79 0c b9 1f 0a e1 f7 d5 6e 1f 19 5a 54 56 81 d4 8c d9 06 11 3e 8b 5c cc d6 8a af e8 53 90 ec fb 07 dd d3 59 05 50 8b e6 bc 37 b3 9f e4 33 f1 63 c1 07 f0 fa c2 82 a8 8e 4a 60 69 5d 32 ba c7 b0 d7 7f c7 b0 aa e6 0b f9 da 3c 3c a8 f7 73 20 b4 07 19 dd d7 3b 92 c0 9d ec e8 f1 f7 02 9f e2 10 b7 4a e8 ab 18 7e 2f 66 10 c0 12 99 20 dc 86 26 44 b9 fc 4b c1 ae 56 d4 Data Ascii: Bh_3!:6uwk:Xm[FuiDW<bsz.2)@^H&&gR05mQ~{7PtLWOynZTV>\SYP73cJ`i]2<<s ;J~/f &DKV
2025-03-20 13:48:29 UTC	1220	IN	Data Raw: 94 00 43 1d 02 3d f0 4e 10 85 37 b0 a3 fe b5 52 a4 87 ba 66 de 81 c5 23 53 f5 60 df 33 d2 f4 4f 0e 0e a3 b8 ac 77 75 8d 49 53 8b 88 0b 32 e1 84 1b c4 07 35 54 c5 ea 4b a8 3a b7 23 ca b3 52 53 04 1b d6 82 9e a9 bf df e2 7e eb 9d 31 d2 f6 07 77 48 67 82 3d 13 02 7f 32 34 5e f5 8f bc c7 32 5b 5c a6 70 b5 96 82 11 7e cd 1b df e5 db 92 c3 22 f7 08 4f 46 9c 9a 3f 8d 5d 0b 55 8f 3f 6c 1f f7 c4 ea b1 d9 bf be eb b7 61 0e b0 4b d1 6f 98 5c bc 8b c9 18 3b a7 1d f7 02 99 70 8c ee 0d b9 79 a9 a5 46 6a 84 55 61 d1 10 bf e1 1d 5b 18 c4 4b 47 f3 ea 3f 10 5c be 79 1e 7a 61 bc f1 7b 67 6c d7 7b 13 40 96 51 4a d0 eb 02 d1 ac 4c 66 d9 53 02 ad 56 2e 87 60 17 00 d8 3f 63 e8 ee c7 1d b9 fe ba 9b d6 9f 17 e9 b8 f3 f4 09 35 59 03 40 f9 9c ca 95 c1 a3 a8 1a 40 53 26 f9 e5 95 5c Data Ascii: C=N7Rf#S`3OwuIS25TK:#RS~1wHg=24^2[\p~"OF?]U?laKo\;pyFjUa[KG?\yza{gl{@QJLfSV.`?c5Y@@S&\

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:30 UTC	1106	OUT	GET /auth_warmup HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
2025-03-20 13:48:30 UTC	1731	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:30 GMT Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Resource-Policy: same-site Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveOsidBootstrap/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-2DrihCSx4Bk0_3h-XnVcSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveOsidBootstrap/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveOsidBootstrap/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/DriveOsidBootstrap/web-reports?context=eJzj4tDikmJw1JBiEOLhWLfzwz42gQkv7m1jVlJNyi-MTynKLEvNKCkpSCzILE4tKkstijcyMDI1MDY01jMwii8wAABxlRRV" Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:31 UTC	1227	OUT	GET /drivesharing/clientmodel?id=1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2&foreignService=texmex&authuser=0&origin=https%3A%2F%2Fdrive.google.com HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
2025-03-20 13:48:31 UTC	3597	IN	HTTP/1.1 302 Found Content-Type: application/binary X-Frame-Options: ALLOW-FROM https://drive.google.com Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Content-Security-Policy: frame-ancestors https://drive.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /drivesharing/_/DriveShareDialogUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pZV7wT1fDpgcp1yvj2ejgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /drivesharing/_/DriveShareDialogUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /drivesharing/_/DriveShareDialogUi/cspreport/allowlist Location: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://drive.google.com/drivesharing/clientmodel?id%3D1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps://drive.google.com&followup=https://drive.google.com/drivesharing/clientmodel?id%3D1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps://drive.google.com Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Resource-Policy: same-site Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.google.com/js/bg/ https://translate.google.com/translate_a/element.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.goo [TRUNCATED] Cross-Origin-Opener-Policy: same-origin Date: Thu, 20 Mar 2025 13:48:31 GMT Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:31 UTC	1320	OUT	GET /viewerng/upload?ds=APznzaaun2iLCbSGK5krodng5O7FdYrhAfmrIfxFoRxXcRtlIqqAMVdDMUHRacK3B_1fZLDyUmQaxYlRQurgcKcHf0moupD57zKCp1wJSee__jB4GCxPBiu7avs9lxXyaLJEh4LoMVTbpzQZLBL_iABT1gJ6Tn916pay8ISjAmMv1GElC41xYZSthpQRSoXsfbqHLfIhhJuXP00ULpYJuT1OiN6meu0zDrnD46ej1Qzu3arCOAYKjkJxmbhJ-X3aKRPSlSCOeyuqGgc2upE8c9HV6DkeIuQSWe6dsin43fMMHGuf1duxCgehmmwnX3wnlbnUgueAFciVcQc1zBjUOCZet5UBuJ5ZyCdQmcoD9_D6mqZWKwg5ZKuhmxjZuTj9fcAr1c5Rz2rvFuWEe6d0vhesqafVnGfT1w%3D%3D&ck=drive&p=proj&sp=W3sibWV0YSI6e319LHsicGFnZSI6eyJ3Ijo4MDAsIndlYnAiOnRydWUsInNraXBoaWdobGlnaHQiOnRydWUsInBhZ2UiOjB9fV0. HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=WvgJKjlJRGgEu6_mGZV1zNxdhBGxKwsSxekZsKGMi8cAQuvKj1awtYKFPO9eHPWfo2Sq0QWIKYyDqTfFGgHxE8oqHMQFhqlB98PbGTgcSgoqRpKecO2fN-e34GKilKCf8aHgpL_qajWhsf7rml4u89Po9P8wzJPKv30UjsBafyEL6nwQHcnouecrfBT6kH6K9g
2025-03-20 13:48:32 UTC	970	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:32 GMT Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-viewer" Content-Security-Policy: script-src 'report-sample' 'nonce-1qvTB-Oh44wxDGFvkw_mKA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="apps-viewer" Report-To: {"group":"apps-viewer","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-viewer"}]} X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 13:48:32 UTC	250	IN	Data Raw: 36 66 32 0d 0a 29 5d 7d 27 0a 7b 22 6d 65 74 61 22 3a 22 6d 65 74 61 3f 69 64 3d 41 43 46 72 4f 67 43 4e 66 47 38 66 78 62 47 64 37 55 37 67 44 74 4c 43 76 42 5a 35 76 41 32 63 56 56 37 66 54 30 45 6a 32 38 62 32 71 34 59 5a 4a 65 55 5a 38 54 77 4a 5a 45 49 48 4f 79 77 66 6d 51 79 6b 67 61 6f 6b 76 30 47 7a 45 73 69 38 69 72 54 77 6b 68 2d 36 76 61 4d 6e 61 35 64 7a 74 4b 45 41 52 62 35 53 50 75 42 48 36 77 53 42 55 6b 47 32 42 2d 6e 4d 59 50 76 39 45 4a 32 4e 48 37 5f 52 54 30 72 4b 38 58 34 41 44 4d 4a 7a 41 68 70 51 48 67 44 69 56 30 69 72 5f 5f 4c 59 45 47 53 59 6f 51 77 38 4c 67 74 6a 64 77 50 4a 35 6c 4d 33 4a 57 30 6a 42 4a 48 38 33 59 36 66 4b 52 6b 61 35 7a 73 63 48 50 46 55 50 61 35 64 49 4c 4f 4c 22 2c 22 73 74 61 74 75 73 22 3a Data Ascii: 6f2)]}'{"meta":"meta?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL","status":
2025-03-20 13:48:32 UTC	1220	IN	Data Raw: 22 73 74 61 74 75 73 3f 69 64 3d 41 43 46 72 4f 67 43 4e 66 47 38 66 78 62 47 64 37 55 37 67 44 74 4c 43 76 42 5a 35 76 41 32 63 56 56 37 66 54 30 45 6a 32 38 62 32 71 34 59 5a 4a 65 55 5a 38 54 77 4a 5a 45 49 48 4f 79 77 66 6d 51 79 6b 67 61 6f 6b 76 30 47 7a 45 73 69 38 69 72 54 77 6b 68 2d 36 76 61 4d 6e 61 35 64 7a 74 4b 45 41 52 62 35 53 50 75 42 48 36 77 53 42 55 6b 47 32 42 2d 6e 4d 59 50 76 39 45 4a 32 4e 48 37 5f 52 54 30 72 4b 38 58 34 41 44 4d 4a 7a 41 68 70 51 48 67 44 69 56 30 69 72 5f 5f 4c 59 45 47 53 59 6f 51 77 38 4c 67 74 6a 64 77 50 4a 35 6c 4d 33 4a 57 30 6a 42 4a 48 38 33 59 36 66 4b 52 6b 61 35 7a 73 63 48 50 46 55 50 61 35 64 49 4c 4f 4c 22 2c 22 70 61 67 65 22 3a 22 69 6d 67 3f 69 64 3d 41 43 46 72 4f 67 43 4e 66 47 38 66 78 62 47 Data Ascii: "status?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL","page":"img?id=ACFrOgCNfG8fxbG
2025-03-20 13:48:32 UTC	315	IN	Data Raw: 73 65 63 75 72 65 2f 70 64 66 2f 33 6e 62 39 62 64 66 63 76 33 65 32 68 32 6b 31 63 6d 71 6c 30 65 65 39 63 76 63 35 6c 6f 6c 65 2f 71 73 35 36 6f 6a 37 6b 37 34 37 72 67 73 64 31 73 6f 33 37 63 38 73 6f 6b 68 6d 66 37 72 36 67 2f 31 37 34 32 34 37 38 34 35 30 30 30 30 2f 64 72 69 76 65 2f 2a 2f 41 43 46 72 4f 67 43 4e 66 47 38 66 78 62 47 64 37 55 37 67 44 74 4c 43 76 42 5a 35 76 41 32 63 56 56 37 66 54 30 45 6a 32 38 62 32 71 34 59 5a 4a 65 55 5a 38 54 77 4a 5a 45 49 48 4f 79 77 66 6d 51 79 6b 67 61 6f 6b 76 30 47 7a 45 73 69 38 69 72 54 77 6b 68 2d 36 76 61 4d 6e 61 35 64 7a 74 4b 45 41 52 62 35 53 50 75 42 48 36 77 53 42 55 6b 47 32 42 2d 6e 4d 59 50 76 39 45 4a 32 4e 48 37 5f 52 54 30 72 4b 38 58 34 41 44 4d 4a 7a 41 68 70 51 48 67 44 69 56 30 69 72 Data Ascii: secure/pdf/3nb9bdfcv3e2h2k1cmql0ee9cvc5lole/qs56oj7k747rgsd1so37c8sokhmf7r6g/1742478450000/drive/*/ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir
