Edit tour

Windows Analysis Report
https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6

Overview

General Information

Sample URL:	https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6
Analysis ID:	1523600
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2000,i,7732493170639082351,9406106685669153208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 3539sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://drive.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA

Source: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6	Matcher: Template: wellsfargo matched
Source: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6	Matcher: Template: wellsfargo matched
Source: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6	Matcher: Template: wellsfargo matched
Source: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6	Matcher: Template: wellsfargo matched

Source: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49728 version: TLS 1.2

Source:	Binary string: _.KDb=!!(_.Zg[0]>>17&1);_.LDb=!!(_.Zg[0]>>18&1);_.MDb=!!(_.Zg[0]>>23&1);_.NDb=!!(_.Zg[0]>>24&1);_.ODb=!!(_.Zg[0]>>25&1);_.PDb=!!(_.Zg[0]>>26&1);_.Zv=!!(_.Zg[0]>>27&1);_.QDb=!!(_.Zg[0]>>28&1);_.RDb=!!(_.Zg[1]&4);_.SDb=!!(_.Zg[1]&8);_.TDb=!!(_.Zg[1]&16);_.UDb=!!(_.Zg[1]&32);_.VDb=!!(_.Zg[1]&64);_.WDb=!!(_.Zg[1]>>15&1);_.XDb=!!(_.Zg[1]>>16&1);_.YDb=!!(_.Zg[1]>>17&1);_.ZDb=!!(_.Zg[1]>>19&1);_.$Db=!!(_.Zg[1]>>25&1);_.aEb=!!(_.Zg[1]>>26&1);_.bEb=!!(_.Zg[1]>>27&1);_.$v=!!(_.Zg[1]>>28&1); source: chromecache_222.2.dr, chromecache_518.2.dr
Source:	Binary string: _.C(odb,_.Nd);odb.prototype.listen=function(a,b){a=_.Ee(this.root,a,b);this.ka.add(a);return a};odb.prototype.listenOnce=function(a,b){var c=this,d;return d=this.listen(a,function(e){c.Rm(d);b(e)})};odb.prototype.Rm=function(a){var b=_.Fe(a);a=this.ka.delete(a);return b&&a};_.pdb=function(a){var b=a.ej.eFd;b\|\|(b=a.ej.eFd=new odb(a.FN),_.Cg(a,b));return b};_.ir=function(a){return a.ej.DMa?a.ej.DMa:a.ej.DMa=new _.mm(a)};qdb=function(a,b){b&&(a[_.kpa]=new ndb(b,function(){a[_.kpa]=void 0}))}; source: chromecache_272.2.dr, chromecache_371.2.dr

Source: global traffic	TCP traffic: 192.168.2.5:50011 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50210 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_338.2.dr	String found in binary or memory: "pagePath": "https://www.facebook.com/Google" equals www.facebook.com (Facebook)
Source: chromecache_338.2.dr	String found in binary or memory: "pagePath": "https://www.linkedin.com/company/google" equals www.linkedin.com (Linkedin)
Source: chromecache_338.2.dr	String found in binary or memory: "pagePath": "https://www.youtube.com/google" equals www.youtube.com (Youtube)
Source: chromecache_338.2.dr	String found in binary or memory: href="https://www.facebook.com/Google"> equals www.facebook.com (Facebook)
Source: chromecache_338.2.dr	String found in binary or memory: href="https://www.linkedin.com/company/google"> equals www.linkedin.com (Linkedin)
Source: chromecache_338.2.dr	String found in binary or memory: href="https://www.youtube.com/google"> equals www.youtube.com (Youtube)
Source: chromecache_338.2.dr	String found in binary or memory: '//www.youtube.com', equals www.youtube.com (Youtube)
Source: chromecache_338.2.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?caption=Generative%20AI%20in%20Search%3A%20Let%20Google%20do%20the%20searching%20for%20you&u=https://blog.google/products/search/generative-ai-google-search-may-2024/" equals www.facebook.com (Facebook)
Source: chromecache_338.2.dr	String found in binary or memory: href="https://www.linkedin.com/shareArticle?mini=true&url=https://blog.google/products/search/generative-ai-google-search-may-2024/&title=Generative%20AI%20in%20Search%3A%20Let%20Google%20do%20the%20searching%20for%20you" equals www.linkedin.com (Linkedin)
Source: chromecache_338.2.dr	String found in binary or memory: <meta property="article:publisher" content="https://www.facebook.com/Google/" /> equals www.facebook.com (Facebook)
Source: chromecache_535.2.dr	String found in binary or memory: L.getElementsByTagName("iframe"),la=P.length,na=0;na<la;na++)if(!v&&c(P[na],H.Ie)){nJ("https://www.youtube.com/iframe_api");v=!0;break}})}}else F(u.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,v=!1;Z.__ytl=n;Z.__ytl.o="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_383.2.dr, chromecache_560.2.dr, chromecache_390.2.dr, chromecache_535.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},dk:function(){e=zb()},od:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)
Source: chromecache_432.2.dr, chromecache_414.2.dr	String found in binary or memory: Mf=w(["https://sandbox.google.com/tools/feedback/"]),Nf=w(["https://www.google.cn/tools/feedback/"]),Of=w(["https://help.youtube.com/tools/feedback/"]),Pf=w(["https://asx-frontend-staging.corp.google.com/inapp/"]),Qf=w(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),Rf=w(["https://localhost.corp.google.com/inapp/"]),Sf=w(["https://localhost.proxy.googlers.com/inapp/"]),Tf=V(vf),Uf=[V(wf),V(xf)],Vf=[V(yf),V(zf),V(Af),V(Bf),V(Cf),V(Df),V(Ef),V(Ff),V(Gf),V(Hf)],Wf=[V(If),V(Jf)],Xf= equals www.youtube.com (Youtube)
Source: chromecache_425.2.dr, chromecache_231.2.dr	String found in binary or memory: YTb.prototype.H=function(a){var b=a.w7;if(!b)return{};var c=b.f$,d,e,f=(d=b.SY)==null?void 0:(e=d.h7)==null?void 0:e.message,g;b=(g=b.SY)==null?void 0:g.state;var k;g=(k=a.E8)==null?void 0:k.x5;var l;k=(l=a.waa)==null?void 0:l.vaa;c={player_response:c,reason:f,status:b,hbut:g,ttsurl:k};var n;if((n=a.UW)==null?0:n.duration)c.length_seconds=a.UW.duration.replace(XTb,"");return c};var aUb=function(a){EH.call(this,a.oa());this.context=a;this.L=new Sg};O(aUb,EH);aUb.prototype.D=function(){return"onYouTubeIframeAPIReady"};aUb.prototype.H=function(){var a=PE(this.context.ja())\|\|new DH;return PFa(y(a,1,"https://www.youtube.com"),"iframe_api")};aUb.prototype.C=function(){return rl("YT.Player",this.oa().getWindow())};aUb.prototype.og=function(){return this.L};var bUb=function(){yw.apply(this,arguments)};O(bUb,yw);var EJ=function(a){Sg.call(this);this.context=a;this.F=null;this.V=!1;this.L=0;this.J=null;this.sa(this.context);var b=a.ja();a=a.oa();zE(b)\|\|Ig(b,83);this.H=new Umb;var c=cUb(b);Xmb(this.H,c,function(){return L4a(c,!0)});Wmb(this.H,c);this.handler=new vv(this);this.sa(this.handler);this.C=new iCb;this.sa(this.C);dUb(this,b,a);eUb(this);this.D&&Ti(b)&&(this.context.get(aB).start(),this.D.Hb({ea:1}),(b=vj(b))&&this.context.get(aB).setEnabled(!!G(b,18,!1)));this.root=(b=wf(this.context,FDb))&&b.isEnabled()? equals www.youtube.com (Youtube)
Source: chromecache_212.2.dr, chromecache_300.2.dr	String found in binary or memory: inline:{css:1},disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"}, equals www.youtube.com (Youtube)
Source: chromecache_251.2.dr, chromecache_279.2.dr, chromecache_530.2.dr, chromecache_378.2.dr	String found in binary or memory: return b}IC.F="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: sustainability.google
Source: global traffic	DNS traffic detected: DNS query: www.blog.google
Source: global traffic	DNS traffic detected: DNS query: blog.google
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: googletagmanager.com
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ampproject.org

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2000,i,7732493170639082351,9406106685669153208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2000,i,7732493170639082351,9406106685669153208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://feedback.googleusercontent.com/resources/annotator.css	0%	URL Reputation	safe
https://apis.google.com/js/client.js	0%	URL Reputation	safe
https://support.google.com	0%	URL Reputation	safe
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://sustainability.google/static/index.min.js?cache=47ade0f	0%	URL Reputation	safe
https://pay.google.com/gp/v/widget/save	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	0%	URL Reputation	safe
https://sandbox.google.com/inapp/%	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://sustainability.google/static/index.min.css?cache=732a3af	0%	URL Reputation	safe
https://blog.google/outreach-initiatives/sustainability/google-wildfire-boundary-maps-europe-africa/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.com/inapp/	0%	URL Reputation	safe
https://support.google.com/inapp/%	0%	URL Reputation	safe
https://lens.google.com/gen204	0%	URL Reputation	safe
https://blog.google/outreach-initiatives/sustainability/2024-environmental-report/	0%	URL Reputation	safe
https://support.google.com/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/inapp/	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
https://feedback2-test.corp.google.com/inapp/%	0%	URL Reputation	safe
http://hammerjs.github.io/	0%	URL Reputation	safe
https://sandbox.google.com/inapp/	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	0%	URL Reputation	safe

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.142	unknown	United States	15169	GOOGLEUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.232	googletagmanager.com	United States	15169	GOOGLEUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
172.217.18.1	unknown	United States	15169	GOOGLEUS	false
142.250.185.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.83	ghs-svc-https-sni.ghs-ssl.googlehosted.com	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
142.250.185.78	drive.google.com	United States	15169	GOOGLEUS	false
142.250.185.206	google.com	United States	15169	GOOGLEUS	false
142.250.186.174	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.238	play.google.com	United States	15169	GOOGLEUS	false
216.239.34.21	sustainability.google	United States	15169	GOOGLEUS	false
216.239.38.21	unknown	United States	15169	GOOGLEUS	false
172.217.18.97	cdn-content.ampproject.org	United States	15169	GOOGLEUS	false
142.250.186.177	csp.withgoogle.com	United States	15169	GOOGLEUS	false
216.239.32.21	blog.google	United States	15169	GOOGLEUS	false
142.250.181.225	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523600
Start date and time:	2024-10-01 20:26:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus21.phis.win@23/548@58/23
Cookbook Comments:	Browse: https://www.google.com/ Browse: https://sustainability.google/?utm_source=googlehpfooter&utm_medium=housepromos&utm_campaign=bottom-footer&utm_content= Browse: https://google.com/search/howsearchworks/?fg=1