2025-03-20 13:48:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:32 UTC	994	OUT	GET /viewerng/meta?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=C8O4vypYHoIB7fwU4PoDsNpa0I_9HETacUxYfm1uH-cNe0N7EkHEmSzTmWnStXRf1e2CAOJQX4p0y_EYRDMpu_rS5sfN9thVH-wNQZ3GlzEF3vigzfc2B3IEEpD4bOyD9mE1f5lXlWB-uIzDy_4nRqq1-NaXZ-WHSqRECYfVcnH5BcLI2yykAWXWFPWYzPi_Wx2MUNBknw
2025-03-20 13:48:32 UTC	970	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:32 GMT Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="apps-viewer" Content-Security-Policy: script-src 'report-sample' 'nonce-KO3_O-SlIJVsXl86bKGymA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-viewer" Report-To: {"group":"apps-viewer","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-viewer"}]} X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 13:48:32 UTC	42	IN	Data Raw: 32 34 0d 0a 29 5d 7d 27 0a 7b 22 70 61 67 65 73 22 3a 31 2c 22 6d 61 78 50 61 67 65 57 69 64 74 68 22 3a 33 32 30 30 7d 0d 0a Data Ascii: 24)]}'{"pages":1,"maxPageWidth":3200}
2025-03-20 13:48:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:32 UTC	1188	OUT	GET /viewerng/upload?ds=APznzaaun2iLCbSGK5krodng5O7FdYrhAfmrIfxFoRxXcRtlIqqAMVdDMUHRacK3B_1fZLDyUmQaxYlRQurgcKcHf0moupD57zKCp1wJSee__jB4GCxPBiu7avs9lxXyaLJEh4LoMVTbpzQZLBL_iABT1gJ6Tn916pay8ISjAmMv1GElC41xYZSthpQRSoXsfbqHLfIhhJuXP00ULpYJuT1OiN6meu0zDrnD46ej1Qzu3arCOAYKjkJxmbhJ-X3aKRPSlSCOeyuqGgc2upE8c9HV6DkeIuQSWe6dsin43fMMHGuf1duxCgehmmwnX3wnlbnUgueAFciVcQc1zBjUOCZet5UBuJ5ZyCdQmcoD9_D6mqZWKwg5ZKuhmxjZuTj9fcAr1c5Rz2rvFuWEe6d0vhesqafVnGfT1w%3D%3D&ck=drive&p=proj&sp=W3sibWV0YSI6e319LHsicGFnZSI6eyJ3Ijo4MDAsIndlYnAiOnRydWUsInNraXBoaWdobGlnaHQiOnRydWUsInBhZ2UiOjB9fV0. HTTP/1.1 Host: drive.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=C8O4vypYHoIB7fwU4PoDsNpa0I_9HETacUxYfm1uH-cNe0N7EkHEmSzTmWnStXRf1e2CAOJQX4p0y_EYRDMpu_rS5sfN9thVH-wNQZ3GlzEF3vigzfc2B3IEEpD4bOyD9mE1f5lXlWB-uIzDy_4nRqq1-NaXZ-WHSqRECYfVcnH5BcLI2yykAWXWFPWYzPi_Wx2MUNBknw
2025-03-20 13:48:32 UTC	970	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:32 GMT Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-viewer" Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="apps-viewer" Report-To: {"group":"apps-viewer","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-viewer"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-r3G2LpH-zzKZafI7JWm-KQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 13:48:32 UTC	250	IN	Data Raw: 36 66 32 0d 0a 29 5d 7d 27 0a 7b 22 6d 65 74 61 22 3a 22 6d 65 74 61 3f 69 64 3d 41 43 46 72 4f 67 44 76 7a 64 76 67 56 58 5f 70 73 77 44 78 72 5a 31 6d 34 6d 6a 35 71 70 76 4e 62 70 77 4d 6d 55 59 44 64 6d 4e 75 2d 51 59 70 54 4f 46 53 69 5a 6a 50 39 42 32 30 35 4d 69 5f 63 53 75 68 4c 5f 72 38 49 47 59 35 41 58 73 70 4d 4b 6a 55 75 4e 41 4e 62 6b 63 42 70 43 44 65 61 69 36 56 6c 75 79 4d 37 71 61 68 6e 4e 5a 4a 67 4e 2d 7a 69 46 51 58 31 47 50 4d 59 35 37 50 55 71 4c 4e 6a 71 43 58 49 73 64 5f 4f 68 63 53 43 71 4a 4f 5f 4a 47 72 45 6d 34 36 66 34 31 36 43 55 52 43 56 4c 66 50 30 6d 43 30 66 52 33 36 4a 6b 77 35 79 67 67 48 77 2d 63 4e 63 6f 64 68 39 58 67 67 2d 47 6e 31 44 41 55 75 69 44 66 61 47 6b 50 32 22 2c 22 73 74 61 74 75 73 22 3a Data Ascii: 6f2)]}'{"meta":"meta?id=ACFrOgDvzdvgVX_pswDxrZ1m4mj5qpvNbpwMmUYDdmNu-QYpTOFSiZjP9B205Mi_cSuhL_r8IGY5AXspMKjUuNANbkcBpCDeai6VluyM7qahnNZJgN-ziFQX1GPMY57PUqLNjqCXIsd_OhcSCqJO_JGrEm46f416CURCVLfP0mC0fR36Jkw5yggHw-cNcodh9Xgg-Gn1DAUuiDfaGkP2","status":
2025-03-20 13:48:32 UTC	1220	IN	Data Raw: 22 73 74 61 74 75 73 3f 69 64 3d 41 43 46 72 4f 67 44 76 7a 64 76 67 56 58 5f 70 73 77 44 78 72 5a 31 6d 34 6d 6a 35 71 70 76 4e 62 70 77 4d 6d 55 59 44 64 6d 4e 75 2d 51 59 70 54 4f 46 53 69 5a 6a 50 39 42 32 30 35 4d 69 5f 63 53 75 68 4c 5f 72 38 49 47 59 35 41 58 73 70 4d 4b 6a 55 75 4e 41 4e 62 6b 63 42 70 43 44 65 61 69 36 56 6c 75 79 4d 37 71 61 68 6e 4e 5a 4a 67 4e 2d 7a 69 46 51 58 31 47 50 4d 59 35 37 50 55 71 4c 4e 6a 71 43 58 49 73 64 5f 4f 68 63 53 43 71 4a 4f 5f 4a 47 72 45 6d 34 36 66 34 31 36 43 55 52 43 56 4c 66 50 30 6d 43 30 66 52 33 36 4a 6b 77 35 79 67 67 48 77 2d 63 4e 63 6f 64 68 39 58 67 67 2d 47 6e 31 44 41 55 75 69 44 66 61 47 6b 50 32 22 2c 22 70 61 67 65 22 3a 22 69 6d 67 3f 69 64 3d 41 43 46 72 4f 67 44 76 7a 64 76 67 56 58 5f Data Ascii: "status?id=ACFrOgDvzdvgVX_pswDxrZ1m4mj5qpvNbpwMmUYDdmNu-QYpTOFSiZjP9B205Mi_cSuhL_r8IGY5AXspMKjUuNANbkcBpCDeai6VluyM7qahnNZJgN-ziFQX1GPMY57PUqLNjqCXIsd_OhcSCqJO_JGrEm46f416CURCVLfP0mC0fR36Jkw5yggHw-cNcodh9Xgg-Gn1DAUuiDfaGkP2","page":"img?id=ACFrOgDvzdvgVX_
2025-03-20 13:48:32 UTC	315	IN	Data Raw: 73 65 63 75 72 65 2f 70 64 66 2f 33 6e 62 39 62 64 66 63 76 33 65 32 68 32 6b 31 63 6d 71 6c 30 65 65 39 63 76 63 35 6c 6f 6c 65 2f 6a 66 6b 6f 70 39 35 63 33 61 6a 70 68 72 74 68 36 6a 38 69 33 30 76 31 69 32 30 62 6a 73 65 68 2f 31 37 34 32 34 37 38 34 35 30 30 30 30 2f 64 72 69 76 65 2f 2a 2f 41 43 46 72 4f 67 44 76 7a 64 76 67 56 58 5f 70 73 77 44 78 72 5a 31 6d 34 6d 6a 35 71 70 76 4e 62 70 77 4d 6d 55 59 44 64 6d 4e 75 2d 51 59 70 54 4f 46 53 69 5a 6a 50 39 42 32 30 35 4d 69 5f 63 53 75 68 4c 5f 72 38 49 47 59 35 41 58 73 70 4d 4b 6a 55 75 4e 41 4e 62 6b 63 42 70 43 44 65 61 69 36 56 6c 75 79 4d 37 71 61 68 6e 4e 5a 4a 67 4e 2d 7a 69 46 51 58 31 47 50 4d 59 35 37 50 55 71 4c 4e 6a 71 43 58 49 73 64 5f 4f 68 63 53 43 71 4a 4f 5f 4a 47 72 45 6d 34 36 Data Ascii: secure/pdf/3nb9bdfcv3e2h2k1cmql0ee9cvc5lole/jfkop95c3ajphrth6j8i30v1i20bjseh/1742478450000/drive/*/ACFrOgDvzdvgVX_pswDxrZ1m4mj5qpvNbpwMmUYDdmNu-QYpTOFSiZjP9B205Mi_cSuhL_r8IGY5AXspMKjUuNANbkcBpCDeai6VluyM7qahnNZJgN-ziFQX1GPMY57PUqLNjqCXIsd_OhcSCqJO_JGrEm46
2025-03-20 13:48:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:32 UTC	652	OUT	GET /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=C8O4vypYHoIB7fwU4PoDsNpa0I_9HETacUxYfm1uH-cNe0N7EkHEmSzTmWnStXRf1e2CAOJQX4p0y_EYRDMpu_rS5sfN9thVH-wNQZ3GlzEF3vigzfc2B3IEEpD4bOyD9mE1f5lXlWB-uIzDy_4nRqq1-NaXZ-WHSqRECYfVcnH5BcLI2yykAWXWFPWYzPi_Wx2MUNBknw
2025-03-20 13:48:32 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Mar 2025 13:48:32 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-20 13:48:32 UTC	950	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2025-03-20 13:48:32 UTC	605	IN	Data Raw: 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f Data Ascii: -repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/go

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:32 UTC	887	OUT	GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
2025-03-20 13:48:32 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 3170 Date: Thu, 20 Mar 2025 13:48:32 GMT Expires: Thu, 20 Mar 2025 13:48:32 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-20 13:48:32 UTC	549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 36 08 06 00 00 00 25 1d 60 0c 00 00 0c 29 49 44 41 54 78 da ed 5d 0b 70 54 d5 19 3e 98 6c 00 1f 88 da 97 b5 82 62 ad 14 28 48 76 37 20 44 37 f7 6e 08 38 83 a2 a5 b4 56 ab a5 48 5f 82 52 3b 53 1f 68 59 60 77 13 28 b6 d5 2a b6 4e 5f 52 ab 22 30 60 a9 2d e6 41 a9 1d 7c b4 2a 4e c5 fa 60 b0 a8 80 ec 6e 02 84 7b ef 26 90 84 6c ff 6f e0 0e 3b 9b ff de bd 8f 84 61 9a f3 cd 9c d9 64 ef dd 24 e7 f0 9d ff f1 fd ff b9 08 09 09 09 89 fe 89 e9 b1 dc e9 4a 9d 31 ae 2a 91 9d a1 d4 1a 37 2b 09 63 8e 9a d4 6f a0 a1 54 2f cf 7e 56 e4 72 03 84 84 84 13 44 eb da 47 a8 49 63 11 91 e7 e5 aa b8 d6 45 5f e7 ac 46 55 52 db a3 26 f4 df 55 25 8c a9 b1 58 ee 34 21 21 51 88 48 22 3b 91 c8 f4 1c 08 e3 65 28 49 63 07 Data Ascii: PNGIHDR6%`)IDATx]pT>lb(Hv7 D7n8VH_R;ShY`w(N_R"0`-A\|N`n{&lo;ad$J1*7+coT/~VrDGIcE_FUR&U%X4!!QH";e(Ic
2025-03-20 13:48:32 UTC	1220	IN	Data Raw: f4 8d 4c 34 7c 7f 46 0d d7 e2 b5 39 1a be 09 ef e3 ba ff 70 50 0c 38 fc 7c d9 c8 ae c6 c0 2d 1d 4d a5 8b 3a 9b 02 75 78 c5 f7 87 37 97 5d 86 eb c2 27 90 d0 28 71 ed aa aa 84 7e 07 e9 86 09 f2 0e 4b 51 c8 57 e2 ad 97 9c 2c 62 b5 d6 4c 3c b7 59 09 5d 9b 56 2b ee ca a8 a1 ba 74 34 bc 24 a3 56 dc ba 4f 09 8f f6 bd 8e 44 a2 35 0c b1 76 9e 6a 81 f6 ae 48 64 10 4d fc f6 b4 12 7a 9b 88 94 b3 1a b8 9e 56 83 f3 71 bf 70 89 ee 97 c4 e0 8e c6 d2 3b 3a 1b 4a de 25 32 e5 ac 47 c9 3b b8 2f b7 45 0c f2 e2 21 88 48 cb 20 df d8 08 c8 2f 44 6b db ae 38 9e 54 fd 99 be 7f 2b 7f f8 25 56 73 34 14 ce 44 43 1b 52 d1 60 a7 f5 5a 06 df c2 e6 05 c1 bc 0a a2 1f 30 13 5b 29 4e 21 a4 ab 83 95 19 25 fc 3e 26 ec 62 ec 24 92 4d 12 0e d1 d1 50 1a 21 c2 fc 97 21 92 1d c1 de 27 4b 76 a5 e3 Data Ascii: L4\|F9pP8\|-M:ux7]'(q~KQW,bL<Y]V+t4$VOD5vjHdMzVqp;:J%2G;/E!H /Dk8T+%Vs4DCR`Z0[)N!%>&b$MP!!'Kv
2025-03-20 13:48:32 UTC	1220	IN	Data Raw: 49 85 db 11 7c 8a 5e c6 b4 58 cb 10 2e fd 56 e2 87 26 99 f7 70 82 28 e3 d7 6d d1 32 ad 62 08 27 98 9a d7 b9 c0 dd 6d 89 a6 7b ab 38 8b 11 4c 8f e2 1a 32 3e 6e c3 a2 4b d7 25 b1 92 5e 89 65 5a 6d 97 e3 95 74 b4 e2 16 73 bd 7d 41 a9 cd 5e 6b a1 2d fd 0d 7e be 97 dd e0 62 a6 99 70 2f 7e 4f 5e 26 93 61 26 ec e2 d8 18 32 cb d0 18 66 b7 a6 f2 2c 56 4b 21 29 0e 37 94 5d 2a 5c 00 ae 93 21 56 26 cf 8d 1d ec 69 99 b5 2f bb 23 96 f6 b8 57 62 ed 8b 4c b8 c8 19 99 82 6d 14 3b fd 1a 44 14 bd 09 98 6d 2b dd 84 32 9b 07 3d 15 a4 f9 5a 59 05 d7 53 0f b2 89 3c 90 99 fe 47 e1 e4 a9 70 fa 1d 77 c1 7b 68 1e 53 9a f8 7b 9e 5c b0 95 21 c5 5c 97 c1 fb 3c 46 ae 78 21 af 8c f3 72 cf 8c 5b 5b e1 e6 df 05 87 7d fd 04 ef 20 8d 75 55 22 f8 1e 65 e0 0b 5a 2b 2b cf 11 7d 05 a8 be f8 47 Data Ascii: I\|^X.V&p(m2b'm{8L2>nK%^eZmts}A^k-~bp/~O^&a&2f,VK!)7]*\!V&i/#WbLm;Dm+2=ZYS<Gpw{hS{\!\<Fx!r[[} uU"eZ++}G
2025-03-20 13:48:32 UTC	181	IN	Data Raw: 9f 98 36 a6 b3 8f e7 44 59 4d 42 82 82 ef 7a 2e f3 43 92 33 69 79 f3 59 dc 63 36 91 7d 93 7e 78 98 91 1f 36 08 09 09 f3 88 1d 91 e8 90 45 bf 5b 2b 65 d4 4f 50 76 78 1f 65 86 3f 26 4b f6 7b f4 a6 59 9d 62 a2 40 7e 94 90 90 30 01 1d cf 8d 30 6a d9 05 22 21 c1 91 cb 3c f6 e6 76 e0 18 99 90 90 b0 02 a4 06 b2 5c cf 3b 25 14 54 77 f9 54 45 09 c7 c0 b3 31 f0 04 69 9c 1e e7 ca 39 c7 1e dd 99 bd 0e 81 bc 90 90 f0 02 94 bd a8 07 eb 02 fc 57 7c f8 5a 48 48 48 48 48 48 48 48 48 48 10 fe 07 d8 95 18 53 b9 4a 7f b2 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: 6DYMBz.C3iyYc6}~x6E[+eOPvxe?&K{Yb@~00j"!<v\;%TwTE1i9W\|ZHHHHHHHHHHSJIENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:32 UTC	1035	OUT	GET /viewerng/img?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL&page=0&skiphighlight=true&w=800&webp=true HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=nKK1s3ZfUGHxOX73pFu_d1CzEwpyRY3012dSHN0bEEk4gopXRYYdVoriI-8KQ-WkO8ljVBc5Adkg0l7eEJAF-5DsoD7rKy-YW8bM9d0HoAX38MBrm_dVIMnbeiqxYDTIH8K6aMoQA2QN7_J-PsvwAaqBVesJbEiNrmd3jBOBWaLXZpEQFYz00ucXkzFiccdZQK3IotzCTg
2025-03-20 13:48:33 UTC	905	IN	HTTP/1.1 200 OK Content-Type: image/webp Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:32 GMT Transfer-Encoding: chunked Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-viewer" Report-To: {"group":"apps-viewer","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-viewer"}]} Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="apps-viewer" Content-Security-Policy: script-src 'report-sample' 'nonce-jzIllSTCgenFW_R9t75jmg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: 37 30 30 36 0d 0a 52 49 46 46 7c 73 01 00 57 45 42 50 56 50 38 4c 6f 73 01 00 2f 1f 43 1a 01 0d 31 6a 1b 49 92 52 df 14 7f c2 53 7b 22 88 e8 ff 04 80 77 2f 62 06 78 26 c9 41 1a 75 38 93 01 da 3a 7a 40 47 dc 2b b7 5a ad 76 a4 7b 59 81 05 b4 e1 66 eb 1d ec ad 1f 8e 14 b4 6d e4 98 3f ca 03 33 7f 00 20 c8 b6 29 c2 10 ee 4f 77 84 61 ef ff 04 e0 bb 22 02 e7 44 12 50 d2 0c 01 00 53 a5 83 6d e7 dc 01 dc 4d 62 d8 b6 6d a4 58 69 9d ec bf 72 9f 7b 26 88 88 09 20 ce 10 c1 69 cb dd 36 ef ce b6 75 84 01 73 4e b6 49 8e 6d de 42 02 58 52 69 b2 b5 55 55 65 db 11 92 04 65 c7 be bb 3b 72 cf b2 c6 9a 9d f1 e7 f2 80 6d db 32 25 db fe ed 13 cc 20 21 dd 0a d8 22 76 77 60 03 16 76 77 20 26 76 77 2b 76 60 62 8b 88 81 dd 81 2d 8a 81 0a 26 82 20 dd 31 30 b5 c0 79 5e e7 75 31 de ef Data Ascii: 7006RIFF\|sWEBPVP8Los/C1jIRS{"w/bx&Au8:z@G+Zv{Yfm?3 )Owa"DPSmMbmXir{& i6usNImBXRiUUee;rm2% !"vw`vw &vw+v`b-& 10y^u1
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: 5d 7e 1d 69 ec 29 80 a8 93 9d da 32 61 5b 99 7d 2b d2 a4 5b 55 8a 1f 67 86 38 73 46 87 20 45 9c 21 b2 95 a8 05 66 23 51 cf 9a 69 8e cf ce a8 e2 90 18 65 bc 67 90 4e 79 3c 3e 52 04 b4 0e a8 4c 50 fb ad 3e c8 92 94 37 f9 3e c1 ea 6e 1d 84 8e 88 16 69 1d 8f b6 07 22 87 bd 16 41 3a 76 8b 01 d4 5b 57 67 8a b4 b2 a9 ab f5 91 3d 2b 40 05 51 f7 43 36 6c a8 24 3e 1c a1 07 28 b5 e2 76 7b 6b fc 47 b8 ea bb bb 13 9b a4 b1 d7 b4 d0 5f b0 50 02 a6 37 11 dd 53 09 9d ae c8 49 3a f8 44 86 16 ab 60 79 c3 f4 93 63 35 23 4b fa 37 be 2c cb f3 09 a5 a9 1e 05 a2 6b f5 fa ed 3e 00 4e 4c 4f 13 69 cd 77 0e d1 01 b7 77 eb 89 a0 56 a3 c2 d6 7e 02 1c 13 c0 93 0d 7a 22 8a 61 78 b9 f9 2c e2 b6 8f 16 12 c8 f7 2d cb d8 4a 98 56 86 8f 88 10 69 0d 17 ce 95 02 b8 76 f4 1e c3 79 01 8a 58 43 Data Ascii: ]~i)2a[}+[Ug8sF E!f#QiegNy<>RLP>7>ni"A:v[Wg=+@QC6l$>(v{kG_P7SI:D`yc5#K7,k>NLOiwwV~z"ax,-JVivyXC
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: e7 3b 68 d4 64 a8 6b d5 1a 68 d5 db 1a 05 e5 2e 5f 6b d2 a9 ff c7 b5 ab 9e 23 6a 48 fa b2 a6 9f fd 86 5d 6c ac 55 6f 73 09 30 dd 77 f5 d0 92 be 47 42 07 37 d3 67 d9 f6 55 ec 4c 96 1a a7 0c 30 bd c9 88 b6 0d be 9d 5e 7b 4a 7d c0 fc 78 53 ba 56 61 79 c3 f4 93 c7 ea 07 eb 27 bb 13 9b e8 6a ee e2 88 6e 00 34 5b 5e 9c ce a2 84 34 af ba ef 61 9b 97 3b 2b b5 12 82 f0 c5 ba 4d 76 38 62 c6 a6 ac 69 9a 7e f4 ea 8e ed b4 63 2c 2f 05 50 fc 00 e8 e5 73 c6 99 01 fd f3 0e 2c 5c ef 8b 67 13 e4 db 9c 4f 6e 55 91 55 ad 1e ad 8f 61 25 99 25 1a 03 9a 67 cb 4c c9 70 bb 5f b9 32 cb 79 7e 45 ac 21 d2 25 aa d5 4d 97 a8 67 cd 34 7d ef 5f 6e c3 20 75 bc f6 b8 11 34 43 6e df ac e9 9e 7d d3 1a 2f 26 fd 41 ea 76 a7 73 ce c0 d2 8d b7 bd 6c 43 b8 9a e9 95 6e 61 fc 76 32 f6 98 91 50 35 Data Ascii: ;hdkh._k#jH]lUos0wGB7gUL0^{J}xSVay'jn4[^4a;+Mv8bi~c,/Ps,\gOnUUa%%gLp_2y~E!%Mg4}_n u4Cn}/&AvslCnav2P5
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: 2a 63 a4 90 8e 73 b9 ab b3 81 40 36 e4 d2 5a f8 d6 e7 73 b5 0e 75 5c 17 08 f0 92 4f 2e cf 53 37 5a 5c b4 49 27 56 93 21 a4 e2 0f 4f 50 e3 be 7d 20 0a ef 35 b2 61 3a cf ab 88 31 44 fa 44 b5 30 6d a2 9e b5 37 5e b8 d7 bf 48 0d b8 88 ae e5 ef 44 f5 6a 12 64 01 0c be 71 ad 45 7a 96 13 0a af 4c 0d 84 a5 be a8 bf a0 73 c9 41 ca 00 f6 01 1a 59 4e 02 a9 57 fa 79 a8 0e 69 d9 a4 17 58 18 54 09 fe 43 d6 bb d4 9a c8 94 97 a7 56 98 42 40 bd 69 79 93 80 a2 a3 61 52 83 68 13 c9 2b a5 c8 78 e0 cb fe ef 3d 60 64 9a 98 69 0d 64 25 18 1b da e7 27 92 21 14 68 e5 2e d6 90 b1 97 a5 14 a0 d4 c8 3c b3 8d 53 c9 cd ae 2a fe 0a 20 27 da 16 fa 2c 6f 6e 3c 18 56 9b 34 98 f4 4c 38 f0 78 c3 f4 93 fe 49 8f c9 26 64 a0 7e 96 57 27 6d f7 57 09 ee 64 ad 30 6c 44 c6 70 e6 57 e7 8a 28 cc 37 Data Ascii: cs@6Zsu\O.S7Z\I'V!OP} 5a:1DD0m7^HDjdqEzLsAYNWyiXTCVB@iyaRh+x=`did%'!h.<S ',on<V4L8xI&d~W'mWd0lDpW(7
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: e8 37 39 4e 35 a4 80 13 d5 c7 24 52 42 f8 84 0f d7 b0 47 c8 96 c4 b7 1a 57 47 6a d6 7f 18 11 e7 54 93 4c a0 35 6e 7e 8b 92 d7 b5 06 6a 32 db 6f 86 6b 52 c3 45 75 ad 84 18 61 f3 9e 47 46 b7 f7 6f 13 2a ba 4a 01 d8 9d 8e fe 64 5e c7 10 90 ce fb 16 6e d8 d0 20 01 68 42 ed 4a 07 53 15 de 76 f2 79 6d c3 3e c6 58 d4 36 a6 14 91 a2 e8 15 80 c6 af df 18 d9 ea 47 b3 bc d9 11 1b 61 52 d7 88 cf 9b 9a 77 a2 be 99 14 dd 0c e1 48 3b cf e3 0d cb 4f 5e ab 49 87 2a 8a c2 e2 35 db ab 3e 05 d4 2b f5 fb f4 2e c1 ba be be 2e 9e fd 2e 86 08 92 2a 47 7e 7e 31 6e 58 d4 7c e3 3a c6 f5 92 d2 45 96 23 2d 83 59 0a a0 65 3a 79 24 27 63 23 64 d5 2b 52 6b d8 9b 77 59 0d a9 db c6 67 e8 d8 f8 ac ac 7a ed eb 57 e3 86 c6 b0 28 ee 5e 33 9d e7 55 44 0d 11 fe 07 d5 c2 74 89 7a b6 1f bc 67 3e Data Ascii: 79N5$RBGWGjTL5n~j2okREuaGFoJd^n hBJSvym>X6GaRwH;O^I5>+...*G~~1nX\|:E#-Ye:y$'c#d+RkwYgzW(^3UDtzg>