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Name	IP	Active	Malicious	Reputation
blobcomments-pa.clients6.google.com	142.250.186.138	true	false	unknown
google.com	142.250.185.206	true	false	unknown
csp.withgoogle.com	142.250.186.177	true	false	unknown
plus.l.google.com	142.250.186.78	true	false	unknown
googletagmanager.com	142.250.185.232	true	false	unknown
peoplestackwebexperiments-pa.clients6.google.com	216.58.212.138	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
play.google.com	142.250.181.238	true	false	unknown
www3.l.google.com	142.250.186.174	true	false	unknown
sustainability.google	216.239.34.21	true	false	unknown
ghs-svc-https-sni.ghs-ssl.googlehosted.com	142.250.186.83	true	false	unknown
drive.google.com	142.250.185.78	true	false	unknown
www.google.com	172.217.16.196	true	false	unknown
blog.google	216.239.32.21	true	false	unknown
cdn-content.ampproject.org	172.217.18.97	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.185.193	true	false	unknown
www.blog.google	unknown	unknown	false	unknown
ogs.google.com	unknown	unknown	false	unknown
lh3.googleusercontent.com	unknown	unknown	false	unknown
cdn.ampproject.org	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://apis.google.com/js/googleapis.proxy.js?onload=startup	false		unknown
https://blog.google/static/blogv2/js/csp/gtm.js?version=pr20240911-2220	false		unknown
https://www.google.com/search/howsearchworks/assets/hIvGK13F.min.js	false		unknown
https://google.com/search/howsearchworks/?fg=1	false		unknown
https://www.google.com/search/howsearchworks/assets/bAPu5B1A.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/J8wBfiw3.min.js	false		unknown
https://sustainability.google/static/index.min.js?cache=47ade0f	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?prid=19040333&pgid=19037049&puid=86ee7442362823ae&eom=1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=en	false		unknown
https://lh3.googleusercontent.com/fvNhHugJAnsAS2DJW1V3kQ-0lsCTl2eDWV9NW2p4KXStsynp7EjqGSiACH9xSdCIvPvw0z9l_L7kOtfVZH07iQuasGIGWyFqhpdY=s0-rw-e365	false		unknown
https://lh3.googleusercontent.com/KFlNAaVs85YpfRd4QhVbLq0xLBY-aRG2TLZxxMNyXyXDis2RfuycaeIqpASHRwANtaMhTdsbBwYGtalRjWd1_bdDuDRtap9NeQ2B=s0-rw-e365	false		unknown
https://www.google.com/xjs/_/js/md=2/k=xjs.hd.en.QLkG0SrSjNo.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAEAQoAAAAAoAAAAAAAAAAAAAAAAAAAgABBAAAiAQAAAQCwAAAgEAAAAQACAgCAAAnAo0wAABEATAAAAAAAEAAABBQBAAAQAADAAAAAIAAAAAAAQAEAAAAAAAAAAAAAAAAAQACBAAAAAAAAAAAAAAQAAABADwAAAAAAAAAgAACAAAEAwAAZgAAAAAAAAIA-AAgeAEMKCwAAAAAAAAAAAAAABCBBMBcSUBCAAAAAAAAAAAAAAAAAAEhJExc2/rs=ACT90oFMRHr3TChM7YpvVW3wNTm2ewwfJg	false		unknown
https://blog.google/products/search/generative-ai-google-search-may-2024/	false		unknown
https://sustainability.google/static/index.min.css?cache=732a3af	false	URL Reputation: safe	unknown
https://www.google.com/favicon.ico	false		unknown
https://blog.google/static/keyword/js/all/index.js?version=pr20240911-2220	false		unknown
https://cdn.ampproject.org/amp-story-player-v0.css	false		unknown
https://blog.google/static/blogv2/images/newsletter-envelope-letter-approved.svg	false		unknown
https://www.google.com/search/howsearchworks/assets/0-7k4-1q.min.js	false		unknown
https://www.google.com/gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=Ij_8ZtLFPJPZxc8P5Yuw2QY&zx=1727807275917&opi=89978449	false		unknown
https://www.google.com/search/howsearchworks/assets/IFunn9hk.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/bS7WqXuL.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/BLvkbcMJ.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/u4Ay35bP.min.js	false		unknown
https://www.google.com/client_204?cs=1&opi=89978449	false		unknown
https://lh3.googleusercontent.com/VzZoNfTFy0Q5bMd9mVfo4M7dp1-OXWmUWsSAttnwnbw6agWisqAeJeJUCzxiZq1UhJff1rvLgHGOfQ7N44OdZHUdN66d3lEIwHh0=s0-rw-e365	false		unknown
https://lh3.googleusercontent.com/EBPAhXOL1V7V-htVUiggxWVB6mPR2IJrSak2HsjCMAM-FA5nQYnvp8epTuRSDwDQPvqJov_qzDoOpYJFvcVUhk9a__VISQ7GxYuB=s0-rw-e365	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://signaler-staging.sandbox.google.com	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://apis.google.com/js/client.js	chromecache_432.2.dr, chromecache_425.2.dr, chromecache_414.2.dr, chromecache_231.2.dr	false	URL Reputation: safe	unknown
https://blog.google/products/shopping/back-to-school-2024-shopping-tips/	chromecache_338.2.dr	false		unknown
https://support.google.com	chromecache_338.2.dr, chromecache_231.2.dr	false	URL Reputation: safe	unknown
https://lh3.googleusercontent.com/6Q907Y7fYBiaW6VAnv1r8BHZnFXjJm138u89gr8j8NSikSES5OrnMMP0bDiTWR7YyY	chromecache_359.2.dr	false		unknown
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_494.2.dr, chromecache_341.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/zh-TW/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/helping-monarch-butterflies-2024/	chromecache_263.2.dr, chromecache_400.2.dr	false		unknown
https://www.google.com/intl/en-IN/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://pay.google.com/gp/v/widget/save	chromecache_300.2.dr	false	URL Reputation: safe	unknown
https://support.google.com/docs/answer/49114	chromecache_231.2.dr	false		unknown
https://drive-thirdparty.googleusercontent.com/	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://ogs.google.com/widget/callout?eom=1	chromecache_314.2.dr	false		unknown
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/google	chromecache_338.2.dr	false		unknown
https://blog.google/products/search/generative-ai-search/	chromecache_338.2.dr	false		unknown
https://lh3.googleusercontent.com/iRxTGREAOizQhtbCjDGShDHvBc39qEI004M8SClsSzIBgvBsbUMFNVMDfAfzoEzgvr	chromecache_359.2.dr	false		unknown
https://www.google.com/intl/no/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://www.google.com/intl/hr/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://sandbox.google.com/inapp/%	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://lh3.googleusercontent.com/VT4SCA4b12NEXu4W5qmH5nMdrHvYyXiasJ8kqJWUd7rtLUdO78YTV5v0ulPoXyXn8X	chromecache_359.2.dr	false		unknown
https://tasks.google.com/	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://www.google.com/intl/es/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://www.google.com/recaptcha/api.js?trustedtypes=true	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://www.google.com/intl/el/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://apis.google.com/js/api.js	chromecache_231.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/es-419/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://www.youtube.com/subscribe_embed?usegapi=1	chromecache_212.2.dr, chromecache_300.2.dr	false		unknown
https://lh3.googleusercontent.com/uEalHdGqJHrnhoH1O5rYmk5kO2c-xB5HxCobW5KSipKv22HsrmhZNjVvQmBdWcV06W	chromecache_359.2.dr	false		unknown
https://github.com/shoelace-style/shoelace/blob/next/src/internal/slot.ts	chromecache_229.2.dr, chromecache_343.2.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/google-wildfire-boundary-maps-europe-africa/	chromecache_263.2.dr, chromecache_400.2.dr	false	URL Reputation: safe	unknown
https://blog.google/products/maps/google-ai-tools-travel-vacation/	chromecache_338.2.dr	false		unknown
https://www.google.com/intl/pt/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/en-GB/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://lh3.googleusercontent.com/OMmSijDU0neu_vZPqLWBrVJsQGT_D0ejrnpIgQMPkTZC-0s9dO6_kbV3sGb2q9BWmp	chromecache_359.2.dr	false		unknown
https://www.google.com/intl/da/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://drive.google.com/requestreview?id=	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://support.google.com/docs/answer/13447609	chromecache_231.2.dr	false		unknown
https://play.google.com	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://www.google.com/intl/bg/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://support.google.com/inapp/%	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/id/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://lens.google.com/gen204	chromecache_222.2.dr, chromecache_518.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/hu/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://www.google.com/shopping/customerreviews/badge?usegapi=1	chromecache_212.2.dr, chromecache_300.2.dr	false		unknown
https://blog.google/products/search/new-ways-to-connect-to-the-web-with-ai-overviews/	chromecache_338.2.dr	false		unknown
https://www.google.com/intl/ru/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/2024-environmental-report/	chromecache_263.2.dr, chromecache_400.2.dr	false	URL Reputation: safe	unknown
https://lh3.googleusercontent.com/a/default-user	chromecache_455.2.dr, chromecache_231.2.dr	false		unknown
https://support.google.com/inapp/	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://apis.google.com	chromecache_300.2.dr, chromecache_259.2.dr, chromecache_451.2.dr, chromecache_344.2.dr, chromecache_314.2.dr, chromecache_423.2.dr, chromecache_421.2.dr	false	URL Reputation: safe	unknown
https://domains.google.com/suggest/flow	chromecache_375.2.dr, chromecache_508.2.dr, chromecache_451.2.dr, chromecache_421.2.dr	false	URL Reputation: safe	unknown
https://twitter.com/google	chromecache_338.2.dr	false		unknown
https://apps-drive-picker-dev.corp.google.com/picker/minpick/main	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/google-ai-wildfire-detection/	chromecache_263.2.dr, chromecache_400.2.dr	false		unknown
https://lh3.googleusercontent.com/ByIuDjG_OxNhZWu_Bix9cHR32kCnpGrjVaunDIzC9Q75eon4dC4Ei5h2pcD85FyPcj	chromecache_359.2.dr	false		unknown
https://feedback2-test.corp.google.com/inapp/%	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
http://hammerjs.github.io/	chromecache_562.2.dr, chromecache_325.2.dr	false	URL Reputation: safe	unknown
https://workspace.google.com/terms/google-workspace-individual-terms/esignature-signer/	chromecache_231.2.dr	false		unknown
http://www.bohemiancoding.com/sketch/ns	chromecache_284.2.dr, chromecache_489.2.dr	false		unknown
https://www.google.com/intl/sv/search/howsearchworks/	chromecache_359.2.dr	false		unknown
https://sandbox.google.com/inapp/	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://www.linkedin.com/shareArticle?mini=true&url=https://blog.google/products/search/generative-a	chromecache_338.2.dr	false		unknown
https://mygoogle.corp.google.com/help/answer/9011840	chromecache_425.2.dr, chromecache_231.2.dr	false		unknown
https://www.google.com/tools/feedback/%	chromecache_432.2.dr, chromecache_414.2.dr	false		unknown
https://adservice.google.com/pagead/regclk?	chromecache_378.2.dr	false		unknown
https://www.google.com/intl/th/search/howsearchworks/	chromecache_359.2.dr	false		unknown
http://www.broofa.com	chromecache_329.2.dr, chromecache_272.2.dr, chromecache_259.2.dr, chromecache_425.2.dr, chromecache_344.2.dr, chromecache_423.2.dr, chromecache_231.2.dr, chromecache_371.2.dr	false	URL Reputation: safe	unknown
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_432.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://myaccount.google.com/yourdata/search?pli=1	chromecache_359.2.dr	false		unknown

Input	Output
URL: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6 Model: jbxai	{ "brand":["Wells Fargo"], "contains_trigger_text":true, "trigger_text":"To continue, let us know you're not a robot.", "prominent_button_name":"VERIFY", "text_input_field_labels":["I'm not a robot"], "pdf_icon_visible":false, "has_visible_captcha":true, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6 Model: jbxai	{ "brand":["Wells Fargo"], "contains_trigger_text":true, "trigger_text":"To continue, let us know you're not a robot.", "prominent_button_name":"VERIFY", "text_input_field_labels":["I'm not a robot"], "pdf_icon_visible":false, "has_visible_captcha":true, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6 Model: jbxai	{ "brand":["Wells Fargo"], "contains_trigger_text":true, "trigger_text":"To continue, let us know you're not a robot.", "prominent_button_name":"VERIFY", "text_input_field_labels":["I'm not a robot"], "pdf_icon_visible":false, "has_visible_captcha":true, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6 Model: jbxai	{ "brand":["Wells Fargo"], "contains_trigger_text":true, "trigger_text":"I'm not a robot", "prominent_button_name":"VERIFY", "text_input_field_labels":["I'm not a robot"], "pdf_icon_visible":false, "has_visible_captcha":true, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.google.com/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["Google Search", "I'm Feeling Lucky"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.google.com/search/howsearchworks/?fg=1 Model: jbxai	{ "brand":["Google"], "contains_trigger_text":true, "trigger_text":"Read post", "prominent_button_name":"Read article", "text_input_field_labels":["Learn more", "Read post"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.google.com/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["Google Search", "I'm Feeling Lucky"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?ts=66fc2cc6 Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["Google Search", "I'm Feeling Lucky"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://sustainability.google/?utm_source=googlehpfooter&utm_medium=housepromos&utm_campaign=bottom-footer&utm_content= Model: jbxai	{ "brand":["Google"], "contains_trigger_text":true, "trigger_text":"How to be more sustainable while commuting", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://blog.google/products/search/generative-ai-google-search-may-2024/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Subscribe", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 17:27:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9705065907630677
Encrypted:	false
SSDEEP:	48:8O2dMOTsKnROHFidAKZdA19ehwiZUklqehqy+3:8O9OI+RA9y
MD5:	E1BB7D07C35067E543EB15D5C0045664
SHA1:	88DFAB167866BCB1EF2F75633A48133941BEACD3
SHA-256:	F6C4C372C0172FB272EB3DED5F81DD099DFB83AD2C33FABF66E2758D730F5A46
SHA-512:	29724151681387BE67B8EA86DD14BA505B5F67E30E9401F5DE6548FF9828A5EC9B785F5BC0A936D0062C666C463535D574841D347FEF402DE985947B31628BE1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....m../...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IAYi.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAYj............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 20:27:19.644231081 CEST	192.168.2.5	1.1.1.1	0x61d9	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:19.644413948 CEST	192.168.2.5	1.1.1.1	0xdec3	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:22.485244036 CEST	192.168.2.5	1.1.1.1	0x7c18	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:22.487529039 CEST	192.168.2.5	1.1.1.1	0xc7df	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:22.505928040 CEST	192.168.2.5	1.1.1.1	0x7718	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:22.506493092 CEST	192.168.2.5	1.1.1.1	0x64a9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:25.615418911 CEST	192.168.2.5	1.1.1.1	0x5757	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:25.615976095 CEST	192.168.2.5	1.1.1.1	0x6a35	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:26.720571995 CEST	192.168.2.5	1.1.1.1	0x8f32	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:26.720866919 CEST	192.168.2.5	1.1.1.1	0x6b8d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:26.942018986 CEST	192.168.2.5	1.1.1.1	0x49c3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:26.942245007 CEST	192.168.2.5	1.1.1.1	0xca09	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:27.934400082 CEST	192.168.2.5	1.1.1.1	0xd72d	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:27.934556961 CEST	192.168.2.5	1.1.1.1	0xf7c4	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:28.058528900 CEST	192.168.2.5	1.1.1.1	0xadef	Standard query (0)	blobcomments-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:28.059129000 CEST	192.168.2.5	1.1.1.1	0x75c2	Standard query (0)	blobcomments-pa.clients6.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:29.010551929 CEST	192.168.2.5	1.1.1.1	0x36c2	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:29.010786057 CEST	192.168.2.5	1.1.1.1	0x44d2	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:29.692054987 CEST	192.168.2.5	1.1.1.1	0x4668	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:29.692306995 CEST	192.168.2.5	1.1.1.1	0x34a5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:30.315694094 CEST	192.168.2.5	1.1.1.1	0xa145	Standard query (0)	blobcomments-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:30.316188097 CEST	192.168.2.5	1.1.1.1	0x8474	Standard query (0)	blobcomments-pa.clients6.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:32.240763903 CEST	192.168.2.5	1.1.1.1	0x1958	Standard query (0)	peoplestackwebexperiments-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:32.240923882 CEST	192.168.2.5	1.1.1.1	0xdf6b	Standard query (0)	peoplestackwebexperiments-pa.clients6.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:33.256104946 CEST	192.168.2.5	1.1.1.1	0xe707	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:33.256194115 CEST	192.168.2.5	1.1.1.1	0x65fe	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:34.229690075 CEST	192.168.2.5	1.1.1.1	0x882c	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:34.230042934 CEST	192.168.2.5	1.1.1.1	0xfb66	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 1, 2024 20:27:50.737709999 CEST	192.168.2.5	1.1.1.1	0xc8e	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:50.737709999 CEST	192.168.2.5	1.1.1.1	0xb2ba	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:28:06.145919085 CEST	192.168.2.5	1.1.1.1	0x1f61	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:06.145920038 CEST	192.168.2.5	1.1.1.1	0x1fa0	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Oct 1, 2024 20:28:10.430119991 CEST	192.168.2.5	1.1.1.1	0x34f7	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:10.430253029 CEST	192.168.2.5	1.1.1.1	0x8152	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Oct 1, 2024 20:28:13.627660990 CEST	192.168.2.5	1.1.1.1	0x971b	Standard query (0)	www.blog.google	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:13.628101110 CEST	192.168.2.5	1.1.1.1	0x8a8b	Standard query (0)	www.blog.google	65	IN (0x0001)	false
Oct 1, 2024 20:28:14.854522943 CEST	192.168.2.5	1.1.1.1	0xf66	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:14.862694025 CEST	192.168.2.5	1.1.1.1	0x3493	Standard query (0)	blog.google	65	IN (0x0001)	false
Oct 1, 2024 20:28:17.109257936 CEST	192.168.2.5	1.1.1.1	0xbde1	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:17.109450102 CEST	192.168.2.5	1.1.1.1	0xfb02	Standard query (0)	blog.google	65	IN (0x0001)	false
Oct 1, 2024 20:28:22.140333891 CEST	192.168.2.5	1.1.1.1	0x190d	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 1, 2024 20:28:22.140333891 CEST	192.168.2.5	1.1.1.1	0x28c0	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:24.692298889 CEST	192.168.2.5	1.1.1.1	0xdc79	Standard query (0)	googletagmanager.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:24.692775965 CEST	192.168.2.5	1.1.1.1	0x2591	Standard query (0)	googletagmanager.com	65	IN (0x0001)	false
Oct 1, 2024 20:28:25.802386045 CEST	192.168.2.5	1.1.1.1	0x1b94	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:25.802566051 CEST	192.168.2.5	1.1.1.1	0x2671	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:28:27.281056881 CEST	192.168.2.5	1.1.1.1	0xcd86	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:27.281419039 CEST	192.168.2.5	1.1.1.1	0x964f	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 1, 2024 20:28:33.154593945 CEST	192.168.2.5	1.1.1.1	0x3c7	Standard query (0)	csp.withgoogle.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:33.154795885 CEST	192.168.2.5	1.1.1.1	0x35bc	Standard query (0)	csp.withgoogle.com	65	IN (0x0001)	false
Oct 1, 2024 20:28:35.119972944 CEST	192.168.2.5	1.1.1.1	0x5184	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:35.120528936 CEST	192.168.2.5	1.1.1.1	0x8792	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 1, 2024 20:28:39.845959902 CEST	192.168.2.5	1.1.1.1	0x858f	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:39.846148968 CEST	192.168.2.5	1.1.1.1	0xab3c	Standard query (0)	blog.google	65	IN (0x0001)	false
Oct 1, 2024 20:28:40.723592043 CEST	192.168.2.5	1.1.1.1	0xf772	Standard query (0)	cdn.ampproject.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:40.723747015 CEST	192.168.2.5	1.1.1.1	0x11e5	Standard query (0)	cdn.ampproject.org	65	IN (0x0001)	false
Oct 1, 2024 20:28:44.035756111 CEST	192.168.2.5	1.1.1.1	0xdec1	Standard query (0)	cdn.ampproject.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:44.036011934 CEST	192.168.2.5	1.1.1.1	0xb4af	Standard query (0)	cdn.ampproject.org	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 20:27:19.651704073 CEST	1.1.1.1	192.168.2.5	0x61d9	No error (0)	drive.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:22.500601053 CEST	1.1.1.1	192.168.2.5	0x7c18	No error (0)	drive.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:22.513344049 CEST	1.1.1.1	192.168.2.5	0x7718	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:22.513501883 CEST	1.1.1.1	192.168.2.5	0x64a9	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 20:27:25.623079062 CEST	1.1.1.1	192.168.2.5	0x5757	No error (0)	play.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:26.727770090 CEST	1.1.1.1	192.168.2.5	0x6b8d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:26.727782965 CEST	1.1.1.1	192.168.2.5	0x8f32	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:26.727782965 CEST	1.1.1.1	192.168.2.5	0x8f32	No error (0)	plus.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:26.949441910 CEST	1.1.1.1	192.168.2.5	0x49c3	No error (0)	play.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:27.941068888 CEST	1.1.1.1	192.168.2.5	0xd72d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:27.941068888 CEST	1.1.1.1	192.168.2.5	0xd72d	No error (0)	plus.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:27.942706108 CEST	1.1.1.1	192.168.2.5	0xf7c4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:28.074527025 CEST	1.1.1.1	192.168.2.5	0xadef	No error (0)	blobcomments-pa.clients6.google.com		142.250.186.138	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:29.018057108 CEST	1.1.1.1	192.168.2.5	0x44d2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:29.018354893 CEST	1.1.1.1	192.168.2.5	0x36c2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:29.018354893 CEST	1.1.1.1	192.168.2.5	0x36c2	No error (0)	plus.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:29.699052095 CEST	1.1.1.1	192.168.2.5	0x4668	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:29.699069023 CEST	1.1.1.1	192.168.2.5	0x34a5	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 1, 2024 20:27:30.322408915 CEST	1.1.1.1	192.168.2.5	0xa145	No error (0)	blobcomments-pa.clients6.google.com		142.250.185.202	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:31.531975985 CEST	1.1.1.1	192.168.2.5	0x9084	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:31.531975985 CEST	1.1.1.1	192.168.2.5	0x9084	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:32.029006004 CEST	1.1.1.1	192.168.2.5	0xd7f8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:32.029006004 CEST	1.1.1.1	192.168.2.5	0xd7f8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:32.248055935 CEST	1.1.1.1	192.168.2.5	0x1958	No error (0)	peoplestackwebexperiments-pa.clients6.google.com		216.58.212.138	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:33.263299942 CEST	1.1.1.1	192.168.2.5	0x65fe	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:33.264076948 CEST	1.1.1.1	192.168.2.5	0xe707	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:33.264076948 CEST	1.1.1.1	192.168.2.5	0xe707	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.193	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:34.236493111 CEST	1.1.1.1	192.168.2.5	0x882c	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:34.236493111 CEST	1.1.1.1	192.168.2.5	0x882c	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:34.236963034 CEST	1.1.1.1	192.168.2.5	0xfb66	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:45.851279974 CEST	1.1.1.1	192.168.2.5	0xf64d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:45.851279974 CEST	1.1.1.1	192.168.2.5	0xf64d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:50.745140076 CEST	1.1.1.1	192.168.2.5	0xc8e	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:27:50.745140076 CEST	1.1.1.1	192.168.2.5	0xc8e	No error (0)	www3.