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: 8d 00 fe 5d 73 2f 3d 24 7c a6 13 52 83 22 4c 7a 35 e5 2e 23 11 c1 d6 3e 00 32 66 1f d5 40 95 0b 51 51 f5 4f 6d 3d 9f 3c fa a3 e7 e2 e1 c4 40 f5 e8 d1 1f 83 96 1e 02 30 af 04 3c 18 ea 5f 89 b3 e7 72 14 f1 c5 40 42 b8 ff 3c 5e 64 d3 a0 8b 01 15 66 c0 ec 2c 68 f2 64 d0 a3 8b a5 c8 1b 3f 0a 2a 74 6e 2a e6 e4 c1 e3 db 09 26 b5 9a 2a c2 26 0a 1e ac 24 0c ba ca d2 89 39 3c 81 71 0e 50 ce 69 7d 65 cf 2f e5 b9 77 26 42 22 ee 7c cf 37 af e2 e9 50 02 3e df 02 6a f0 56 91 0d 9c 0a b8 1d 91 4d 93 26 af 0e 55 d3 8e 15 14 ef e5 28 33 35 0a 5a 01 7d d0 19 d2 c1 43 71 f1 89 d9 b0 ea ef 47 7d 80 56 91 0b 89 3e 0b 85 1a b9 80 32 b7 78 a6 e1 34 f9 af 2f 1e 37 73 e7 77 d6 ae eb e4 cc 68 c4 6f f6 de 47 8e 4b b9 d1 0e a0 02 c8 55 b0 e4 9f f7 9d d9 b2 17 eb 71 a4 dd 78 9b 6e de Data Ascii: ]s/=$\|R"Lz5.#>2f@QQOm=<@0<_r@B<^df,hd?tn&*&$9<qPi}e/w&B"\|7P>jVM&U(35Z}CqG}V>2x4/7swhoGKUqxn
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: d5 c3 8b 92 d4 af d2 17 01 32 ed ce 2c 3e 58 08 64 ae 73 5e 3e 54 ca 2f 2a 3d 06 62 aa 31 d4 00 f8 ce ab 69 e7 9b 8d 55 a9 62 b0 e7 62 dc 08 6f 86 37 b9 05 54 42 55 1f fc 5a 10 17 e7 93 6b 3b 8f a3 9a e8 c6 1c a1 81 c1 49 a4 35 dc 5e 17 0e 3d c9 27 69 8b ba ef d4 2a 6b 92 90 90 29 f4 39 e5 a6 01 52 f6 21 0e 6b ab b1 3a a6 46 1f fa f4 7c 18 f2 56 51 25 16 6b e3 c1 ed b3 1b 59 01 f5 36 9b 40 47 27 8e 9f 36 17 f6 ac 4d 04 88 27 d7 41 e4 3a 15 29 21 0d a0 f1 1e 23 36 74 eb 24 2f 81 dc c7 5b e6 18 c1 70 66 97 5f bf a3 dc c8 4a 7b b8 b9 17 25 be 97 69 fa 8f a0 45 ff 5a 48 a5 30 5b 6e 4d 14 b8 94 4f cb a0 17 00 9e 61 c7 d9 3e bc ab 5d 89 9e 80 ed 81 48 00 c1 2f 25 5e f4 76 d6 be 9a a0 70 cc 76 de 98 17 01 20 7a 4c d7 ad fc 47 22 96 b5 6f d4 a0 66 fe f2 62 4d ae Data Ascii: 2,>Xds^>T/=b1iUbbo7TBUZk;I5^='ik)9R!k:F\|VQ%kY6@G'6M'A:)!#6t$/[pf_J{%iEZH0[nMOa>]H/%^vpv zLG"ofbM
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: 20 8a bb 58 a9 b4 45 df c6 40 6d 72 fe 26 a4 87 5c 0e b9 9c 93 78 ea 5f 5d fe d6 98 93 e3 dd 57 ee e1 8e fa 7d 83 7f 0e e8 9e 98 1d f0 ad 80 39 95 a6 c6 56 d3 ed 0e d1 b4 1a d4 01 49 d6 34 8a 95 c7 50 d1 28 4b 79 43 c3 49 2e c6 26 9a 31 86 1e 10 0d 9c fe 6d b5 67 30 e5 fb 3d 1a ac 0b e3 bc 55 9c 9e f2 51 68 27 ee 6d c9 94 a5 f8 69 60 43 36 50 c7 67 ed d6 de fd 0f 98 23 28 30 1e de df 45 95 6a 3a 88 6e bc 0c 0a 7f be 2b d0 ea bd 2f 60 e9 02 7c fe cd 21 47 8d c6 9c e6 44 51 09 c8 78 38 ba a7 a6 15 b4 0f 35 9c d0 b2 21 6f a7 6b b8 1d 05 cb 6f f1 c7 d7 8a 39 27 39 6b 83 fe 51 7e 69 bd 05 df 13 98 e7 8d 6f 62 3b 96 fc 53 a8 79 b7 78 34 d1 df 3d a2 a7 0c 5b bb 81 4e ec cb 3f 80 1a 15 3e e1 fa 3b ee 1c c8 28 f2 19 27 20 bf 9c 98 97 88 f5 eb b3 62 a0 4f ff 38 8d Data Ascii: XE@mr&\x_]W}9VI4P(KyCI.&1mg0=UQh'mi`C6Pg#(0Ej:n+/`\|!GDQx85!oko9'9kQ~iob;Syx4=[N?>;(' bO8
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: 9e 15 2d f5 64 16 59 30 52 fc 6b 44 38 a0 da e5 df 72 af 09 55 90 a7 40 b1 8b f9 83 1d 40 95 cf 1d 10 13 05 84 53 ab e7 af 2f c0 33 32 15 c8 d7 8e ba 05 f5 f3 15 80 a8 6f 51 bb f2 df 04 b2 ba 2f bd b3 fa 89 b7 79 3d 1b 4d ec 07 b5 c7 52 ce d9 dc d9 c3 4f 0a a0 5c d8 a2 cd bc 7d 77 9e e4 43 b5 b8 a5 57 ff 55 8f df 01 df bb b6 39 01 c0 dd e3 92 f6 8f 9d 7f 13 40 ba e8 e0 12 6a e2 6f b3 93 d6 dc ee e2 f4 67 5a f5 0f bd 51 eb a6 41 52 b9 d2 a0 4a ec 20 bd 6a 85 3f 6e 57 b9 aa 59 d2 eb ec 16 ab c9 76 96 1d 43 fd 15 b3 b2 b5 f1 16 3b c7 c4 57 8c d2 88 fc 5b 00 ce 53 17 28 72 bf cf 9c 4a 06 f7 15 5f 6a 2b 5c 61 dd 10 5a 6e c1 d6 6a cd 8c 3f 7c ef bd 95 79 59 57 b5 3d f4 f5 6f 72 0a df b4 b5 eb 7c 73 2e ba 31 87 37 b0 8c 15 f7 3e 02 85 8b ea 0c 9a 2b 06 0c 37 0c Data Ascii: -dY0RkD8rU@@S/32oQ/y=MRO\}wCWU9@jogZQARJ j?nWYvC;W[S(rJ_j+\aZnj?\|yYW=or\|s.17>+7
2025-03-20 13:48:33 UTC	1220	IN	Data Raw: ee af 32 eb 6e 8d d4 d2 fa 0c 4a c6 eb 91 b1 86 db 3b 30 64 d4 3c d0 3b 2d e7 bf 64 54 ee f1 1e a5 60 bf b0 53 51 cc 55 41 2d 48 1e 6c a8 ba ec 11 c4 32 4a 41 25 24 9e e4 36 d3 f4 4a 44 ea f4 18 0c e8 c5 14 d2 74 ca b2 dc ff 12 a1 cf 4b f7 de 70 b1 80 65 22 15 62 09 67 07 b4 e3 9d 1b 07 71 89 f0 7f 0e b3 71 3c ed e3 c1 95 32 ff 43 24 ad cc 29 dd 43 22 a0 03 96 cd 10 73 66 97 46 27 ca a3 8f aa d1 a0 1e 57 0a bd e2 b9 67 fc 87 3a 7d 8b 5e 94 e6 fd 8b aa a8 c8 e3 ac 50 11 c1 d6 3e e4 0d 14 da 1c 25 a0 c8 05 e4 e2 80 d9 59 d0 e4 c9 a0 27 e3 a2 b8 f6 58 db b2 97 8c 8f 6b df 81 f6 86 7c 5a 3c 5e d1 3a ef de 18 da 9c ee 55 5f 09 9b ee 1c 7f ea 7b bd a1 c6 d4 e2 78 f7 65 a2 61 5d 4f 6b a2 8d 74 ac 25 fa a4 a2 54 51 0a 68 12 2f fc 98 67 01 64 cc 3e aa 81 2a 17 22 Data Ascii: 2nJ;0d<;-dT`SQUA-Hl2JA%$6JDtKpe"bgqq<2C$)C"sfF'Wg:}^P>%Y'Xk\|Z<^:U_{xea]Okt%TQh/gd>*"

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:32 UTC	1006	OUT	GET /viewerng/presspage?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL&page=0 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=nKK1s3ZfUGHxOX73pFu_d1CzEwpyRY3012dSHN0bEEk4gopXRYYdVoriI-8KQ-WkO8ljVBc5Adkg0l7eEJAF-5DsoD7rKy-YW8bM9d0HoAX38MBrm_dVIMnbeiqxYDTIH8K6aMoQA2QN7_J-PsvwAaqBVesJbEiNrmd3jBOBWaLXZpEQFYz00ucXkzFiccdZQK3IotzCTg
2025-03-20 13:48:33 UTC	970	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:32 GMT Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="apps-viewer" Report-To: {"group":"apps-viewer","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-viewer"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-viewer" Content-Security-Policy: script-src 'report-sample' 'nonce-70q-zdopcirGJV_XU9f2OQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 13:48:33 UTC	250	IN	Data Raw: 34 36 62 0d 0a 29 5d 7d 27 0a 5b 37 32 2c 35 39 36 2c 38 34 32 2c 5b 5b 5b 38 2c 37 31 2c 31 34 2c 34 33 35 5d 2c 5b 5b 5b 38 2c 37 31 2c 31 34 2c 34 33 35 5d 2c 5b 5b 5b 38 2c 37 31 2c 31 34 2c 33 38 5d 2c 22 43 61 73 65 3a 22 5d 2c 5b 5b 38 2c 31 31 31 2c 31 34 2c 36 31 5d 2c 22 32 31 2d 35 30 38 32 36 22 5d 2c 5b 5b 38 2c 31 38 33 2c 31 34 2c 36 38 5d 2c 22 44 6f 63 75 6d 65 6e 74 3a 22 5d 2c 5b 5b 38 2c 32 35 34 2c 31 34 2c 38 37 5d 2c 22 30 30 35 31 36 35 31 34 37 34 38 22 5d 2c 5b 5b 38 2c 33 36 33 2c 31 34 2c 33 31 5d 2c 22 44 61 74 65 22 5d 2c 5b 5b 38 2c 33 39 37 2c 31 34 2c 33 35 5d 2c 22 46 69 6c 65 64 3a 22 5d 2c 5b 5b 38 2c 34 33 35 2c 31 34 2c 37 31 5d 2c 22 31 33 2f 30 33 2f 32 30 32 35 22 5d 5d 5d 5d 5d 2c 5b 5b 36 38 2c 31 Data Ascii: 46b)]}'[72,596,842,[[[8,71,14,435],[[[8,71,14,435],[[[8,71,14,38],"Case:"],[[8,111,14,61],"21-50826"],[[8,183,14,68],"Document:"],[[8,254,14,87],"00516514748"],[[8,363,14,31],"Date"],[[8,397,14,35],"Filed:"],[[8,435,14,71],"13/03/2025"]]]]],[[68,1
2025-03-20 13:48:33 UTC	888	IN	Data Raw: 30 30 2c 32 33 2c 33 39 35 5d 2c 5b 5b 5b 36 38 2c 31 30 30 2c 32 33 2c 33 39 35 5d 2c 5b 5b 5b 36 38 2c 31 30 30 2c 32 33 2c 37 39 5d 2c 22 55 6e 69 74 65 64 22 5d 2c 5b 5b 36 38 2c 31 38 35 2c 32 33 2c 36 37 5d 2c 22 53 74 61 74 65 73 22 5d 2c 5b 5b 36 38 2c 32 35 37 2c 32 33 2c 38 36 5d 2c 22 46 65 64 65 72 61 6c 22 5d 2c 5b 5b 36 38 2c 33 34 39 2c 32 33 2c 36 36 5d 2c 22 43 6f 75 72 74 22 5d 2c 5b 5b 36 38 2c 34 32 30 2c 32 33 2c 33 34 5d 2c 22 66 6f 72 22 5d 2c 5b 5b 36 38 2c 34 35 39 2c 32 33 2c 33 36 5d 2c 22 74 68 65 22 5d 5d 5d 5d 5d 2c 5b 5b 31 30 35 2c 32 32 37 2c 32 33 2c 31 34 32 5d 2c 5b 5b 5b 31 30 35 2c 32 32 37 2c 32 33 2c 31 34 32 5d 2c 5b 5b 5b 31 30 35 2c 32 32 37 2c 32 33 2c 35 37 5d 2c 22 46 69 66 74 68 22 5d 2c 5b 5b 31 30 35 2c 32 Data Ascii: 00,23,395],[[[68,100,23,395],[[[68,100,23,79],"United"],[[68,185,23,67],"States"],[[68,257,23,86],"Federal"],[[68,349,23,66],"Court"],[[68,420,23,34],"for"],[[68,459,23,36],"the"]]]]],[[105,227,23,142],[[[105,227,23,142],[[[105,227,23,57],"Fifth"],[[105,2
2025-03-20 13:48:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:33 UTC	895	OUT	GET /viewerng/img?id=ACFrOgCNfG8fxbGd7U7gDtLCvBZ5vA2cVV7fT0Ej28b2q4YZJeUZ8TwJZEIHOywfmQykgaokv0GzEsi8irTwkh-6vaMna5dztKEARb5SPuBH6wSBUkG2B-nMYPv9EJ2NH7_RT0rK8X4ADMJzAhpQHgDiV0ir__LYEGSYoQw8LgtjdwPJ5lM3JW0jBJH83Y6fKRka5zscHPFUPa5dILOL&page=0&skiphighlight=true&w=800&webp=true HTTP/1.1 Host: drive.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CLf3ygE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
2025-03-20 13:48:34 UTC	905	IN	HTTP/1.1 200 OK Content-Type: image/webp Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:33 GMT Transfer-Encoding: chunked Content-Security-Policy: script-src 'report-sample' 'nonce-HBLJC7H78DE9FMaXtyMrIg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport Report-To: {"group":"apps-viewer","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-viewer"}]} Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="apps-viewer" Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-viewer" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: 37 30 30 36 0d 0a 52 49 46 46 7c 73 01 00 57 45 42 50 56 50 38 4c 6f 73 01 00 2f 1f 43 1a 01 0d 31 6a 1b 49 92 52 df 14 7f c2 53 7b 22 88 e8 ff 04 80 77 2f 62 06 78 26 c9 41 1a 75 38 93 01 da 3a 7a 40 47 dc 2b b7 5a ad 76 a4 7b 59 81 05 b4 e1 66 eb 1d ec ad 1f 8e 14 b4 6d e4 98 3f ca 03 33 7f 00 20 c8 b6 29 c2 10 ee 4f 77 84 61 ef ff 04 e0 bb 22 02 e7 44 12 50 d2 0c 01 00 53 a5 83 6d e7 dc 01 dc 4d 62 d8 b6 6d a4 58 69 9d ec bf 72 9f 7b 26 88 88 09 20 ce 10 c1 69 cb dd 36 ef ce b6 75 84 01 73 4e b6 49 8e 6d de 42 02 58 52 69 b2 b5 55 55 65 db 11 92 04 65 c7 be bb 3b 72 cf b2 c6 9a 9d f1 e7 f2 80 6d db 32 25 db fe ed 13 cc 20 21 dd 0a d8 22 76 77 60 03 16 76 77 20 26 76 77 2b 76 60 62 8b 88 81 dd 81 2d 8a 81 0a 26 82 20 dd 31 30 b5 c0 79 5e e7 75 31 de ef Data Ascii: 7006RIFF\|sWEBPVP8Los/C1jIRS{"w/bx&Au8:z@G+Zv{Yfm?3 )Owa"DPSmMbmXir{& i6usNImBXRiUUee;rm2% !"vw`vw &vw+v`b-& 10y^u1
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: 5d 7e 1d 69 ec 29 80 a8 93 9d da 32 61 5b 99 7d 2b d2 a4 5b 55 8a 1f 67 86 38 73 46 87 20 45 9c 21 b2 95 a8 05 66 23 51 cf 9a 69 8e cf ce a8 e2 90 18 65 bc 67 90 4e 79 3c 3e 52 04 b4 0e a8 4c 50 fb ad 3e c8 92 94 37 f9 3e c1 ea 6e 1d 84 8e 88 16 69 1d 8f b6 07 22 87 bd 16 41 3a 76 8b 01 d4 5b 57 67 8a b4 b2 a9 ab f5 91 3d 2b 40 05 51 f7 43 36 6c a8 24 3e 1c a1 07 28 b5 e2 76 7b 6b fc 47 b8 ea bb bb 13 9b a4 b1 d7 b4 d0 5f b0 50 02 a6 37 11 dd 53 09 9d ae c8 49 3a f8 44 86 16 ab 60 79 c3 f4 93 63 35 23 4b fa 37 be 2c cb f3 09 a5 a9 1e 05 a2 6b f5 fa ed 3e 00 4e 4c 4f 13 69 cd 77 0e d1 01 b7 77 eb 89 a0 56 a3 c2 d6 7e 02 1c 13 c0 93 0d 7a 22 8a 61 78 b9 f9 2c e2 b6 8f 16 12 c8 f7 2d cb d8 4a 98 56 86 8f 88 10 69 0d 17 ce 95 02 b8 76 f4 1e c3 79 01 8a 58 43 Data Ascii: ]~i)2a[}+[Ug8sF E!f#QiegNy<>RLP>7>ni"A:v[Wg=+@QC6l$>(v{kG_P7SI:D`yc5#K7,k>NLOiwwV~z"ax,-JVivyXC
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: e7 3b 68 d4 64 a8 6b d5 1a 68 d5 db 1a 05 e5 2e 5f 6b d2 a9 ff c7 b5 ab 9e 23 6a 48 fa b2 a6 9f fd 86 5d 6c ac 55 6f 73 09 30 dd 77 f5 d0 92 be 47 42 07 37 d3 67 d9 f6 55 ec 4c 96 1a a7 0c 30 bd c9 88 b6 0d be 9d 5e 7b 4a 7d c0 fc 78 53 ba 56 61 79 c3 f4 93 c7 ea 07 eb 27 bb 13 9b e8 6a ee e2 88 6e 00 34 5b 5e 9c ce a2 84 34 af ba ef 61 9b 97 3b 2b b5 12 82 f0 c5 ba 4d 76 38 62 c6 a6 ac 69 9a 7e f4 ea 8e ed b4 63 2c 2f 05 50 fc 00 e8 e5 73 c6 99 01 fd f3 0e 2c 5c ef 8b 67 13 e4 db 9c 4f 6e 55 91 55 ad 1e ad 8f 61 25 99 25 1a 03 9a 67 cb 4c c9 70 bb 5f b9 32 cb 79 7e 45 ac 21 d2 25 aa d5 4d 97 a8 67 cd 34 7d ef 5f 6e c3 20 75 bc f6 b8 11 34 43 6e df ac e9 9e 7d d3 1a 2f 26 fd 41 ea 76 a7 73 ce c0 d2 8d b7 bd 6c 43 b8 9a e9 95 6e 61 fc 76 32 f6 98 91 50 35 Data Ascii: ;hdkh._k#jH]lUos0wGB7gUL0^{J}xSVay'jn4[^4a;+Mv8bi~c,/Ps,\gOnUUa%%gLp_2y~E!%Mg4}_n u4Cn}/&AvslCnav2P5
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: 2a 63 a4 90 8e 73 b9 ab b3 81 40 36 e4 d2 5a f8 d6 e7 73 b5 0e 75 5c 17 08 f0 92 4f 2e cf 53 37 5a 5c b4 49 27 56 93 21 a4 e2 0f 4f 50 e3 be 7d 20 0a ef 35 b2 61 3a cf ab 88 31 44 fa 44 b5 30 6d a2 9e b5 37 5e b8 d7 bf 48 0d b8 88 ae e5 ef 44 f5 6a 12 64 01 0c be 71 ad 45 7a 96 13 0a af 4c 0d 84 a5 be a8 bf a0 73 c9 41 ca 00 f6 01 1a 59 4e 02 a9 57 fa 79 a8 0e 69 d9 a4 17 58 18 54 09 fe 43 d6 bb d4 9a c8 94 97 a7 56 98 42 40 bd 69 79 93 80 a2 a3 61 52 83 68 13 c9 2b a5 c8 78 e0 cb fe ef 3d 60 64 9a 98 69 0d 64 25 18 1b da e7 27 92 21 14 68 e5 2e d6 90 b1 97 a5 14 a0 d4 c8 3c b3 8d 53 c9 cd ae 2a fe 0a 20 27 da 16 fa 2c 6f 6e 3c 18 56 9b 34 98 f4 4c 38 f0 78 c3 f4 93 fe 49 8f c9 26 64 a0 7e 96 57 27 6d f7 57 09 ee 64 ad 30 6c 44 c6 70 e6 57 e7 8a 28 cc 37 Data Ascii: cs@6Zsu\O.S7Z\I'V!OP} 5a:1DD0m7^HDjdqEzLsAYNWyiXTCVB@iyaRh+x=`did%'!h.<S ',on<V4L8xI&d~W'mWd0lDpW(7
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: e8 37 39 4e 35 a4 80 13 d5 c7 24 52 42 f8 84 0f d7 b0 47 c8 96 c4 b7 1a 57 47 6a d6 7f 18 11 e7 54 93 4c a0 35 6e 7e 8b 92 d7 b5 06 6a 32 db 6f 86 6b 52 c3 45 75 ad 84 18 61 f3 9e 47 46 b7 f7 6f 13 2a ba 4a 01 d8 9d 8e fe 64 5e c7 10 90 ce fb 16 6e d8 d0 20 01 68 42 ed 4a 07 53 15 de 76 f2 79 6d c3 3e c6 58 d4 36 a6 14 91 a2 e8 15 80 c6 af df 18 d9 ea 47 b3 bc d9 11 1b 61 52 d7 88 cf 9b 9a 77 a2 be 99 14 dd 0c e1 48 3b cf e3 0d cb 4f 5e ab 49 87 2a 8a c2 e2 35 db ab 3e 05 d4 2b f5 fb f4 2e c1 ba be be 2e 9e fd 2e 86 08 92 2a 47 7e 7e 31 6e 58 d4 7c e3 3a c6 f5 92 d2 45 96 23 2d 83 59 0a a0 65 3a 79 24 27 63 23 64 d5 2b 52 6b d8 9b 77 59 0d a9 db c6 67 e8 d8 f8 ac ac 7a ed eb 57 e3 86 c6 b0 28 ee 5e 33 9d e7 55 44 0d 11 fe 07 d5 c2 74 89 7a b6 1f bc 67 3e Data Ascii: 79N5$RBGWGjTL5n~j2okREuaGFoJd^n hBJSvym>X6GaRwH;O^I5>+...*G~~1nX\|:E#-Ye:y$'c#d+RkwYgzW(^3UDtzg>
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: 8d 00 fe 5d 73 2f 3d 24 7c a6 13 52 83 22 4c 7a 35 e5 2e 23 11 c1 d6 3e 00 32 66 1f d5 40 95 0b 51 51 f5 4f 6d 3d 9f 3c fa a3 e7 e2 e1 c4 40 f5 e8 d1 1f 83 96 1e 02 30 af 04 3c 18 ea 5f 89 b3 e7 72 14 f1 c5 40 42 b8 ff 3c 5e 64 d3 a0 8b 01 15 66 c0 ec 2c 68 f2 64 d0 a3 8b a5 c8 1b 3f 0a 2a 74 6e 2a e6 e4 c1 e3 db 09 26 b5 9a 2a c2 26 0a 1e ac 24 0c ba ca d2 89 39 3c 81 71 0e 50 ce 69 7d 65 cf 2f e5 b9 77 26 42 22 ee 7c cf 37 af e2 e9 50 02 3e df 02 6a f0 56 91 0d 9c 0a b8 1d 91 4d 93 26 af 0e 55 d3 8e 15 14 ef e5 28 33 35 0a 5a 01 7d d0 19 d2 c1 43 71 f1 89 d9 b0 ea ef 47 7d 80 56 91 0b 89 3e 0b 85 1a b9 80 32 b7 78 a6 e1 34 f9 af 2f 1e 37 73 e7 77 d6 ae eb e4 cc 68 c4 6f f6 de 47 8e 4b b9 d1 0e a0 02 c8 55 b0 e4 9f f7 9d d9 b2 17 eb 71 a4 dd 78 9b 6e de Data Ascii: ]s/=$\|R"Lz5.#>2f@QQOm=<@0<_r@B<^df,hd?tn&*&$9<qPi}e/w&B"\|7P>jVM&U(35Z}CqG}V>2x4/7swhoGKUqxn
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: d5 c3 8b 92 d4 af d2 17 01 32 ed ce 2c 3e 58 08 64 ae 73 5e 3e 54 ca 2f 2a 3d 06 62 aa 31 d4 00 f8 ce ab 69 e7 9b 8d 55 a9 62 b0 e7 62 dc 08 6f 86 37 b9 05 54 42 55 1f fc 5a 10 17 e7 93 6b 3b 8f a3 9a e8 c6 1c a1 81 c1 49 a4 35 dc 5e 17 0e 3d c9 27 69 8b ba ef d4 2a 6b 92 90 90 29 f4 39 e5 a6 01 52 f6 21 0e 6b ab b1 3a a6 46 1f fa f4 7c 18 f2 56 51 25 16 6b e3 c1 ed b3 1b 59 01 f5 36 9b 40 47 27 8e 9f 36 17 f6 ac 4d 04 88 27 d7 41 e4 3a 15 29 21 0d a0 f1 1e 23 36 74 eb 24 2f 81 dc c7 5b e6 18 c1 70 66 97 5f bf a3 dc c8 4a 7b b8 b9 17 25 be 97 69 fa 8f a0 45 ff 5a 48 a5 30 5b 6e 4d 14 b8 94 4f cb a0 17 00 9e 61 c7 d9 3e bc ab 5d 89 9e 80 ed 81 48 00 c1 2f 25 5e f4 76 d6 be 9a a0 70 cc 76 de 98 17 01 20 7a 4c d7 ad fc 47 22 96 b5 6f d4 a0 66 fe f2 62 4d ae Data Ascii: 2,>Xds^>T/=b1iUbbo7TBUZk;I5^='ik)9R!k:F\|VQ%kY6@G'6M'A:)!#6t$/[pf_J{%iEZH0[nMOa>]H/%^vpv zLG"ofbM
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: 20 8a bb 58 a9 b4 45 df c6 40 6d 72 fe 26 a4 87 5c 0e b9 9c 93 78 ea 5f 5d fe d6 98 93 e3 dd 57 ee e1 8e fa 7d 83 7f 0e e8 9e 98 1d f0 ad 80 39 95 a6 c6 56 d3 ed 0e d1 b4 1a d4 01 49 d6 34 8a 95 c7 50 d1 28 4b 79 43 c3 49 2e c6 26 9a 31 86 1e 10 0d 9c fe 6d b5 67 30 e5 fb 3d 1a ac 0b e3 bc 55 9c 9e f2 51 68 27 ee 6d c9 94 a5 f8 69 60 43 36 50 c7 67 ed d6 de fd 0f 98 23 28 30 1e de df 45 95 6a 3a 88 6e bc 0c 0a 7f be 2b d0 ea bd 2f 60 e9 02 7c fe cd 21 47 8d c6 9c e6 44 51 09 c8 78 38 ba a7 a6 15 b4 0f 35 9c d0 b2 21 6f a7 6b b8 1d 05 cb 6f f1 c7 d7 8a 39 27 39 6b 83 fe 51 7e 69 bd 05 df 13 98 e7 8d 6f 62 3b 96 fc 53 a8 79 b7 78 34 d1 df 3d a2 a7 0c 5b bb 81 4e ec cb 3f 80 1a 15 3e e1 fa 3b ee 1c c8 28 f2 19 27 20 bf 9c 98 97 88 f5 eb b3 62 a0 4f ff 38 8d Data Ascii: XE@mr&\x_]W}9VI4P(KyCI.&1mg0=UQh'mi`C6Pg#(0Ej:n+/`\|!GDQx85!oko9'9kQ~iob;Syx4=[N?>;(' bO8