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:27:50.745155096 CEST	1.1.1.1	192.168.2.5	0xb2ba	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:06.237883091 CEST	1.1.1.1	192.168.2.5	0x1f61	No error (0)	sustainability.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:06.237883091 CEST	1.1.1.1	192.168.2.5	0x1f61	No error (0)	sustainability.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:06.237883091 CEST	1.1.1.1	192.168.2.5	0x1f61	No error (0)	sustainability.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:06.237883091 CEST	1.1.1.1	192.168.2.5	0x1f61	No error (0)	sustainability.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:10.501611948 CEST	1.1.1.1	192.168.2.5	0x34f7	No error (0)	sustainability.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:10.501611948 CEST	1.1.1.1	192.168.2.5	0x34f7	No error (0)	sustainability.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:10.501611948 CEST	1.1.1.1	192.168.2.5	0x34f7	No error (0)	sustainability.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:10.501611948 CEST	1.1.1.1	192.168.2.5	0x34f7	No error (0)	sustainability.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:10.781076908 CEST	1.1.1.1	192.168.2.5	0xb54f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:10.781076908 CEST	1.1.1.1	192.168.2.5	0xb54f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:13.636163950 CEST	1.1.1.1	192.168.2.5	0x971b	No error (0)	www.blog.google	ghs-svc-https-sni.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:13.636163950 CEST	1.1.1.1	192.168.2.5	0x971b	No error (0)	ghs-svc-https-sni.ghs-ssl.googlehosted.com		142.250.186.83	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:13.670001984 CEST	1.1.1.1	192.168.2.5	0x8a8b	No error (0)	www.blog.google	ghs-svc-https-sni.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:14.862298012 CEST	1.1.1.1	192.168.2.5	0xf66	No error (0)	blog.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:14.862298012 CEST	1.1.1.1	192.168.2.5	0xf66	No error (0)	blog.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:14.862298012 CEST	1.1.1.1	192.168.2.5	0xf66	No error (0)	blog.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:14.862298012 CEST	1.1.1.1	192.168.2.5	0xf66	No error (0)	blog.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:17.117010117 CEST	1.1.1.1	192.168.2.5	0xbde1	No error (0)	blog.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:17.117010117 CEST	1.1.1.1	192.168.2.5	0xbde1	No error (0)	blog.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:17.117010117 CEST	1.1.1.1	192.168.2.5	0xbde1	No error (0)	blog.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:17.117010117 CEST	1.1.1.1	192.168.2.5	0xbde1	No error (0)	blog.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:22.149732113 CEST	1.1.1.1	192.168.2.5	0x28c0	No error (0)	google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:24.699589014 CEST	1.1.1.1	192.168.2.5	0xdc79	No error (0)	googletagmanager.com		142.250.185.232	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:25.809021950 CEST	1.1.1.1	192.168.2.5	0x1b94	No error (0)	play.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:27.288691044 CEST	1.1.1.1	192.168.2.5	0xcd86	No error (0)	play.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:30.961488962 CEST	1.1.1.1	192.168.2.5	0x92f8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:30.961488962 CEST	1.1.1.1	192.168.2.5	0x92f8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:33.161741972 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	csp.withgoogle.com		142.250.186.177	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:35.128263950 CEST	1.1.1.1	192.168.2.5	0x5184	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:35.128263950 CEST	1.1.1.1	192.168.2.5	0x5184	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:35.131953955 CEST	1.1.1.1	192.168.2.5	0x8792	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:39.852930069 CEST	1.1.1.1	192.168.2.5	0x858f	No error (0)	blog.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:39.852930069 CEST	1.1.1.1	192.168.2.5	0x858f	No error (0)	blog.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:39.852930069 CEST	1.1.1.1	192.168.2.5	0x858f	No error (0)	blog.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:39.852930069 CEST	1.1.1.1	192.168.2.5	0x858f	No error (0)	blog.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:40.730757952 CEST	1.1.1.1	192.168.2.5	0x11e5	No error (0)	cdn.ampproject.org	cdn-content.ampproject.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:40.731098890 CEST	1.1.1.1	192.168.2.5	0xf772	No error (0)	cdn.ampproject.org	cdn-content.ampproject.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:40.731098890 CEST	1.1.1.1	192.168.2.5	0xf772	No error (0)	cdn-content.ampproject.org		172.217.18.97	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:28:44.042680025 CEST	1.1.1.1	192.168.2.5	0xb4af	No error (0)	cdn.ampproject.org	cdn-content.ampproject.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:44.042974949 CEST	1.1.1.1	192.168.2.5	0xdec1	No error (0)	cdn.ampproject.org	cdn-content.ampproject.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 20:28:44.042974949 CEST	1.1.1.1	192.168.2.5	0xdec1	No error (0)	cdn-content.ampproject.org		142.250.181.225	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:20 UTC	877	OUT	GET /file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:27:20 UTC	1322	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 18:27:20 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: script-src 'report-sample' 'nonce-W0iOT-GOqizl1FFJRXOWfA' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/viewer/ Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA; expires=Wed, 02-Apr-2025 18:27:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-01 18:27:20 UTC	68	IN	Data Raw: 34 32 62 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 57 30 69 4f 54 2d 47 4f 71 69 7a 6c 31 46 46 4a 52 58 4f 57 Data Ascii: 42b0<!DOCTYPE html><html><head><script nonce="W0iOT-GOqizl1FFJRXOW
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 66 41 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 3d 7b 7d 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 57 30 69 4f 54 2d 47 4f 71 69 7a 6c 31 46 46 4a 52 58 4f 57 66 41 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 5b 27 74 66 73 27 5d 3d 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 69 64 3d 22 74 65 78 6d 65 78 2d 74 68 75 6d 62 22 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 69 6d 61 67 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 72 69 76 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 72 69 76 65 2d 76 69 65 77 65 72 2f 41 4b Data Ascii: fA"> window['_DRIVE_VIEWER_ctiming']={}; </script><script nonce="W0iOT-GOqizl1FFJRXOWfA"> window['_DRIVE_VIEWER_ctiming']['tfs']=new Date().getTime(); </script><link id="texmex-thumb" rel="preload" as="image" href="https://drive.google.com/drive-viewer/AK
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6b 43 6e 71 45 75 39 32 46 72 31 4d 75 35 31 78 45 49 7a 49 46 4b 77 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 31 46 30 30 2d 31 46 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 Data Ascii: ont-face{font-family:'Roboto';font-style:italic;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)format('woff2');unicode-range:U+1F00-1FFF;}@font-face{font-family:'Roboto';font-style:italic;font-weight:400;src:url(
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 53 55 35 66 43 52 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 34 36 30 2d 30 35 32 46 2c 55 2b 31 43 38 30 2d 31 43 38 38 2c 55 2b 32 30 42 34 2c 55 2b 32 44 45 30 2d 32 44 46 46 2c 55 2b 41 36 34 30 2d 41 36 39 46 2c 55 2b 46 45 32 45 2d 46 45 32 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 Data Ascii: e:normal;font-weight:300;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)format('woff2');unicode-range:U+0460-052F,U+1C80-1C88,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F;}@font-face{font-family:'Roboto';font-style:normal;font-we
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 2c 55 2b 32 30 41 30 2d 32 30 41 42 2c 55 2b 32 30 41 44 2d 32 30 43 30 2c 55 2b 32 31 31 33 2c 55 2b 32 43 36 30 2d 32 43 37 46 2c 55 2b 41 37 32 30 2d 41 37 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 53 55 35 66 42 42 63 34 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 30 30 30 2d 30 30 46 46 2c 55 2b 30 31 33 31 2c 55 2b 30 31 35 32 2d 30 31 35 33 Data Ascii: ,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:300;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)format('woff2');unicode-range:U+0000-00FF,U+0131,U+0152-0153
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 32 2d 30 31 30 33 2c 55 2b 30 31 31 30 2d 30 31 31 31 2c 55 2b 30 31 32 38 2d 30 31 32 39 2c 55 2b 30 31 36 38 2d 30 31 36 39 2c 55 2b 30 31 41 30 2d 30 31 41 31 2c 55 2b 30 31 41 46 2d 30 31 42 30 2c 55 2b 30 33 30 30 2d 30 33 30 31 2c 55 2b 30 33 30 33 2d 30 33 30 34 2c 55 2b 30 33 30 38 2d 30 33 30 39 2c 55 2b 30 33 32 33 2c 55 2b 30 33 32 39 2c 55 2b 31 45 41 30 2d 31 45 46 39 2c 55 2b 32 30 41 42 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e Data Ascii: )format('woff2');unicode-range:U+0102-0103,U+0110-0111,U+0128-0129,U+0168-0169,U+01A0-01A1,U+01AF-01B0,U+0300-0301,U+0303-0304,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB;}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(//fonts.
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 31 46 30 30 2d 31 46 46 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 37 30 2d 30 33 37 37 2c 55 2b 30 33 37 41 2d 30 33 37 46 2c 55 2b 30 33 38 34 2d 30 33 38 41 2c 55 2b 30 33 38 43 2c 55 Data Ascii: mat('woff2');unicode-range:U+1F00-1FFF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:500;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)format('woff2');unicode-range:U+0370-0377,U+037A-037F,U+0384-038A,U+038C,U
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 30 35 32 46 2c 55 2b 31 43 38 30 2d 31 43 38 38 2c 55 2b 32 30 42 34 2c 55 2b 32 44 45 30 2d 32 44 46 46 2c 55 2b 41 36 34 30 2d 41 36 39 46 2c 55 2b 46 45 32 45 2d 46 45 32 46 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 57 55 6c 66 41 42 63 34 45 73 41 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 33 30 31 2c 55 2b 30 34 30 30 2d 30 34 35 46 2c 55 2b 30 34 Data Ascii: 052F,U+1C80-1C88,U+20B4,U+2DE0-2DFF,U+A640-A69F,U+FE2E-FE2F;}@font-face{font-family:'Roboto';font-style:normal;font-weight:700;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)format('woff2');unicode-range:U+0301,U+0400-045F,U+04
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 57 55 6c 66 42 42 63 34 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 30 30 30 2d 30 30 46 46 2c 55 2b 30 31 33 31 2c 55 2b 30 31 35 32 2d 30 31 35 33 2c 55 2b 30 32 42 42 2d 30 32 42 43 2c 55 2b 30 32 43 36 2c 55 2b 30 32 44 41 2c 55 2b 30 32 44 43 2c 55 2b 30 33 30 34 2c 55 2b 30 33 30 38 2c 55 2b 30 33 32 39 2c 55 2b 32 30 30 30 2d 32 30 36 46 2c 55 2b 32 30 37 34 2c 55 2b 32 30 41 43 2c 55 2b 32 31 32 32 2c 55 2b 32 31 39 31 2c 55 2b 32 31 39 33 2c 55 2b 32 32 31 32 2c 55 2b 32 32 31 35 2c 55 2b 46 45 46 46 2c 55 2b 46 46 46 44 3b 7d 3c 2f 73 74 79 6c Data Ascii: s.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)format('woff2');unicode-range:U+0000-00FF,U+0131,U+0152-0153,U+02BB-02BC,U+02C6,U+02DA,U+02DC,U+0304,U+0308,U+0329,U+2000-206F,U+2074,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD;}</styl
2024-10-01 18:27:20 UTC	1390	IN	Data Raw: 64 3d 22 5f 63 6c 22 20 6e 6f 6e 63 65 3d 22 78 59 4e 79 32 6e 42 2d 30 4c 33 45 70 55 4d 47 4e 77 58 4c 6e 67 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 47 6f 6f 67 6c 65 2b 4d 61 74 65 72 69 61 6c 2b 49 63 6f 6e 73 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6e 6f 6e 63 65 3d 22 78 59 4e 79 32 6e 42 2d 30 4c 33 45 70 55 4d 47 4e 77 58 4c 6e 67 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 57 30 69 4f 54 2d 47 4f 71 69 7a 6c 31 46 46 4a 52 58 4f 57 66 41 22 3e 20 77 69 6e 64 6f 77 5b 27 5f 44 52 49 56 45 5f 56 49 45 57 45 52 5f 63 74 69 6d 69 6e 67 27 5d 5b 27 63 6c Data Ascii: d="_cl" nonce="xYNy2nB-0L3EpUMGNwXLng"><link href="https://fonts.googleapis.com/css2?family=Google+Material+Icons:wght@400;500;700" rel="stylesheet" nonce="xYNy2nB-0L3EpUMGNwXLng"><script nonce="W0iOT-GOqizl1FFJRXOWfA"> window['_DRIVE_VIEWER_ctiming']['cl