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: 9e 15 2d f5 64 16 59 30 52 fc 6b 44 38 a0 da e5 df 72 af 09 55 90 a7 40 b1 8b f9 83 1d 40 95 cf 1d 10 13 05 84 53 ab e7 af 2f c0 33 32 15 c8 d7 8e ba 05 f5 f3 15 80 a8 6f 51 bb f2 df 04 b2 ba 2f bd b3 fa 89 b7 79 3d 1b 4d ec 07 b5 c7 52 ce d9 dc d9 c3 4f 0a a0 5c d8 a2 cd bc 7d 77 9e e4 43 b5 b8 a5 57 ff 55 8f df 01 df bb b6 39 01 c0 dd e3 92 f6 8f 9d 7f 13 40 ba e8 e0 12 6a e2 6f b3 93 d6 dc ee e2 f4 67 5a f5 0f bd 51 eb a6 41 52 b9 d2 a0 4a ec 20 bd 6a 85 3f 6e 57 b9 aa 59 d2 eb ec 16 ab c9 76 96 1d 43 fd 15 b3 b2 b5 f1 16 3b c7 c4 57 8c d2 88 fc 5b 00 ce 53 17 28 72 bf cf 9c 4a 06 f7 15 5f 6a 2b 5c 61 dd 10 5a 6e c1 d6 6a cd 8c 3f 7c ef bd 95 79 59 57 b5 3d f4 f5 6f 72 0a df b4 b5 eb 7c 73 2e ba 31 87 37 b0 8c 15 f7 3e 02 85 8b ea 0c 9a 2b 06 0c 37 0c Data Ascii: -dY0RkD8rU@@S/32oQ/y=MRO\}wCWU9@jogZQARJ j?nWYvC;W[S(rJ_j+\aZnj?\|yYW=or\|s.17>+7
2025-03-20 13:48:34 UTC	1220	IN	Data Raw: ee af 32 eb 6e 8d d4 d2 fa 0c 4a c6 eb 91 b1 86 db 3b 30 64 d4 3c d0 3b 2d e7 bf 64 54 ee f1 1e a5 60 bf b0 53 51 cc 55 41 2d 48 1e 6c a8 ba ec 11 c4 32 4a 41 25 24 9e e4 36 d3 f4 4a 44 ea f4 18 0c e8 c5 14 d2 74 ca b2 dc ff 12 a1 cf 4b f7 de 70 b1 80 65 22 15 62 09 67 07 b4 e3 9d 1b 07 71 89 f0 7f 0e b3 71 3c ed e3 c1 95 32 ff 43 24 ad cc 29 dd 43 22 a0 03 96 cd 10 73 66 97 46 27 ca a3 8f aa d1 a0 1e 57 0a bd e2 b9 67 fc 87 3a 7d 8b 5e 94 e6 fd 8b aa a8 c8 e3 ac 50 11 c1 d6 3e e4 0d 14 da 1c 25 a0 c8 05 e4 e2 80 d9 59 d0 e4 c9 a0 27 e3 a2 b8 f6 58 db b2 97 8c 8f 6b df 81 f6 86 7c 5a 3c 5e d1 3a ef de 18 da 9c ee 55 5f 09 9b ee 1c 7f ea 7b bd a1 c6 d4 e2 78 f7 65 a2 61 5d 4f 6b a2 8d 74 ac 25 fa a4 a2 54 51 0a 68 12 2f fc 98 67 01 64 cc 3e aa 81 2a 17 22 Data Ascii: 2nJ;0d<;-dT`SQUA-Hl2JA%$6JDtKpe"bgqq<2C$)C"sfF'Wg:}^P>%Y'Xk\|Z<^:U_{xea]Okt%TQh/gd>*"

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:34 UTC	1086	OUT	POST /file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/docos/p/sync?resourcekey&id=1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2&reqid=0 HTTP/1.1 Host: drive.google.com Connection: keep-alive Content-Length: 75 sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 X-Same-Domain: 1 X-Client-Deadline-Ms: 20000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 X-Build: apps-fileview.texmex_20250313.01_p0 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
2025-03-20 13:48:34 UTC	75	OUT	Data Raw: 70 3d 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 32 32 31 59 5a 49 6d 50 65 46 79 39 4f 54 49 76 4d 76 59 6d 55 79 69 49 6c 58 50 6c 6e 46 54 73 6d 52 32 25 32 32 25 35 44 Data Ascii: p=%5Bnull%2Cnull%2Cnull%2Cnull%2C%221YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2%22%5D
2025-03-20 13:48:35 UTC	724	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 20 Mar 2025 13:48:34 GMT Content-Disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin X-Content-Type-Options: nosniff Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 13:48:35 UTC	49	IN	Data Raw: 32 62 0d 0a 29 5d 7d 27 0a 0a 5b 5b 22 73 72 22 2c 6e 75 6c 6c 2c 31 37 34 32 34 37 37 39 31 34 39 34 34 5d 2c 5b 22 64 69 22 2c 31 37 5d 5d 0d 0a Data Ascii: 2b)]}'[["sr",null,1742477914944],["di",17]]
2025-03-20 13:48:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:38 UTC	1189	OUT	GET /url?sa=D&q=https://t9oyouthbaseball.com/dclg&ust=1742561580000000&usg=AOvVaw0oNnuzu8GDQHjCQBY5Ey1-&hl=en HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable X-Browser-Year: 2025 X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q= X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved. X-Client-Data: CLf3ygE= Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=522=a-l50PEG5c1xxLdt_cyCoDabHWx3AThMV5G0JgoaycqME6ed0sFSL7fGlLIU9O8kfv14CJ1OFIBnaxTNH7oA0bQeihKf6RcCKpthzq0GfwNYcGMqrl5G2WZYapljKWTzQJ28-7rixRF1D33NhPr9965W86_OGmXfq2uKeWIG2gdqts7RZk1ANOGgleCKZVggGzY_4ww6yg
2025-03-20 13:48:39 UTC	372	IN	HTTP/1.1 200 OK Location: https://t9oyouthbaseball.com/dclg Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Permissions-Policy: unload=() Date: Thu, 20 Mar 2025 13:48:39 GMT Server: gws Content-Length: 355 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-20 13:48:39 UTC	355	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 74 39 6f 79 6f 75 74 68 62 61 73 65 62 61 6c 6c 2e 63 6f 6d 2f 64 63 6c 67 22 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 22 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 74 39 6f 79 6f 75 74 68 62 61 73 65 62 61 6c 6c 2e 63 6f 6d 2f Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>Redirecting</TITLE><META HTTP-EQUIV="refresh" content="1; url=https://t9oyouthbaseball.com/dclg"></HEAD><BODY onLoad="location.replace('https://t9oyouthbaseball.com/

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:39 UTC	694	OUT	GET /dclg HTTP/1.1 Host: t9oyouthbaseball.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:48:40 UTC	217	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 20 Mar 2025 13:48:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 589 Connection: close Set-Cookie: 8f2e915dd=915dd1dc5b7d X-Powered-By: PHP/7.2.30
2025-03-20 13:48:40 UTC	589	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 0a 09 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 Data Ascii: <!DOCTYPE html><html><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="twitter:card" content="summary_large_image"><meta property="og:title" content=""/><meta property="twitter:title" content=""

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:40 UTC	639	OUT	GET /favicon.ico HTTP/1.1 Host: t9oyouthbaseball.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://t9oyouthbaseball.com/dclg Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: 8f2e915dd=915dd1dc5b7d
2025-03-20 13:48:41 UTC	147	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 20 Mar 2025 13:48:41 GMT Content-Type: text/html Content-Length: 552 Connection: close
2025-03-20 13:48:41 UTC	552	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chr

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:41 UTC	743	OUT	GET /downloadreaders/adobe_reader/downloads/AdobeReader.exe HTTP/1.1 Host: bitbucket.org Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://t9oyouthbaseball.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:48:41 UTC	6267	IN	HTTP/1.1 302 Found Date: Thu, 20 Mar 2025 13:48:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/09941335-82ee-4a46-9f39-491b91c71a7d/downloads/9f1aac03-26d5-4668-8e87-2a5e744b5957/AdobeReader.exe?response-content-disposition=attachment%3B%20filename%3D%22AdobeReader.exe%22&AWSAccessKeyId=ASIA6KOSE3BNKEZOBDUK&Signature=BeWLLwTiP9TPUPsJZ0i1f4ocHnk%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEDYaCXVzLWVhc3QtMSJGMEQCIGxqWhBHAh23xcG1v%2BcLmsq3mQsnFIcZbCLK6z0R%2FuPLAiAYXIsAoNazSxv2gpeyqpdgA2C3%2BdWtRMjvZcM5n10aISqwAgiP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIM%2BrLD%2B9NbQ2h3sA4BKoQCESUOjNzRbpL40KSWjx%2FJuQbeKMZYEUcB3GMcuP96JmdtnQwgSNoURC%2FgN4snibQfrYFyU9DRQsMWf%2BMM9jEytw1VyulZL%2FQiEosGrcOb%2FBd68Mt1%2BVXcXJiWtQvfaONkQLt4cthLP2EhL3VkI4IDI7T0p2%2BtJRNLynXuykRGORgAym3b5QG6SUCAsEst4nU6IdQhkP960RyGJYAujWcfjpqpVJAYJBkg%2F0L06DdIZm5BMmMBE5bpcZoUtvG0PZeqMZ1EZFkVzxovtNHgZ%2B2cXewBMH%2FaAkdOEiibiBG06FCzZ1eYmWOk4pPXunk2bMtjKoQgZ5fe9VvT9aYGqFVf3efZYEswq7PwvgY6ngEpHl1vfMGRU1C6DfRWsTVF%2FjIS%2F24NaWArR261nk4FSvi7jeahHWbw2YZf565W1ArPzbuPpm2pXS%2BwjDUuiRr5LDE18ij [TRUNCATED] Expires: Thu, 20 Mar 2025 13:48:41 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 98eca0d61a93 X-Version: ff05a03a9359 X-Static-Version: ff05a03a9359 X-Request-Count: 695 X-Render-Time: 0.07534599304199219 X-B3-Traceid: e296a3f1a91f4d37b9d7869c64445c25 X-B3-Spanid: 86e343535d145057 X-Frame-Options: SAMEORIGIN Content-Security-Policy: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net app.pendo.io cdn.pendo.io pendo-static-6291417196199936.storage.googleapis.com https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; base-uri 'self'; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket- [TRUNCATED] X-Usage-Quota-Remaining: 998848.039 X-Usage-Request-Cost: 1173.57 X-Usage-User-Time: 0.035207 X-Usage-System-Time: 0.000000 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: e296a3f1a91f4d37b9d7869c64445c25 Atl-Request-Id: e296a3f1-a91f-4d37-b9d7-869c64445c25 X-Trace-Id: e296a3f1a91f4d37b9d7869c64445c25 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=98,atl-edge-internal;dur=3,atl-edge-upstream;dur=96,atl-edge-pop;desc="aws-us-east-1" Connection: close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\AdobeReader.exe (copy)