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:21 UTC	1119	OUT	GET /drive-viewer/AKGpihb9NzPH3NN_h_LCpi-OPXsT759Egt6u05M_WSILRkJO2NMRfLURWv63uYhzVEkS2KiV0Jf0mtDgHRqaGZo5wYabVb2qTs85nyM=s1600-rw-v1 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA
2024-10-01 18:27:21 UTC	874	IN	HTTP/1.1 200 OK Content-Type: image/webp Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: sandbox X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length ETag: "v1" Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private, max-age=86400, no-transform Content-Disposition: inline;filename="Attention! Make 5 Steps to Renew Online-ID Access, Check Immediately.webp" Date: Tue, 01 Oct 2024 18:27:21 GMT Server: fife Content-Length: 7058 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 18:27:21 UTC	516	IN	Data Raw: 52 49 46 46 8a 1b 00 00 57 45 42 50 56 50 38 20 7e 1b 00 00 70 f9 00 9d 01 2a 00 04 40 02 3e b5 5a a8 4f a7 25 23 a3 21 33 b8 c8 e0 16 89 67 6e fc 67 f9 c8 e8 c6 b3 dd ea ec bf e2 f9 e8 f3 7f 84 91 d6 fe 2f 90 9f 21 e3 df d0 9e 7f 3f dd 7a ab fd 49 ec 1b cf 1f fb 0f fd 2f 50 1f b4 3e ab ff f4 bf 68 bd d8 7f 70 f5 00 fe 97 fe 83 d6 4f d5 5f f7 27 d8 5f cb c3 d9 c7 fb ef fd ff 4b 7d 55 7e ce f6 e1 fe 6f c3 5f 33 01 0f da 16 a7 1d b9 fa 1b d1 0f d9 4f 22 7e 54 ea 16 ed fb 46 ad 2d d6 a9 64 43 5f f3 a6 34 ce 27 e3 cb 74 36 48 b8 ff 4a df 1e 5b a1 b2 45 c7 fa 56 f8 f2 dd 0d 2e 75 36 07 ed bb 33 1c 48 77 49 6d be aa 7f 9b e5 c5 3c cb 48 9b 82 81 9d 0e d7 13 fe a1 a0 49 ad f1 ac c5 7a 1d b1 16 af 4d c0 1f 04 ba 05 bb 2d b2 22 d4 eb c2 67 64 45 a9 d7 84 ce c8 8b Data Ascii: RIFFWEBPVP8 ~p*@>ZO%#!3gng/!?zI/P>hpO_'_K}U~o_3O"~TF-dC_4't6HJ[EV.u63HwIm<HIzM-"gdE
2024-10-01 18:27:21 UTC	1390	IN	Data Raw: 03 5f 28 f5 bf a9 5a 61 36 1f 89 c7 4f 96 e9 6c e5 e0 d8 99 62 c1 ac 1d 81 a5 a4 4c 4a a1 47 a5 6f 8f 2d d0 d9 22 e3 fd 2b 7c 79 6e 86 c9 17 1f e9 5b df 8b 3a c5 a7 ea 48 98 a7 e9 fe 72 75 c5 28 06 dd e0 09 85 09 9b 3a 20 6d 62 99 9c 9b 10 00 00 a8 38 d5 62 21 4c 87 99 85 29 dc 4c 78 b8 63 ff 8c 91 71 fe 95 be 3c b7 43 64 8b 8f f4 ad f1 e5 ba 1b 24 5c 7f a5 6f 8f 13 48 34 f6 0d a4 53 22 e2 9f 10 4c 6b fa bc 96 8f 47 59 59 ab a5 ff 40 ff e8 86 0b c7 cb f0 41 71 6e 0f c9 11 e5 ba 1b 24 5c 7f a5 6f 8f 2d d0 d9 22 e3 fd 2b 7c 79 6e 86 c9 17 1f d7 7d 42 c2 93 9e bb ff e8 c4 40 80 18 a8 0f 56 3d 13 70 72 e9 69 b6 1c a8 85 61 4d 1d ee e4 72 55 12 79 56 91 cc 45 a7 7b aa 75 0d f7 89 42 81 6f e1 31 2a 85 1e 95 be 3c b7 43 64 8b 8f f4 ad f1 e5 ba 1b 24 5c 7f a5 6f Data Ascii: _(Za6OlbLJGo-"+\|yn[:Hru(: mb8b!L)Lxcq<Cd$\oH4S"LkGYY@Aqn$\o-"+\|yn}B@V=priaMrUyVE{uBo1*<Cd$\o
2024-10-01 18:27:21 UTC	1390	IN	Data Raw: fb 69 5f b6 19 48 31 af 4f 2a a1 c8 ba 36 f1 9c d4 05 ef 56 eb f3 5f c1 17 1f e9 5b e3 cb 74 36 48 b8 ff 4a df 1e 5b a1 b2 45 c7 fa 56 f8 f2 dd 08 57 1a 76 6e 12 ef f0 70 f1 9b 24 5c 7f a5 6f 8f 2d d0 d9 22 e3 fd 2b 7c 79 6e 86 c9 17 1f e9 5b e3 cb 74 36 48 b8 ff 4a df 1e 5b a1 b2 45 c7 fa 56 f8 f2 dd 0d 92 2e 3f d2 b7 c7 96 e8 6c 91 71 fe 95 be 36 80 00 fe ff 3e 55 7d c7 77 71 d9 8d ff fd 02 cf ff 01 67 ff 80 b3 ee 13 97 8c 67 09 74 57 00 fe 5e 75 38 20 00 6c 39 04 60 f2 8e 3d d7 33 8d 19 3d 36 7e 8a 52 a1 ce 33 a6 1c fa 30 4d d2 d2 3f 58 23 62 b6 1e 2b aa fa b2 1c 6d 14 8a fe c6 79 89 5d db 65 fb 23 0b d4 98 25 bb 40 ea d0 3f cf 0a 62 48 00 6a 3b 68 a1 0b d8 f8 6c e0 38 90 a1 50 32 ed f6 f7 02 d8 94 38 4f 2b b9 f4 7d 63 68 83 a0 ad 32 8f ac b2 68 2d a0 Data Ascii: i_H1O*6V_[t6HJ[EVWvnp$\o-"+\|yn[t6HJ[EV.?lq6>U}wqggtW^u8 l9`=3=6~R30M?X#b+my]e#%@?bHj;hl8P28O+}ch2h-
2024-10-01 18:27:21 UTC	1390	IN	Data Raw: 95 b6 00 00 00 00 00 fb 1e 61 5b 67 41 bd af 4c b4 b9 b1 f8 5f a2 58 72 bd b6 5d ea ca 98 61 4e ce eb 01 ec 47 23 04 39 53 ee 8a c0 15 26 12 3e d7 52 1b 54 26 93 70 d8 b5 50 24 26 a5 1b 92 f7 9f 68 78 e3 72 29 b4 46 4c 9a e2 15 5e a6 3c 46 5e 3d ab 91 79 f3 21 2e 3b e3 35 58 54 47 31 d0 a5 21 49 ee da 25 03 35 4b ac fe a5 b6 94 47 8d 7b 2f 5c da 74 b0 d4 c5 b2 4e 9c 25 74 68 68 7b c5 c9 d2 50 a2 95 53 25 7a 25 54 3f 59 0e d7 75 60 3c 04 fe 74 13 5f 3e 38 19 ce d4 af 29 90 17 09 1f df 79 ef d8 62 40 26 39 16 64 c8 03 b6 30 6a 8f 29 e3 4c 89 db dd 7f c4 30 12 d7 73 c3 fa c7 12 f5 38 86 8b ff 68 80 00 05 10 24 d5 fb 16 f9 40 e1 28 3d ab a0 d8 73 24 5e 95 e9 6b b8 be 3a d0 56 d3 42 bf e4 a0 e3 a6 d2 f9 c9 44 8b bf 71 06 75 e3 ee df 99 bb 0b 1c 96 e2 40 38 7e Data Ascii: a[gAL_Xr]aNG#9S&>RT&pP$&hxr)FL^<F^=y!.;5XTG1!I%5KG{/\tN%thh{PS%z%T?Yu`<t_>8)yb@&9d0j)L0s8h$@(=s$^k:VBDqu@8~
2024-10-01 18:27:21 UTC	1390	IN	Data Raw: 05 b5 bd 01 84 a5 ac 27 f2 e9 6e f1 d6 e9 42 5e cc 02 bc 91 20 c1 f0 0b e9 54 03 db 25 3c d0 f9 19 8c 49 d4 f8 b5 ff 0a 0a 93 65 ad 47 7c 59 51 66 62 a4 ea 9a 5b fc ff ad 94 66 1e 2e 07 d2 59 b5 2c 46 2b 3a 69 05 fe 0f 5f 27 29 ea 4e 43 bf fa f2 e8 07 8a 3e 3a 1e fc 2f f5 0a ff 30 1e 18 0b 29 2b 91 31 f3 36 e0 f2 5c c3 d5 9b 92 a9 51 e2 81 72 7f de 16 71 00 ee 09 29 b2 60 73 f0 ac 8e 83 ef fa 13 2d 7e 3e ac b4 23 92 38 7d 43 bc 2b 83 7e 75 8d ab 96 b9 1b e7 51 cb 42 ea 38 91 3e 3b 16 b2 36 b7 04 a6 20 7f a5 11 4a 09 83 c0 35 d9 fe f6 9d c5 16 cc 49 73 a4 90 8f 3f 9c 22 36 1d c1 ab b2 8a 70 1b 16 fc 6d ae c3 23 9f 57 74 90 ea 2d dc d8 43 6d a3 23 c0 23 c7 21 dd d1 89 bf 47 d7 a5 14 39 b4 0a 65 c2 ec dd ad e4 32 9d d7 6f 74 c5 ba c0 ee ac a8 9e 79 43 c5 a0 Data Ascii: 'nB^ T%<IeG\|YQfb[f.Y,F+:i_')NC>:/0)+16\Qrq)`s-~>#8}C+~uQB8>;6 J5Is?"6pm#Wt-Cm##!G9e2otyC
2024-10-01 18:27:21 UTC	982	IN	Data Raw: 0b 17 ef 64 9b 30 00 53 fa b5 da 27 e1 ab c0 3d 47 a9 6b d5 f6 07 95 00 00 00 0e 98 e2 12 70 34 f1 12 f8 10 8b fa 95 0a 4b ce 01 8f ec 8f 17 fd 82 01 67 d7 e7 5a c5 a5 2d 74 9f 31 2b a4 d6 14 f9 b1 fa 58 7a aa 71 71 71 71 71 71 28 fe 8c 13 67 68 b8 64 65 d8 28 f2 7b 55 34 d7 28 09 a5 60 28 83 c0 00 00 48 bd ae 94 3d aa 16 3e 9e 77 25 7b 03 56 2b 34 a0 aa 51 35 44 7e e4 38 06 96 28 c6 b2 87 d1 fa db 74 9e cf 7f 5f ad 8e 38 44 50 09 5e e6 70 55 48 ca a3 71 f8 ef 90 72 94 1b 46 82 e7 a3 d5 72 50 53 b6 3a 07 c5 71 49 d3 10 75 f9 8e d7 d6 ce 1d bb 52 08 f4 ee a0 fd 33 fd 7e 8d e9 e8 a4 c2 ad a0 fc 8d 84 22 aa 3e fa 8b b2 00 b7 52 9b b0 e5 b5 e1 1b 70 ea b2 5c ac fd dd 24 46 d7 09 af 60 5c 7d 90 88 f0 c2 eb b4 86 74 5d e2 3a 40 d9 ec ae f6 fc 00 99 ce da eb 69 Data Ascii: d0S'=Gkp4KgZ-t1+Xzqqqqqq(ghde({U4(`(H=>w%{V+4Q5D~8(t_8DP^pUHqrFrPS:qIuR3~">Rp\$F`\}t]:@i

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 222

Chrome Cache Entry: 223

Chrome Cache Entry: 224

Chrome Cache Entry: 225

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Windows Analysis Report
https://drive.google.com/file/d/1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH/view?usp=sharing_eil&ts=66fc2cc6

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:23 UTC	761	OUT	GET /drive-viewer/AKGpihb9NzPH3NN_h_LCpi-OPXsT759Egt6u05M_WSILRkJO2NMRfLURWv63uYhzVEkS2KiV0Jf0mtDgHRqaGZo5wYabVb2qTs85nyM=s1600-rw-v1 HTTP/1.1 Host: drive.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA
2024-10-01 18:27:23 UTC	874	IN	HTTP/1.1 200 OK Content-Type: image/webp Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: sandbox X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff Vary: Origin Access-Control-Allow-Origin: * Timing-Allow-Origin: * Access-Control-Expose-Headers: Content-Length ETag: "v1" Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private, max-age=86400, no-transform Content-Disposition: inline;filename="Attention! Make 5 Steps to Renew Online-ID Access, Check Immediately.webp" Date: Tue, 01 Oct 2024 18:27:23 GMT Server: fife Content-Length: 7058 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 18:27:23 UTC	516	IN	Data Raw: 52 49 46 46 8a 1b 00 00 57 45 42 50 56 50 38 20 7e 1b 00 00 70 f9 00 9d 01 2a 00 04 40 02 3e b5 5a a8 4f a7 25 23 a3 21 33 b8 c8 e0 16 89 67 6e fc 67 f9 c8 e8 c6 b3 dd ea ec bf e2 f9 e8 f3 7f 84 91 d6 fe 2f 90 9f 21 e3 df d0 9e 7f 3f dd 7a ab fd 49 ec 1b cf 1f fb 0f fd 2f 50 1f b4 3e ab ff f4 bf 68 bd d8 7f 70 f5 00 fe 97 fe 83 d6 4f d5 5f f7 27 d8 5f cb c3 d9 c7 fb ef fd ff 4b 7d 55 7e ce f6 e1 fe 6f c3 5f 33 01 0f da 16 a7 1d b9 fa 1b d1 0f d9 4f 22 7e 54 ea 16 ed fb 46 ad 2d d6 a9 64 43 5f f3 a6 34 ce 27 e3 cb 74 36 48 b8 ff 4a df 1e 5b a1 b2 45 c7 fa 56 f8 f2 dd 0d 2e 75 36 07 ed bb 33 1c 48 77 49 6d be aa 7f 9b e5 c5 3c cb 48 9b 82 81 9d 0e d7 13 fe a1 a0 49 ad f1 ac c5 7a 1d b1 16 af 4d c0 1f 04 ba 05 bb 2d b2 22 d4 eb c2 67 64 45 a9 d7 84 ce c8 8b Data Ascii: RIFFWEBPVP8 ~p*@>ZO%#!3gng/!?zI/P>hpO_'_K}U~o_3O"~TF-dC_4't6HJ[EV.u63HwIm<HIzM-"gdE
2024-10-01 18:27:23 UTC	1390	IN	Data Raw: 03 5f 28 f5 bf a9 5a 61 36 1f 89 c7 4f 96 e9 6c e5 e0 d8 99 62 c1 ac 1d 81 a5 a4 4c 4a a1 47 a5 6f 8f 2d d0 d9 22 e3 fd 2b 7c 79 6e 86 c9 17 1f e9 5b df 8b 3a c5 a7 ea 48 98 a7 e9 fe 72 75 c5 28 06 dd e0 09 85 09 9b 3a 20 6d 62 99 9c 9b 10 00 00 a8 38 d5 62 21 4c 87 99 85 29 dc 4c 78 b8 63 ff 8c 91 71 fe 95 be 3c b7 43 64 8b 8f f4 ad f1 e5 ba 1b 24 5c 7f a5 6f 8f 13 48 34 f6 0d a4 53 22 e2 9f 10 4c 6b fa bc 96 8f 47 59 59 ab a5 ff 40 ff e8 86 0b c7 cb f0 41 71 6e 0f c9 11 e5 ba 1b 24 5c 7f a5 6f 8f 2d d0 d9 22 e3 fd 2b 7c 79 6e 86 c9 17 1f d7 7d 42 c2 93 9e bb ff e8 c4 40 80 18 a8 0f 56 3d 13 70 72 e9 69 b6 1c a8 85 61 4d 1d ee e4 72 55 12 79 56 91 cc 45 a7 7b aa 75 0d f7 89 42 81 6f e1 31 2a 85 1e 95 be 3c b7 43 64 8b 8f f4 ad f1 e5 ba 1b 24 5c 7f a5 6f Data Ascii: _(Za6OlbLJGo-"+\|yn[:Hru(: mb8b!L)Lxcq<Cd$\oH4S"LkGYY@Aqn$\o-"+\|yn}B@V=priaMrUyVE{uBo1*<Cd$\o
2024-10-01 18:27:23 UTC	1390	IN	Data Raw: fb 69 5f b6 19 48 31 af 4f 2a a1 c8 ba 36 f1 9c d4 05 ef 56 eb f3 5f c1 17 1f e9 5b e3 cb 74 36 48 b8 ff 4a df 1e 5b a1 b2 45 c7 fa 56 f8 f2 dd 08 57 1a 76 6e 12 ef f0 70 f1 9b 24 5c 7f a5 6f 8f 2d d0 d9 22 e3 fd 2b 7c 79 6e 86 c9 17 1f e9 5b e3 cb 74 36 48 b8 ff 4a df 1e 5b a1 b2 45 c7 fa 56 f8 f2 dd 0d 92 2e 3f d2 b7 c7 96 e8 6c 91 71 fe 95 be 36 80 00 fe ff 3e 55 7d c7 77 71 d9 8d ff fd 02 cf ff 01 67 ff 80 b3 ee 13 97 8c 67 09 74 57 00 fe 5e 75 38 20 00 6c 39 04 60 f2 8e 3d d7 33 8d 19 3d 36 7e 8a 52 a1 ce 33 a6 1c fa 30 4d d2 d2 3f 58 23 62 b6 1e 2b aa fa b2 1c 6d 14 8a fe c6 79 89 5d db 65 fb 23 0b d4 98 25 bb 40 ea d0 3f cf 0a 62 48 00 6a 3b 68 a1 0b d8 f8 6c e0 38 90 a1 50 32 ed f6 f7 02 d8 94 38 4f 2b b9 f4 7d 63 68 83 a0 ad 32 8f ac b2 68 2d a0 Data Ascii: i_H1O*6V_[t6HJ[EVWvnp$\o-"+\|yn[t6HJ[EV.?lq6>U}wqggtW^u8 l9`=3=6~R30M?X#b+my]e#%@?bHj;hl8P28O+}ch2h-
2024-10-01 18:27:23 UTC	1390	IN	Data Raw: 95 b6 00 00 00 00 00 fb 1e 61 5b 67 41 bd af 4c b4 b9 b1 f8 5f a2 58 72 bd b6 5d ea ca 98 61 4e ce eb 01 ec 47 23 04 39 53 ee 8a c0 15 26 12 3e d7 52 1b 54 26 93 70 d8 b5 50 24 26 a5 1b 92 f7 9f 68 78 e3 72 29 b4 46 4c 9a e2 15 5e a6 3c 46 5e 3d ab 91 79 f3 21 2e 3b e3 35 58 54 47 31 d0 a5 21 49 ee da 25 03 35 4b ac fe a5 b6 94 47 8d 7b 2f 5c da 74 b0 d4 c5 b2 4e 9c 25 74 68 68 7b c5 c9 d2 50 a2 95 53 25 7a 25 54 3f 59 0e d7 75 60 3c 04 fe 74 13 5f 3e 38 19 ce d4 af 29 90 17 09 1f df 79 ef d8 62 40 26 39 16 64 c8 03 b6 30 6a 8f 29 e3 4c 89 db dd 7f c4 30 12 d7 73 c3 fa c7 12 f5 38 86 8b ff 68 80 00 05 10 24 d5 fb 16 f9 40 e1 28 3d ab a0 d8 73 24 5e 95 e9 6b b8 be 3a d0 56 d3 42 bf e4 a0 e3 a6 d2 f9 c9 44 8b bf 71 06 75 e3 ee df 99 bb 0b 1c 96 e2 40 38 7e Data Ascii: a[gAL_Xr]aNG#9S&>RT&pP$&hxr)FL^<F^=y!.;5XTG1!I%5KG{/\tN%thh{PS%z%T?Yu`<t_>8)yb@&9d0j)L0s8h$@(=s$^k:VBDqu@8~
2024-10-01 18:27:23 UTC	1390	IN	Data Raw: 05 b5 bd 01 84 a5 ac 27 f2 e9 6e f1 d6 e9 42 5e cc 02 bc 91 20 c1 f0 0b e9 54 03 db 25 3c d0 f9 19 8c 49 d4 f8 b5 ff 0a 0a 93 65 ad 47 7c 59 51 66 62 a4 ea 9a 5b fc ff ad 94 66 1e 2e 07 d2 59 b5 2c 46 2b 3a 69 05 fe 0f 5f 27 29 ea 4e 43 bf fa f2 e8 07 8a 3e 3a 1e fc 2f f5 0a ff 30 1e 18 0b 29 2b 91 31 f3 36 e0 f2 5c c3 d5 9b 92 a9 51 e2 81 72 7f de 16 71 00 ee 09 29 b2 60 73 f0 ac 8e 83 ef fa 13 2d 7e 3e ac b4 23 92 38 7d 43 bc 2b 83 7e 75 8d ab 96 b9 1b e7 51 cb 42 ea 38 91 3e 3b 16 b2 36 b7 04 a6 20 7f a5 11 4a 09 83 c0 35 d9 fe f6 9d c5 16 cc 49 73 a4 90 8f 3f 9c 22 36 1d c1 ab b2 8a 70 1b 16 fc 6d ae c3 23 9f 57 74 90 ea 2d dc d8 43 6d a3 23 c0 23 c7 21 dd d1 89 bf 47 d7 a5 14 39 b4 0a 65 c2 ec dd ad e4 32 9d d7 6f 74 c5 ba c0 ee ac a8 9e 79 43 c5 a0 Data Ascii: 'nB^ T%<IeG\|YQfb[f.Y,F+:i_')NC>:/0)+16\Qrq)`s-~>#8}C+~uQB8>;6 J5Is?"6pm#Wt-Cm##!G9e2otyC
2024-10-01 18:27:23 UTC	982	IN	Data Raw: 0b 17 ef 64 9b 30 00 53 fa b5 da 27 e1 ab c0 3d 47 a9 6b d5 f6 07 95 00 00 00 0e 98 e2 12 70 34 f1 12 f8 10 8b fa 95 0a 4b ce 01 8f ec 8f 17 fd 82 01 67 d7 e7 5a c5 a5 2d 74 9f 31 2b a4 d6 14 f9 b1 fa 58 7a aa 71 71 71 71 71 71 28 fe 8c 13 67 68 b8 64 65 d8 28 f2 7b 55 34 d7 28 09 a5 60 28 83 c0 00 00 48 bd ae 94 3d aa 16 3e 9e 77 25 7b 03 56 2b 34 a0 aa 51 35 44 7e e4 38 06 96 28 c6 b2 87 d1 fa db 74 9e cf 7f 5f ad 8e 38 44 50 09 5e e6 70 55 48 ca a3 71 f8 ef 90 72 94 1b 46 82 e7 a3 d5 72 50 53 b6 3a 07 c5 71 49 d3 10 75 f9 8e d7 d6 ce 1d bb 52 08 f4 ee a0 fd 33 fd 7e 8d e9 e8 a4 c2 ad a0 fc 8d 84 22 aa 3e fa 8b b2 00 b7 52 9b b0 e5 b5 e1 1b 70 ea b2 5c ac fd dd 24 46 d7 09 af 60 5c 7d 90 88 f0 c2 eb b4 86 74 5d e2 3a 40 d9 ec ae f6 fc 00 99 ce da eb 69 Data Ascii: d0S'=Gkp4KgZ-t1+Xzqqqqqq(ghde({U4(`(H=>w%{V+4Q5D~8(t_8DP^pUHqrFrPS:qIuR3~">Rp\$F`\}t]:@i

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 18:27:24 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=166706 Date: Tue, 01 Oct 2024 18:27:24 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 18:27:25 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=166649 Date: Tue, 01 Oct 2024 18:27:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-01 18:27:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:26 UTC	1032	OUT	GET /auth_warmup HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA
2024-10-01 18:27:26 UTC	1739	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 18:27:26 GMT Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-DWOYt-iY_RuV-A1FcInErg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveOsidBootstrap/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveOsidBootstrap/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveOsidBootstrap/cspreport Cross-Origin-Resource-Policy: same-site Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/_/DriveOsidBootstrap/web-reports?context=eJzjEtDikmLw0pBicEqfwRoCxEI8HH3_PmxnE7hx4fh0JiXVpPzC-JSizLLUjJKSgsSCzOLUorLUongjAyMTA0tDSz0Do_gCAwAZqxcm" Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:26 UTC	1153	OUT	GET /drivesharing/clientmodel?id=1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH&foreignService=texmex&authuser=0&origin=https%3A%2F%2Fdrive.google.com HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA
2024-10-01 18:27:26 UTC	3344	IN	HTTP/1.1 302 Found Content-Type: application/binary X-Frame-Options: ALLOW-FROM https://drive.google.com Content-Security-Policy: frame-ancestors https://drive.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-Ph48RMZ99Qm5G0WyHqIs6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /drivesharing/_/DriveShareDialogUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /drivesharing/_/DriveShareDialogUi/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /drivesharing/_/DriveShareDialogUi/cspreport Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Location: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://drive.google.com/drivesharing/clientmodel?id%3D1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps://drive.google.com&followup=https://drive.google.com/drivesharing/clientmodel?id%3D1KAx-EUZS2_FiLyeH_4eh23ZY3zFt-bCH%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps://drive.google.com Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-drive/_/js/k=boq-drive.DriveShareDialogUi [TRUNCATED] Cross-Origin-Resource-Policy: same-site Date: Tue, 01 Oct 2024 18:27:26 GMT Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:26 UTC	976	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 3539 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA
2024-10-01 18:27:26 UTC	3539	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 32 37 38 30 37 32 34 34 36 33 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 31 37 32 37 38 30 37 32 34 34 36 33 33 30 30 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 31 37 32 37 38 30 37 32 34 34 36 33 33 30 30 30 5d 2c 6e 75 6c 6c 2c 31 5d 2c 6e 75 6c 6c 2c 37 31 36 2c 6e 75 6c 6c 2c 31 2c 31 5d Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,null,[4,0,0,0,0]]],189,[["1727807244633",null,null,null,null,null,null,"[[[null,null,1,1727807244633000,null,null,null,[[1727807244633000],null,1],null,716,null,1,1]
2024-10-01 18:27:26 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=US9AyQZV6OeHDc7jcf2Wvy68OW3I3aotdd8v6zMjybcHqJwUEXelHjVRViiYRLwzVswvvI0fCrGcoKrw2lWXSy_R_5hN8ebJtNLYMutJoxAipiz2fOEWFxboQVwqAwnx2Zbx5DeGsOhApUGOjjD69bS4tFhcvWGcjYcuR8ZhnUlSihTi9P2Ew2rEIw; expires=Wed, 02-Apr-2025 18:27:26 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 01 Oct 2024 18:27:26 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 01 Oct 2024 18:27:26 GMT Connection: close Transfer-Encoding: chunked
2024-10-01 18:27:26 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-01 18:27:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:27 UTC	1020	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=5wp66tLJ-Av5NcDP3EVQx7JqAZJtS73Il79YhMLOGYRYl71351sAMlHd9uSdzmhB6X3udGy0NMFXTk34oc_SbAuzUyQwWJwDsNrpIh1sJhsEsgwMJIGdCBoIS3PAbiGgoGoUjtAHa050jVvVoyirygZaVR2wVQi09JIsheotT3Zo5uPRHA
2024-10-01 18:27:27 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 126135 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 01 Oct 2024 08:06:24 GMT Expires: Wed, 01 Oct 2025 08:06:24 GMT Cache-Control: public, max-age=31536000 Last-Modified: Fri, 06 Sep 2024 22:07:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 37263 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 18:27:27 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 66 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 75 61 2c 77 61 3b 62 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var ba,fa,ha,na,oa,sa,ua,wa;ba=fun
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 62 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 75 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:ba(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ua=typeof Object.assign=="function"?Object.
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 51 72 3d 5b 5d 3b 74 68 69 73 2e 6a 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 58 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 56 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 58 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Qr=[];this.jV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Xda),reject:h(this.VJ)}};e.prototype.Xda=functi
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 51 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 51 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 5a 4f 28 74 68 69 73 2e 51 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 51 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 44 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 6c 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 45 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.G7=function(){if(this.Qr!=null){for(var h=0;h<this.Qr.length;++h)f.ZO(this.Qr[h]);this.Qr=null}};var f=new b;e.prototype.Dfa=function(h){var k=this.jF();h.ly(k.resolve,k.reject)};e.prototype.Efa=function(h,k){var l=this.jF();try{h.call(k,l.resolve
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 73 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 20 30 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 Data Ascii: his.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&sa(l,f)?l[f][this.Ga]:void 0};k.prototype.has=function(l){return c(l)&&
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 74 2c 6b 2e 65 66 2e 6e 65 78 74 2e 55 6b 3d 0a 6b 2e 65 66 2e 55 6b 2c 6b 2e 65 66 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 55 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 65 66 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 28 6b 3d 64 28 74 68 69 73 2c 6b 29 2e 65 66 29 26 26 6b 2e 76 61 6c 75 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 Data Ascii: t,k.ef.next.Uk=k.ef.Uk,k.ef.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Uk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).ef};c.prototype.get=function(k){return(k=d(this,k).ef)&&k.value};c.prototy
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 Data Ascii: ize!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 Data Ascii: 4111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});na("Array.prototype.entries",function(a){return

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:27 UTC	1039	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_1 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=US9AyQZV6OeHDc7jcf2Wvy68OW3I3aotdd8v6zMjybcHqJwUEXelHjVRViiYRLwzVswvvI0fCrGcoKrw2lWXSy_R_5hN8ebJtNLYMutJoxAipiz2fOEWFxboQVwqAwnx2Zbx5DeGsOhApUGOjjD69bS4tFhcvWGcjYcuR8ZhnUlSihTi9P2Ew2rEIw
2024-10-01 18:27:27 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 208050 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 01 Oct 2024 08:42:11 GMT Expires: Wed, 01 Oct 2025 08:42:11 GMT Cache-Control: public, max-age=31536000 Last-Modified: Fri, 06 Sep 2024 22:07:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 35116 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 18:27:27 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 31 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 7a 68 3d 28 77 69 6e 64 6f 77 2e 67 61 70 69 7c 7c 7b 7d 29 2e 6c 6f 61 64 3b 0a 5f 2e 4c 6f 3d 5f 2e 6b 66 28 5f 2e 76 66 2c 22 72 77 22 2c 5f 2e 6c 66 28 29 29 3b 0a 76 61 72 20 4d 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 28 61 3d 5f 2e 4c 6f 5b 61 5d 29 26 26 61 2e 73 74 61 74 65 3c 62 26 26 28 61 2e 73 74 61 74 65 3d 62 29 7d 3b 76 61 72 20 4e 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 28 61 3d 5f 2e 4c 6f 5b 61 5d 29 3f 61 2e 6f 69 64 3a 76 6f 69 64 20 30 3b 69 66 28 61 29 7b 76 61 72 20 62 3d 5f 2e 67 66 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 3b 62 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 Data Ascii: gapi.loaded_1(function(_){var window=this;_.zh=(window.gapi\|\|{}).load;_.Lo=_.kf(_.vf,"rw",_.lf());var Mo=function(a,b){(a=_.Lo[a])&&a.state<b&&(a.state=b)};var No=function(a){a=(a=_.Lo[a])?a.oid:void 0;if(a){var b=_.gf.getElementById(a);b&&b.parentNode
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 22 70 78 22 3a 61 2e 73 74 79 6c 65 2e 77 69 64 74 68 7c 7c 22 33 30 30 70 78 22 29 2b 22 3b 6d 61 72 67 69 6e 3a 30 70 78 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 22 7d 3b 0a 5f 2e 51 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 2c 64 3d 61 2e 79 63 28 29 2c 65 3d 62 26 26 62 2e 77 69 64 74 68 2c 66 3d 62 26 26 62 2e 68 65 69 67 68 74 2c 68 3d 62 26 26 62 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3b 68 26 26 28 63 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3d 68 29 3b 65 7c 7c 28 65 3d 64 2e 77 69 64 74 68 7c 7c 61 2e 77 69 64 74 68 29 3b 66 7c 7c 28 66 3d 64 2e 68 65 69 67 68 74 7c 7c 61 2e 68 65 69 67 68 74 29 3b 64 2e 77 69 64 74 68 3d 63 2e 77 69 64 74 68 3d 65 3b 64 2e 68 65 69 67 68 74 3d 63 2e 68 65 69 67 Data Ascii: "px":a.style.width\|\|"300px")+";margin:0px;border-style:none;"};_.Qo=function(a,b){var c={},d=a.yc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e\|\|(e=d.width\|\|a.width);f\|\|(f=d.height\|\|a.height);d.width=c.width=e;d.height=c.heig
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3d 65 2e 67 65 74 49 66 72 61 6d 65 45 6c 28 29 3b 65 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 5f 2e 50 6f 28 65 29 7d 7d 3b 0a 5f 2e 4e 6a 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 61 3d 28 61 7c 7c 62 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2e 6d 61 74 63 68 28 52 65 67 45 78 70 28 22 2e 2a 28 5c 5c 3f 7c 23 7c 26 29 75 73 65 67 61 70 69 3d 28 5b 5e 26 23 5d 2b 29 22 29 29 7c 7c 5b 5d 3b 72 65 74 75 72 6e 22 31 22 3d 3d 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 7c 7c 22 22 29 7d 3b 0a 5f 2e 54 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 54 2e 77 68 65 72 65 3d 62 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e Data Ascii: =function(e){e=e.getIframeEl();e.style.cssText=_.Po(e)}};_.Nj=function(a){var b=window;a=(a\|\|b.location.href).match(RegExp(".*(\\?\|#\|&)usegapi=([^&#]+)"))\|\|[];return"1"===decodeURIComponent(a[a.length-1]\|\|"")};_.To=function(a,b){a.T.where=b;return a};_.
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 61 5b 62 5d 2e 63 6f 6e 74 65 6e 74 3b 5f 2e 65 70 5b 63 5d 26 26 64 26 26 28 5f 2e 56 6f 5b 63 5d 3d 64 29 7d 7d 69 66 28 77 69 6e 64 6f 77 2e 73 65 6c 66 21 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 61 3d 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 28 29 3b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 5f 2e 65 70 29 5f 2e 65 70 5b 65 5d 3e 30 26 26 28 62 3d 5f 2e 70 66 28 61 2c 65 2c 22 22 29 29 26 26 28 5f 2e 56 6f 5b 65 5d 3d 62 29 7d 5f 2e 66 70 3d 21 30 7d 65 3d 5f 2e 6c 66 28 29 3b 5f 2e 6e 66 28 5f 2e 56 6f 2c 65 29 3b 72 65 74 75 72 6e 20 65 7d 3b 68 70 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 61 2e 6d 61 74 63 68 28 2f 5e 68 74 74 70 73 3f 25 33 41 2f 69 29 26 26 28 62 3d 64 65 63 6f 64 65 55 52 49 43 Data Ascii: a[b].content;_.ep[c]&&d&&(_.Vo[c]=d)}}if(window.self!==window.top){a=document.location.toString();for(var e in _.ep)_.ep[e]>0&&(b=_.pf(a,e,""))&&(_.Vo[e]=b)}_.fp=!0}e=_.lf();_.nf(_.Vo,e);return e};hp=function(a){var b;a.match(/^https?%3A/i)&&(b=decodeURIC
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 2c 64 3d 61 2e 61 74 74 72 69 62 75 74 65 73 2e 6c 65 6e 67 74 68 2c 65 3d 30 3b 65 3c 64 3b 65 2b 2b 29 7b 76 61 72 20 66 3d 61 2e 61 74 74 72 69 62 75 74 65 73 5b 65 5d 2c 68 3d 66 2e 6e 61 6d 65 2c 6b 3d 66 2e 76 61 6c 75 65 3b 5f 2e 6c 6e 2e 63 61 6c 6c 28 74 70 2c 68 29 3e 3d 30 7c 7c 63 26 26 68 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 22 29 21 3d 30 7c 7c 6b 3d 3d 3d 22 6e 75 6c 6c 22 7c 7c 22 73 70 65 63 69 66 69 65 64 22 69 6e 20 66 26 26 21 66 2e 73 70 65 63 69 66 69 65 64 7c 7c 28 63 26 26 28 68 3d 68 2e 73 75 62 73 74 72 28 35 29 29 2c 62 5b 68 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 3d 6b 29 7d 61 3d 61 2e 73 74 79 6c 65 3b 28 63 3d 75 70 28 61 26 26 61 2e 68 65 69 67 68 74 29 29 26 26 28 62 2e 68 65 69 67 68 74 3d 53 74 72 69 6e 67 Data Ascii: ,d=a.attributes.length,e=0;e<d;e++){var f=a.attributes[e],h=f.name,k=f.value;_.ln.call(tp,h)>=0\|\|c&&h.indexOf("data-")!=0\|\|k==="null"\|\|"specified"in f&&!f.specified\|\|(c&&(h=h.substr(5)),b[h.toLowerCase()]=k)}a=a.style;(c=up(a&&a.height))&&(b.height=String
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 3d 61 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 2a 22 29 3b 61 3d 5f 2e 6c 66 28 29 3b 66 6f 72 28 65 3d 30 3b 65 3c 64 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 66 3d 64 5b 65 5d 3b 76 61 72 20 6b 3d 66 3b 68 3d 62 3b 76 61 72 20 6c 3d 6b 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6d 3d 76 6f 69 64 20 30 3b 69 66 28 6b 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 67 61 70 69 73 63 61 6e 22 29 29 68 3d 0a 6e 75 6c 6c 3b 65 6c 73 65 7b 76 61 72 20 6e 3d 6c 2e 69 6e 64 65 78 4f 66 28 22 67 3a 22 29 3b 6e 3d 3d 30 3f 6d 3d 6c 2e 73 75 62 73 74 72 28 32 29 3a 28 6e 3d 28 6e 3d 53 74 72 69 6e 67 28 6b 2e 63 6c 61 73 73 4e 61 6d 65 7c 7c 6b 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 Data Ascii: =a.getElementsByTagName("*");a=_.lf();for(e=0;e<d.length;e++){f=d[e];var k=f;h=b;var l=k.nodeName.toLowerCase(),m=void 0;if(k.hasAttribute("data-gapiscan"))h=null;else{var n=l.indexOf("g:");n==0?m=l.substr(2):(n=(n=String(k.className\|\|k.getAttribute("cla
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 6f 6e 2c 6d 3d 61 2b 22 2f 22 2b 63 2e 61 63 74 69 6f 6e 29 3b 28 6c 3d 5f 2e 48 66 28 22 69 66 72 61 6d 65 73 2f 22 2b 6c 2b 22 2f 75 72 6c 22 29 29 7c 7c 28 6c 3d 22 3a 69 6d 5f 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 69 6d 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 22 2b 6d 2b 22 3f 75 73 65 67 61 70 69 3d 31 22 29 3b 66 6f 72 28 6e 20 69 6e 20 6f 70 29 66 5b 6e 5d 3d 6e 2b 22 2f 22 2b 28 63 5b 6e 5d 7c 7c 6f 70 5b 6e 5d 29 2b 22 2f 22 3b 76 61 72 20 6e 3d 5f 2e 79 6d 28 5f 2e 67 66 2c 6c 2e 72 65 70 6c 61 63 65 28 5f 2e 52 6d 2c 64 70 28 66 29 29 29 3b 6d 3d 22 69 66 72 61 6d 65 73 2f 22 2b 61 2b 22 2f 70 61 72 61 6d 73 2f 22 3b 66 3d 7b 7d 3b 5f 2e 6e 66 28 63 2c 66 29 3b 28 Data Ascii: on,m=a+"/"+c.action);(l=_.Hf("iframes/"+l+"/url"))\|\|(l=":im_socialhost:/:session_prefix::im_prefix:_/widget/render/"+m+"?usegapi=1");for(n in op)f[n]=n+"/"+(c[n]\|\|op[n])+"/";var n=_.ym(_.gf,l.replace(_.Rm,dp(f)));m="iframes/"+a+"/params/";f={};_.nf(c,f);(
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 2c 75 2c 76 2c 68 29 3b 62 3d 68 2e 69 64 3b 63 3d 5f 2e 6c 66 28 29 3b 63 2e 69 64 3d 62 3b 63 2e 75 73 65 72 50 61 72 61 6d 73 3d 68 2e 75 73 65 72 50 61 72 61 6d 73 3b 63 2e 75 72 6c 3d 68 2e 75 72 6c 3b 63 2e 74 79 70 65 3d 68 2e 74 79 70 65 3b 63 2e 73 74 61 74 65 3d 31 3b 5f 2e 4c 6f 5b 62 5d 3d 63 3b 62 3d 68 7d 65 6c 73 65 20 62 3d 6e 75 6c 6c 3b 62 26 26 28 28 63 3d 62 2e 69 64 29 26 26 64 2e 70 75 73 68 28 63 29 2c 4a 70 28 61 2c 62 29 29 7d 7d 2c 4b 70 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 26 26 61 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 31 26 26 62 29 7b 69 66 28 63 29 72 65 74 75 72 6e 20 31 3b 69 66 28 41 70 5b 62 5d 29 7b 69 66 28 61 70 5b 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 29 72 Data Ascii: ,u,v,h);b=h.id;c=_.lf();c.id=b;c.userParams=h.userParams;c.url=h.url;c.type=h.type;c.state=1;_.Lo[b]=c;b=h}else b=null;b&&((c=b.id)&&d.push(c),Jp(a,b))}},Kp=function(a,b,c){if(a&&a.nodeType===1&&b){if(c)return 1;if(Ap[b]){if(ap[a.nodeName.toLowerCase()])r
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 62 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 3b 65 3e 30 26 26 63 3e 3d 65 26 26 28 77 69 6e 64 6f 77 2e 5f 5f 67 61 70 69 5f 6a 73 74 69 6d 69 6e 67 5f 5f 2e 73 72 74 3d 63 2d 65 29 7d 69 66 28 62 29 7b 76 61 72 20 66 3d 77 69 6e 64 6f 77 2e 5f 5f 67 61 70 69 5f 6a 73 74 69 6d 69 6e 67 5f 5f 2e 6c 6f 61 64 3b 0a 65 3e 30 26 26 63 3e 3d 65 26 26 28 66 2e 74 69 63 6b 28 22 5f 77 74 73 72 74 22 2c 76 6f 69 64 20 30 2c 65 29 2c 66 2e 74 69 63 6b 28 22 77 74 73 72 74 5f 22 2c 22 5f 77 74 73 72 74 22 2c 63 29 2c 66 2e 74 69 63 6b 28 22 74 62 73 64 5f 22 2c 22 77 74 73 72 74 5f 22 29 29 7d 74 72 79 7b 62 3d 6e 75 6c 6c 2c 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 26 26 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 2e 63 73 69 26 26 28 62 3d 4d 61 74 68 2e 66 6c 6f Data Ascii: b.navigationStart;e>0&&c>=e&&(window.__gapi_jstiming__.srt=c-e)}if(b){var f=window.__gapi_jstiming__.load;e>0&&c>=e&&(f.tick("_wtsrt",void 0,e),f.tick("wtsrt_","_wtsrt",c),f.tick("tbsd_","wtsrt_"))}try{b=null,window.chrome&&window.chrome.csi&&(b=Math.flo
2024-10-01 18:27:27 UTC	1390	IN	Data Raw: 63 68 65 64 56 69 61 53 70 64 79 26 26 28 64 2b 3d 22 26 70 3d 73 22 29 3b 69 66 28 65 2e 77 61 73 4e 70 6e 4e 65 67 6f 74 69 61 74 65 64 29 7b 64 2b 3d 22 26 6e 70 6e 3d 31 22 3b 76 61 72 20 66 3d 65 2e 6e 70 6e 4e 65 67 6f 74 69 61 74 65 64 50 72 6f 74 6f 63 6f 6c 3b 66 26 26 28 64 2b 3d 22 26 6e 70 6e 76 3d 22 2b 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 7c 7c 65 73 63 61 70 65 29 28 66 29 29 7d 65 2e 77 61 73 41 6c 74 65 72 6e 61 74 65 50 72 6f 74 6f 63 6f 6c 41 76 61 69 6c 61 62 6c 65 26 26 28 64 2b 3d 22 26 61 70 61 3d 31 22 29 7d 76 61 72 20 68 3d 61 2e 74 2c 6b 3d 68 2e 73 74 61 72 74 3b 65 3d 5b 5d 3b 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6c 20 69 6e 20 68 29 69 66 28 6c 21 3d 0a 22 73 74 61 72 74 22 26 26 6c 2e 69 6e 64 65 78 4f Data Ascii: chedViaSpdy&&(d+="&p=s");if(e.wasNpnNegotiated){d+="&npn=1";var f=e.npnNegotiatedProtocol;f&&(d+="&npnv="+(encodeURIComponent\|\|escape)(f))}e.wasAlternateProtocolAvailable&&(d+="&apa=1")}var h=a.t,k=h.start;e=[];f=[];for(var l in h)if(l!="start"&&l.indexO

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:27 UTC	1330	OUT	GET /viewer2/prod-02/meta?ck=drive&ds=APznzaYc2ZADYQj527cf1n-JHSdWwI8DNdPcRknSJUHZ81wRPn4wLXsNlLM4BtupW5UHnTvSeB4QN4K8W-ykvQSBSIEPORc-_WxSPmfDC6F0oqKsdQn3UauoXxGtswVXx0MyTXQfu6CE6_XOMLfX7hxj4rOuKYAUbqIbbKn-vw5Hwlfqe3Yx1pRPVjF0Qd5SOaMj3mMJzUZOyL_eqayQGUWCPezMCOS5NeoNwrWETdeMO3orRB1GdILv0CB40YNT-qmfNi3GSdyPnZ0hEZTOtHFOE6rosEXPSvK7b2oEBmcXWA12Cj1jzjpxgoXj8EPUoneXYgd9e72FGpTDpgod26dZVeZ6Jq2U2x5HVoybrgktpqfKQieko0SHJoABVqQUlo_tq2YzfhFSAe2j-_q9q_Oek6XrXWUaWQ%3D%3D&authuser=0 HTTP/1.1 Host: drive.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=US9AyQZV6OeHDc7jcf2Wvy68OW3I3aotdd8v6zMjybcHqJwUEXelHjVRViiYRLwzVswvvI0fCrGcoKrw2lWXSy_R_5hN8ebJtNLYMutJoxAipiz2fOEWFxboQVwqAwnx2Zbx5DeGsOhApUGOjjD69bS4tFhcvWGcjYcuR8ZhnUlSihTi9P2Ew2rEIw
2024-10-01 18:27:27 UTC	2134	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 18:27:27 GMT Content-Disposition: attachment; filename="json.txt"; filename=UTF-8''json.txt Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version= Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AppsViewerFrontendHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NofswPdQXr183roTrn52AQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AppsViewerFrontendHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AppsViewerFrontendHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="AppsViewerFrontendHttp" Report-To: {"group":"AppsViewerFrontendHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AppsViewerFrontendHttp"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/_/AppsViewerFrontendHttp/web-reports?context=eJzjktDikmLw0pBicNu9k8kbiJ3SZ7CGALEQD0f_vw_b2QRm7OtpZ1ZST8ovjE8sKCjWLctMLU8t0k0rys8rSc1LiTcyMDIxsDS01DMwii8wAAAc7Bpn" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-01 18:27:27 UTC	656	IN	Data Raw: 32 38 39 0d 0a 29 5d 7d 27 0a 7b 22 70 61 67 65 73 22 3a 31 2c 22 6d 61 78 50 61 67 65 57 69 64 74 68 22 3a 33 32 30 30 2c 22 70 64 66 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 6f 63 2d 30 30 2d 33 73 2d 70 72 6f 64 2d 30 32 2d 61 70 70 73 2d 76 69 65 77 65 72 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 5c 2f 76 69 65 77 65 72 32 5c 2f 70 72 6f 64 2d 30 32 5c 2f 70 64 66 5c 2f 74 69 6a 72 33 66 6b 70 68 70 61 69 74 75 76 74 35 38 39 6b 30 6a 74 65 32 6e 31 74 75 71 67 37 5c 2f 30 65 30 74 34 73 36 37 69 75 72 64 73 6f 6c 67 66 64 68 36 73 62 38 62 6c 6b 39 6e 31 75 74 65 5c 2f 31 37 32 37 38 30 37 31 37 35 30 30 30 5c 2f 33 5c 2f 2a 5c 2f 41 50 7a 6e 7a 61 59 63 32 5a 41 44 59 51 6a 35 32 37 63 66 31 6e 2d 4a 48 53 64 57 77 49 38 44 Data Ascii: 289)]}'{"pages":1,"maxPageWidth":3200,"pdf":"https:\/\/doc-00-3s-prod-02-apps-viewer.googleusercontent.com\/viewer2\/prod-02\/pdf\/tijr3fkphpaituvt589k0jte2n1tuqg7\/0e0t4s67iurdsolgfdh6sb8blk9n1ute\/1727807175000\/3\/*\/APznzaYc2ZADYQj527cf1n-JHSdWwI8D
2024-10-01 18:27:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:27:27 UTC	668	OUT	GET /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=US9AyQZV6OeHDc7jcf2Wvy68OW3I3aotdd8v6zMjybcHqJwUEXelHjVRViiYRLwzVswvvI0fCrGcoKrw2lWXSy_R_5hN8ebJtNLYMutJoxAipiz2fOEWFxboQVwqAwnx2Zbx5DeGsOhApUGOjjD69bS4tFhcvWGcjYcuR8ZhnUlSihTi9P2Ew2rEIw
2024-10-01 18:27:27 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Tue, 01 Oct 2024 18:27:27 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-01 18:27:27 UTC	1120	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-10-01 18:27:27 UTC	435	IN	Data Raw: 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 7d 23 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 34 70 78 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3e 3c 73 70 61 6e Data Ascii: pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span