C:\Users\user\Downloads\Unconfirmed 24310.crdownload

C:\Users\user\Downloads\a9f37d9a-812c-476d-86c0-d8f68e5e624e.tmp

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Windows Analysis Report
https://drive.google.com/file/d/1YZImPeFy9OTIvMvYmUyiIlXPlnFTsmR2/view?usp=sharing

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:41 UTC	1831	OUT	GET /09941335-82ee-4a46-9f39-491b91c71a7d/downloads/9f1aac03-26d5-4668-8e87-2a5e744b5957/AdobeReader.exe?response-content-disposition=attachment%3B%20filename%3D%22AdobeReader.exe%22&AWSAccessKeyId=ASIA6KOSE3BNKEZOBDUK&Signature=BeWLLwTiP9TPUPsJZ0i1f4ocHnk%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEDYaCXVzLWVhc3QtMSJGMEQCIGxqWhBHAh23xcG1v%2BcLmsq3mQsnFIcZbCLK6z0R%2FuPLAiAYXIsAoNazSxv2gpeyqpdgA2C3%2BdWtRMjvZcM5n10aISqwAgiP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIM%2BrLD%2B9NbQ2h3sA4BKoQCESUOjNzRbpL40KSWjx%2FJuQbeKMZYEUcB3GMcuP96JmdtnQwgSNoURC%2FgN4snibQfrYFyU9DRQsMWf%2BMM9jEytw1VyulZL%2FQiEosGrcOb%2FBd68Mt1%2BVXcXJiWtQvfaONkQLt4cthLP2EhL3VkI4IDI7T0p2%2BtJRNLynXuykRGORgAym3b5QG6SUCAsEst4nU6IdQhkP960RyGJYAujWcfjpqpVJAYJBkg%2F0L06DdIZm5BMmMBE5bpcZoUtvG0PZeqMZ1EZFkVzxovtNHgZ%2B2cXewBMH%2FaAkdOEiibiBG06FCzZ1eYmWOk4pPXunk2bMtjKoQgZ5fe9VvT9aYGqFVf3efZYEswq7PwvgY6ngEpHl1vfMGRU1C6DfRWsTVF%2FjIS%2F24NaWArR261nk4FSvi7jeahHWbw2YZf565W1ArPzbuPpm2pXS%2BwjDUuiRr5LDE18ijJiZy1h5NklrLG7IVhvHlb8EKbqXm1Et0ysYjbNXP7VQE [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://t9oyouthbaseball.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:48:42 UTC	544	IN	HTTP/1.1 200 OK x-amz-id-2: ETvbbEBW4C+EmCoZ4WFrxSI8Ro+px44y2eguOjAFe4MDT7YuS7gnqwt/kOgEDs9yCz/Vc6IACu0= x-amz-request-id: XCB3RZD45FGSZS6R Date: Thu, 20 Mar 2025 13:48:42 GMT Last-Modified: Wed, 19 Mar 2025 16:05:58 GMT ETag: "90c805d6e27619c7480eb11be841868e" x-amz-server-side-encryption: AES256 x-amz-version-id: 2afb3CLJ2G5PSUjIrXS88MPDXFAB4vJ9 Content-Disposition: attachment; filename="AdobeReader.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Content-Length: 376832 Server: AmazonS3 Connection: close
2025-03-20 13:48:42 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 38 2e 3c 61 59 40 6f 61 59 40 6f 61 59 40 6f 2a 21 43 6e 64 59 40 6f 2a 21 45 6e cf 59 40 6f 2a 21 44 6e 71 59 40 6f 70 df 43 6e 6b 59 40 6f 70 df 44 6e 70 59 40 6f 70 df 45 6e 3a 59 40 6f e2 df 44 6e 68 59 40 6f 2a 21 41 6e 6c 59 40 6f 61 59 41 6f c1 59 40 6f e2 df 49 6e 65 59 40 6f e2 df bf 6f 60 59 40 6f 61 59 d7 6f 60 59 40 6f e2 df 42 6e 60 59 40 6f 52 69 63 68 61 59 40 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$%8.<aY@oaY@oaY@o!CndY@o!EnY@o!DnqY@opCnkY@opDnpY@opEn:Y@oDnhY@o!AnlY@oaYAoY@oIneY@oo`Y@oaYo`Y@oBn`Y@oRichaY@
2025-03-20 13:48:42 UTC	480	IN	Data Raw: 2e 48 ff c2 48 8b 4d b0 48 8b c1 48 81 fa 00 10 00 00 72 15 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 31 e8 5e e1 01 00 90 48 8b c3 48 8b 8d e0 00 00 00 48 33 cc e8 0f dc 01 00 4c 8d 9c 24 f0 01 00 00 49 8b 5b 18 49 8b 73 20 49 8b 7b 28 49 8b e3 5d c3 e8 b5 3f 02 00 90 e8 af 3f 02 00 cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 18 48 89 74 24 20 57 48 81 ec 80 00 00 00 48 8b 05 37 34 05 00 48 33 c4 48 89 44 24 78 48 63 da 48 8b f9 48 89 4c 24 48 33 f6 89 74 24 20 0f 57 c0 0f 11 44 24 28 48 89 74 24 38 48 89 74 24 40 41 b8 54 00 00 00 48 8d 15 1f af 04 00 48 8d 4c 24 28 e8 45 ea ff ff 48 8d 54 24 28 48 8d 4c 24 58 e8 d6 e3 00 00 90 0f 57 c0 0f 11 07 48 89 77 10 48 c7 47 18 0f 00 00 00 40 88 37 c7 44 24 20 01 00 00 00 48 8b d3 83 fb 10 72 Data Ascii: .HHMHHrH'HIH+HHw1^HHH3L$I[Is I{(I]??H\$Ht$ WHH74H3HD$xHcHHL$H3t$ WD$(Ht$8Ht$@ATHHL$(EHT$(HL$XWHwHG@7D$ Hr
2025-03-20 13:48:42 UTC	16384	IN	Data Raw: 24 80 00 00 00 49 8b 5b 20 49 8b 73 28 49 8b e3 5f c3 e8 1d 3e 02 00 cc cc cc cc cc cc cc cc cc 48 89 5c 24 18 55 56 57 41 54 41 55 41 56 41 57 48 8d 6c 24 d9 48 81 ec c0 00 00 00 48 8b 05 9d 32 05 00 48 33 c4 48 89 45 17 48 8b f2 48 89 55 bf 4c 8b f1 48 89 4d af 48 89 55 cf 33 ff 48 8b ca 48 83 7a 18 0f 76 03 48 8b 0a 48 89 7c 24 30 c7 44 24 28 80 00 00 00 c7 44 24 20 03 00 00 00 45 33 c9 44 8b 05 52 65 05 00 ba 00 00 00 80 ff 15 bb c1 03 00 48 89 45 a7 89 7d d7 48 8d 55 c7 48 8b c8 ff 15 17 c2 03 00 8b c8 89 4d c7 8b 05 28 65 05 00 0f 57 c0 3b c8 75 62 41 0f 11 06 49 89 7e 10 49 89 7e 18 45 33 c0 48 8d 15 87 aa 04 00 49 8b ce e8 57 e8 ff ff 90 48 8b 56 18 48 83 fa 0f 76 30 48 ff c2 48 8b 0e 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 4c 8b 41 f8 49 2b c8 48 Data Ascii: $I[ Is(I_>H\$UVWATAUAVAWHl$HH2H3HEHHULHMHU3HHzvHH\|$0D$(D$ E3DReHE}HUHM(eW;ubAI~I~E3HIWHVHv0HHHrH'LAI+H
2025-03-20 13:48:42 UTC	1024	IN	Data Raw: 04 00 f3 0f 7f 45 2f c6 45 1f 00 0f 10 03 0f 11 45 1f 0f 10 4b 10 0f 11 4d 2f 4c 89 73 10 48 c7 43 18 0f 00 00 00 c6 03 00 48 8b 55 17 48 83 fa 0f 76 31 48 ff c2 48 8b 4d ff 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 a7 00 00 00 e8 48 9f 01 00 48 8d 55 1f 48 83 7d 37 0f 48 0f 47 55 1f 48 8b cf ff 15 f5 81 03 00 48 85 c0 74 12 48 8b ce ff d0 8b d8 48 8b cf ff 15 f0 81 03 00 eb 11 8b 5d b7 48 8b cf ff 15 e2 81 03 00 eb 03 8b 5d b7 48 8b 55 37 48 83 fa 0f 76 2d 48 ff c2 48 8b 4d 1f 48 8b c1 48 81 fa 00 10 00 00 72 15 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 2b e8 d2 9e 01 00 8b c3 48 8b 4d 3f 48 33 cc e8 88 99 01 00 4c 8d 9c 24 b0 00 00 00 49 8b 5b 28 49 8b 73 30 49 8b e3 41 5e 5f 5d Data Ascii: E/EEKM/LsHCHUHv1HHMHHrH'HIH+HHHHUH}7HGUHHtHH]H]HU7Hv-HHMHHrH'HIH+HHw+HM?H3L$I[(Is0IA^_]
2025-03-20 13:48:42 UTC	16384	IN	Data Raw: 8d 4d 18 e8 58 a4 ff ff 48 8b d0 48 8d 8d 90 04 00 00 e8 b9 9e 00 00 90 48 8d 15 f9 6c 04 00 48 8d 8d e0 01 00 00 e8 35 a4 ff ff 48 8b d0 48 8d 8d 10 05 00 00 e8 96 9e 00 00 90 48 8d 8d 90 04 00 00 e8 79 a4 ff ff 48 8b c8 ff 15 08 7e 03 00 48 8b d8 48 85 c0 74 3f 48 8d 8d 10 05 00 00 e8 5c a4 ff ff 48 8b d0 48 8b cb ff 15 00 7e 03 00 48 85 c0 74 19 ff d0 85 c0 74 13 0f b6 15 3e 26 05 00 48 8d 8d 30 04 00 00 e8 82 67 00 00 48 8b cb ff 15 e9 7d 03 00 8b d7 48 8d 4d b8 e8 9e b3 ff ff 48 8b d8 4c 8d 85 f0 04 00 00 48 8d 95 50 04 00 00 48 8d 8d 40 02 00 00 e8 51 75 00 00 90 4c 8d 85 88 02 00 00 48 8b d0 48 8d 8d 20 02 00 00 e8 9a 73 00 00 90 4c 8d 85 70 05 00 00 48 8b d0 48 8d 8d 00 02 00 00 e8 83 73 00 00 90 4c 8d 85 88 02 00 00 48 8b d0 48 8d 8d e8 02 00 00 Data Ascii: MXHHHlH5HHHyH~HHt?H\HH~Htt>&H0gH}HMHLHPH@QuLHH sLpHHsLHH
2025-03-20 13:48:42 UTC	1024	IN	Data Raw: 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 9a 10 00 00 e8 96 5b 01 00 4c 89 bd d0 03 00 00 48 c7 85 d8 03 00 00 0f 00 00 00 c6 85 c0 03 00 00 00 48 8b 95 20 03 00 00 48 83 fa 0f 76 34 48 ff c2 48 8b 8d 08 03 00 00 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 46 10 00 00 e8 3c 5b 01 00 4c 89 bd 18 03 00 00 48 c7 85 20 03 00 00 0f 00 00 00 c6 85 08 03 00 00 00 48 8b 95 b0 02 00 00 48 83 fa 0f 76 34 48 ff c2 48 8b 8d 98 02 00 00 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 f2 0f 00 00 e8 e2 5a 01 00 4c 89 bd a8 02 00 00 48 c7 85 b0 02 00 00 0f 00 00 00 c6 85 98 02 00 00 00 48 8b 95 58 04 00 00 48 83 fa 0f 0f 86 cf 0a 00 00 48 ff c2 48 8b 8d 40 04 00 00 48 Data Ascii: H+HH[LHH Hv4HHHHrH'HIH+HHF<[LH HHv4HHHHrH'HIH+HHZLHHXHHH@H
2025-03-20 13:48:42 UTC	16384	IN	Data Raw: 00 90 48 8d 56 48 48 8d 8d 58 02 00 00 e8 9e 5b ff ff 90 ba 18 00 00 00 48 8d 8d 50 01 00 00 e8 5c 71 ff ff 48 8d 45 80 48 89 44 24 30 48 8d 15 34 e3 04 00 48 8d 4d 80 e8 d3 24 00 00 48 8b d8 48 8d 95 58 02 00 00 48 8d 4c 24 38 e8 bf 24 00 00 90 4c 8b c3 48 8b d0 48 8d 8d 50 01 00 00 e8 7c 5c 00 00 90 48 8d 45 10 48 89 44 24 30 48 8d 45 c0 48 89 44 24 58 48 8d 15 06 24 04 00 48 8d 8d f0 04 00 00 e8 d6 5f ff ff 48 8b d0 48 8d 4d 10 e8 3a 5a 00 00 48 8b f8 48 8d 15 e4 23 04 00 48 8d 8d 80 04 00 00 e8 b4 5f ff ff 48 8b d0 48 8d 4d c0 e8 18 5a 00 00 48 8b d8 48 8b 95 50 01 00 00 48 8d 4d a0 e8 45 24 00 00 90 4c 8b cf 4c 8b c3 48 8b d0 48 8d 8d 98 01 00 00 e8 ef 99 ff ff 90 48 8d 95 98 01 00 00 48 8d 4d 80 e8 be 5a ff ff 48 8b d0 48 8d 8d 98 01 00 00 e8 7f 23 Data Ascii: HVHHX[HP\qHEHD$0H4HM$HHXHL$8$LHHP\|\HEHD$0HEHD$XH$H_HHM:ZHH#H_HHMZHHPHME$LLHHHHMZHH#
2025-03-20 13:48:42 UTC	1024	IN	Data Raw: 4c 8b 6c 24 38 4c 8b 64 24 40 48 8b bc 24 80 00 00 00 4c 8b 74 24 30 48 83 c4 48 41 5f 5e 5d 5b c3 e8 0e 76 01 00 cc e8 f4 16 ff ff cc e8 ae 17 ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 56 41 54 41 55 48 83 ec 38 4c 8b 61 10 48 bb ff ff ff ff ff ff ff 7f 48 8b c3 4d 8b e9 49 2b c4 48 8b f1 48 3b c2 0f 82 5a 01 00 00 48 89 6c 24 70 4a 8d 2c 22 48 89 7c 24 30 48 8b d5 48 83 ca 0f 4c 89 74 24 28 4c 89 7c 24 20 4c 8b 79 18 48 3b d3 77 44 49 8b cf 48 8b c3 48 d1 e9 48 2b c1 4c 3b f8 77 33 4a 8d 04 39 48 8b da 48 3b d0 48 0f 42 d8 48 8d 4b 01 48 85 c9 75 04 33 ff eb 4d 48 81 f9 00 10 00 00 72 3c 48 8d 41 27 48 3b c1 0f 86 ea 00 00 00 eb 0e 48 b8 00 00 00 00 00 00 00 80 48 83 c0 27 48 8b c8 e8 40 14 01 00 48 85 c0 0f 84 c3 00 00 00 48 8d 78 27 48 83 Data Ascii: Ll$8Ld$@H$Lt$0HHA_^][v@SVATAUH8LaHHMI+HH;ZHl$pJ,"H\|$0HHLt$(L\|$ LyH;wDIHHH+L;w3J9HH;HBHKHu3MHr<HA'H;HH'H@HHx'H
2025-03-20 13:48:42 UTC	16384	IN	Data Raw: ff ff ff ff ff ff ff 7f 48 8b c5 49 2b c7 49 3b c4 0f 82 cf 00 00 00 49 8b c5 48 83 c8 0f 48 3b c5 76 2d 48 b8 00 00 00 00 00 00 00 80 48 83 c0 27 48 8b c8 e8 f7 10 01 00 48 85 c0 0f 84 98 00 00 00 4c 8d 70 27 49 83 e6 e0 49 89 46 f8 eb 34 b9 16 00 00 00 48 8b e8 48 3b c1 48 0f 42 e9 48 8d 4d 01 48 85 c9 74 1c 48 81 f9 00 10 00 00 72 0b 48 8d 41 27 48 3b c1 76 66 eb b5 e8 af 10 01 00 4c 8b f0 4c 89 33 4c 89 6b 10 48 89 6b 18 48 83 7f 18 0f 76 03 48 8b 3f 4d 8b c7 48 8b d7 49 8b ce e8 89 9d 02 00 48 83 7e 18 0f 76 03 48 8b 36 4d 8d 44 24 01 48 8b d6 4b 8d 0c 3e e8 6e 9d 02 00 48 8b c3 48 8b 5c 24 68 48 83 c4 20 41 5f 41 5e 41 5d 41 5c 5f 5e 5d c3 e8 55 71 01 00 cc e8 3b 12 ff ff cc e8 f5 12 ff ff cc cc cc cc cc 48 89 5c 24 10 55 56 57 41 54 41 55 41 56 41 Data Ascii: HI+I;IHH;v-HH'HHLp'IIF4HH;HBHMHtHrHA'H;vfLL3LkHkHvH?MHIH~vH6MD$HK>nHH\$hH A_A^A]A\_^]Uq;H\$UVWATAUAVA
2025-03-20 13:48:42 UTC	1024	IN	Data Raw: 89 84 24 b0 00 00 00 48 8b 94 24 b0 00 00 00 48 8d 8c 24 f8 01 00 00 e8 b4 d6 ff ff 90 48 8d 8c 24 f8 01 00 00 e8 96 dc fe ff 48 8b c8 ff 15 25 b6 02 00 48 89 84 24 b8 00 00 00 48 83 bc 24 b8 00 00 00 00 75 39 48 8d 15 0b 9f 03 00 48 8b 8c 24 80 02 00 00 e8 06 dc fe ff 8b 44 24 50 83 c8 01 89 44 24 50 48 8d 8c 24 f8 01 00 00 e8 5e db fe ff 48 8b 84 24 80 02 00 00 e9 07 05 00 00 45 33 c9 45 33 c0 33 d2 48 8d 8c 24 50 02 00 00 e8 9c d0 ff ff 45 33 c0 48 8d 94 24 50 02 00 00 48 8d 8c 24 18 02 00 00 e8 b4 ed ff ff 48 c7 c1 fe ff ff ff e8 88 f0 ff ff 33 c9 e8 11 ef ff ff 48 89 44 24 60 33 c9 e8 35 ec ff ff 89 44 24 58 b9 01 00 00 00 e8 27 ec ff ff 89 44 24 54 8b 05 e1 5d 04 00 39 84 24 88 02 00 00 0f 84 53 01 00 00 c7 84 24 30 01 00 00 30 00 00 00 48 8d 84 24 Data Ascii: $H$H$H$H%H$H$u9HH$D$PD$PH$^H$E3E33H$PE3H$PH$H3HD$`35D$X'D$T]9$S$00H$

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:51 UTC	202	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:51 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:51 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 19 Mar 2025 16:10:57 GMT ETag: "0x8DD6700A2498560" x-ms-request-id: 5cbf31d2-401e-0016-2cfc-9853e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134851Z-186895dd8bdkwn8shC1EWRkk180000000ezg00000000147q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:51 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2025-03-20 13:48:51 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2025-03-20 13:48:51 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2025-03-20 13:48:51 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2025-03-20 13:48:51 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2025-03-20 13:48:51 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2025-03-20 13:48:52 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2025-03-20 13:48:52 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2025-03-20 13:48:52 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2025-03-20 13:48:52 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:52 UTC	199	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:52 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: f281ec8c-d01e-0014-461c-99ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134852Z-186895dd8bdvl5lbhC1EWRmxds0000000grg00000000d6vw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:52 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:52 UTC	199	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:52 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:52 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: bb85e804-d01e-0028-68be-987896000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134852Z-186895dd8bd2r62ghC1EWRf0v00000000eq000000000733y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:52 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:52 UTC	199	OUT	GET /rules/rule120600v5s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:52 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:52 GMT Content-Type: text/xml Content-Length: 3870 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 19 Nov 2024 13:00:34 GMT ETag: "0x8DD089A27B58D5A" x-ms-request-id: 7e231d3d-e01e-0052-35fc-98d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134852Z-186895dd8bdkvr8rhC1EWR0teg0000000d4g000000007z9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:52 UTC	3870	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="5" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:52 UTC	199	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:52 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4ac19812-301e-005d-33c8-98e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134852Z-186895dd8bdlbckjhC1EWR44e40000000cvg000000006u7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:52 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:52 UTC	199	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:52 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f991acef-d01e-0082-25db-98e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134852Z-186895dd8bdqzr24hC1EWRscdn0000000bv000000000g6s7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:52 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:53 UTC	199	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:53 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6bc08573-401e-0078-05fc-984d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134853Z-186895dd8bdz6l5qhC1EWRwurn0000000e4000000000hh3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:53 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:53 UTC	199	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:53 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:53 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 2cc1f298-801e-0067-6549-99fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134853Z-186895dd8bdjz8r9hC1EWR3n3n0000000dxg000000004z1u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:53 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:48:53 UTC	199	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-20 13:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:48:53 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c4b62858-e01e-003c-44d4-98c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20250320T134853Z-186895dd8bdpn7zfhC1EWR5w3w0000000e3g000000001zp8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-20 13:48:53 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />