Edit tour

Windows Analysis Report
https://forms.gle/uegGMX3eHYKZmZss5

Overview

General Information

Sample URL:	https://forms.gle/uegGMX3eHYKZmZss5
Analysis ID:	1417128
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://forms.gle/uegGMX3eHYKZmZss5 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1980,i,6190785327670335455,15667986563799497857,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49833 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic	HTTP traffic detected: GET /uegGMX3eHYKZmZss5 HTTP/1.1Host: forms.gleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform?usp=send_form HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/font/getmetadata HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=LmZ8tPpHRSf6xbp&MD=vYUzOsaG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/font/getmetadata HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=LmZ8tPpHRSf6xbp&MD=vYUzOsaG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: chromecache_232.1.dr	String found in binary or memory: _.Yw(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.Yw(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.Yw(_.gx(c))+"&hl="+_.Yw(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.Yw(m)+"/chromebook/termsofservice.html?languageCode="+_.Yw(d)+"&regionCode="+_.Yw(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded":"")+"?hl="+_.Yw(d)+"&gl="+_.Yw(c)+(h?"&color_scheme="+ equals www.youtube.com (Youtube)
Source: chromecache_187.1.dr	String found in binary or memory: gf=u(["https://sandbox.google.com/tools/feedback/"]),hf=u(["https://www.google.cn/tools/feedback/"]),jf=u(["https://help.youtube.com/tools/feedback/"]),kf=u(["https://asx-frontend-staging.corp.google.com/inapp/"]),lf=u(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),mf=u(["https://localhost.corp.google.com/inapp/"]),nf=u(["https://localhost.proxy.googlers.com/inapp/"]),of=S(Qe),pf=[S(Re),S(Se)],qf=[S(Te),S(Ue),S(Ve),S(We),S(Xe),S(Ye),S(Ze),S($e),S(af),S(bf)],rf=[S(cf),S(df)],sf= equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: forms.gle

Source: unknown

HTTP traffic detected: POST /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/naLogImpressions HTTP/1.1Host: docs.google.comConnection: keep-aliveContent-Length: 3069sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Same-Domain: 1Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform?usp=send_formAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://forms.gle/uegGMX3eHYKZmZss5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1980,i,6190785327670335455,15667986563799497857,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1980,i,6190785327670335455,15667986563799497857,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://forms.gle/uegGMX3eHYKZmZss5	0%	Avira URL Cloud	safe
https://forms.gle/uegGMX3eHYKZmZss5	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
csp.withgoogle.com	0%	Virustotal		Browse
forms.gle	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://play.google/intl/	0%	URL Reputation	safe
http://localhost.proxy.googlers.com/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/inapp/	0%	URL Reputation	safe
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	0%	URL Reputation	safe
https://localhost.proxy.googlers.com/inapp/	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/report-to/gse_qebhlk	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/gse_qebhlk	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
docs.google.com	172.253.115.101	true	false		high
csp.withgoogle.com	172.253.122.141	true	false	0%, Virustotal, Browse	unknown
play.google.com	172.253.63.113	true	false		high
www3.l.google.com	142.251.111.100	true	false		high
forms.gle	199.36.158.100	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.251.163.103	true	false		high
accounts.youtube.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://csp.withgoogle.com/csp/report-to/gse_qebhlk	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://forms.gle/uegGMX3eHYKZmZss5	false		unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		high
https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform	false		high
https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform?usp=send_form	false		high
https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/font/getmetadata	false		high
https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/formResponse	false		high
https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/naLogImpressions	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.31.100	unknown	United States	15169	GOOGLEUS	false
172.253.122.141	csp.withgoogle.com	United States	15169	GOOGLEUS	false
142.251.163.103	www.google.com	United States	15169	GOOGLEUS	false
172.253.63.113	play.google.com	United States	15169	GOOGLEUS	false
199.36.158.100	forms.gle	United States	15169	GOOGLEUS	false
172.253.115.138	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.115.101	docs.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.16
192.168.2.7

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417128
Start date and time:	2024-03-28 16:23:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://forms.gle/uegGMX3eHYKZmZss5
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@16/218@16/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 14:24:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.997745445583367
Encrypted:	false
SSDEEP:	48:8X4dqsTHn/HyoidAKZdA1FehwiZUklqehSy+3:8Mzh1y
MD5:	22D2ECB24828BE22C1048329E3488EAF
SHA1:	F1D4101FF8264EB8528366EFD2C9A8052F812FBE
SHA-256:	DED36EB8C8A67ED6672F2FBF019084BD6C1BA5168624658B04955CF152A76803
SHA-512:	2B185B0FEF9E442458D45B8AA2004836FC14C6C39D0CA5E30662010BC7C5E2E769C224EDF76A136E58107A490583C10904FB04C4B5FCBDC0588D00F843E1ABAC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........$...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\|X.{....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X.{....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X.{....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X.{..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|X.{...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}#g......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google/intl/	chromecache_232.1.dr	false	URL Reputation: safe	unknown
http://localhost.corp.google.com/inapp/	chromecache_187.1.dr	false		high
https://families.google.com/intl/	chromecache_232.1.dr	false		high
https://feedback.googleusercontent.com/resources/annotator.css	chromecache_187.1.dr	false		high
https://youtube.com/embed/?rel=0	chromecache_198.1.dr, chromecache_129.1.dr, chromecache_184.1.dr, chromecache_160.1.dr	false		high
https://apis.google.com/js/client.js	chromecache_187.1.dr	false		high
https://feedback2-test.corp.googleusercontent.com/tools/feedback/%	chromecache_187.1.dr	false		high
https://policies.google.com/technologies/location-data	chromecache_232.1.dr	false		high
https://support.google.com	chromecache_198.1.dr, chromecache_129.1.dr, chromecache_184.1.dr, chromecache_160.1.dr	false		high
https://play.google.com	chromecache_198.1.dr, chromecache_129.1.dr, chromecache_184.1.dr, chromecache_160.1.dr	false		high
https://youtube.com/embed/	chromecache_198.1.dr, chromecache_129.1.dr, chromecache_184.1.dr, chromecache_160.1.dr	false		high
http://localhost.proxy.googlers.com/inapp/	chromecache_187.1.dr	false	URL Reputation: safe	unknown
https://stagingqual-feedback-pa-googleapis.sandbox.google.com	chromecache_187.1.dr	false		high
https://support.google.com/inapp/%	chromecache_187.1.dr	false		high
https://asx-help-frontend-autopush.corp.youtube.com/inapp/	chromecache_187.1.dr	false		high
https://play.google.com/work/enroll?identifier=	chromecache_232.1.dr	false		high
https://policies.google.com/terms/service-specific	chromecache_232.1.dr	false		high
https://g.co/recover	chromecache_232.1.dr	false		high
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	chromecache_232.1.dr	false		high
https://help.youtube.com/tools/feedback/	chromecache_187.1.dr	false		high
https://policies.google.com/technologies/cookies	chromecache_232.1.dr	false		high
https://policies.google.com/terms	chromecache_232.1.dr	false		high
https://asx-frontend-staging.corp.google.com/tools/feedback/	chromecache_187.1.dr	false		high
https://support.google.com/	chromecache_187.1.dr, chromecache_129.1.dr, chromecache_184.1.dr, chromecache_160.1.dr	false		high
https://www.google.com	chromecache_198.1.dr, chromecache_232.1.dr, chromecache_129.1.dr, chromecache_184.1.dr, chromecache_160.1.dr	false		high
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_232.1.dr	false		high
https://scone-pa.clients6.google.com	chromecache_187.1.dr	false		high
https://support.google.com/inapp/	chromecache_187.1.dr	false		high
https://asx-frontend-autopush.corp.google.co.uk/inapp/	chromecache_187.1.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/	chromecache_187.1.dr	false	URL Reputation: safe	unknown
https://asx-frontend-autopush.corp.google.com/tools/feedback/	chromecache_187.1.dr	false		high
https://asx-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_187.1.dr	false		high
https://support.google.com/accounts?p=new-si-ui	chromecache_232.1.dr	false		high
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage	chromecache_232.1.dr	false		high
https://feedback2-test.corp.google.com/inapp/%	chromecache_187.1.dr	false		high
https://www.google.com/tools/feedback	chromecache_187.1.dr, chromecache_129.1.dr, chromecache_184.1.dr, chromecache_160.1.dr	false		high
https://youtube.com/t/terms?gl=	chromecache_232.1.dr	false		high
https://sandbox.google.com/inapp/%	chromecache_187.1.dr	false		high
https://www.google.com/intl/	chromecache_232.1.dr	false		high
https://apis.google.com/js/api.js	chromecache_188.1.dr	false		high
https://feedback2-test.corp.googleusercontent.com/inapp/%	chromecache_187.1.dr	false		high
https://localhost.proxy.googlers.com/inapp/	chromecache_187.1.dr	false	URL Reputation: safe	unknown
https://policies.google.com/privacy/google-partners	chromecache_232.1.dr	false		high
https://www.google.com/tools/feedback/	chromecache_187.1.dr	false		high
https://www.google.cn/tools/feedback/	chromecache_187.1.dr	false		high
https://policies.google.com/privacy/additional	chromecache_232.1.dr	false		high
https://asx-frontend-autopush.corp.google.de/inapp/	chromecache_187.1.dr	false		high
https://www.google.cn/tools/feedback/%	chromecache_187.1.dr	false		high
https://feedback2-test.corp.google.com/tools/feedback/%	chromecache_187.1.dr	false		high
https://www.google.com/tools/feedback/help_panel_binary.js	chromecache_187.1.dr	false		high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_188.1.dr, chromecache_219.1.dr	false		high
https://asx-frontend-autopush.corp.google.de/tools/feedback/	chromecache_187.1.dr	false		high
https://sandbox.google.com/inapp/	chromecache_187.1.dr	false		high
https://test-scone-pa-googleapis.sandbox.google.com	chromecache_187.1.dr	false		high
https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/	chromecache_187.1.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_219.1.dr	false		high
https://asx-frontend-autopush.corp.google.com/inapp/	chromecache_187.1.dr	false		high
https://feedback.googleusercontent.com/resources/render_frame2.html	chromecache_187.1.dr	false		high
https://policies.google.com/privacy/additional/embedded?gl=kr	chromecache_232.1.dr	false		high
https://sandbox.google.com/tools/feedback/%	chromecache_187.1.dr	false		high
https://policies.google.com/terms/location/embedded	chromecache_232.1.dr	false		high
https://sandbox.google.com/tools/feedback/	chromecache_187.1.dr	false		high
https://localhost.corp.google.com/inapp/	chromecache_187.1.dr	false		high
https://support.google.com/accounts?hl=	chromecache_232.1.dr	false		high
https://asx-frontend-autopush.corp.youtube.com/inapp/	chromecache_187.1.dr	false		high
https://policies.google.com/privacy	chromecache_232.1.dr	false		high
https://feedback-pa.clients6.google.com	chromecache_187.1.dr	false		high
https://asx-frontend-staging.corp.google.com/inapp/	chromecache_187.1.dr	false		high
https://www.google.com/tools/feedback/%	chromecache_187.1.dr	false		high
https://fonts.google.com/license/googlerestricted	chromecache_216.1.dr, chromecache_213.1.dr	false		high

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 16:24:27.205549955 CET	55389	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:27.205785990 CET	62762	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:27.300684929 CET	53	53390	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:27.300743103 CET	53	55389	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:27.301482916 CET	53	62762	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:27.304102898 CET	53	57512	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:27.904642105 CET	56348	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:27.904807091 CET	53199	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:27.999820948 CET	53	56348	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:28.000724077 CET	53	53199	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:28.073916912 CET	53	62363	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:28.919363976 CET	53	52847	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:28.921232939 CET	53	60334	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:29.486746073 CET	53	52459	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:30.210633993 CET	53	63162	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:30.523034096 CET	53	52395	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:30.597681999 CET	53	52440	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:31.098805904 CET	53	59372	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:31.532428980 CET	58324	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:31.532593966 CET	64122	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:31.627744913 CET	53	58324	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:31.628091097 CET	53	64122	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:31.939183950 CET	50694	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:31.939373970 CET	50188	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:32.034302950 CET	53	50188	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:32.042347908 CET	53	50694	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:32.710524082 CET	64327	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:32.717196941 CET	60452	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:32.806018114 CET	53	64327	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:32.812258959 CET	53	60452	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:32.835330963 CET	61919	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:32.835500002 CET	62413	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:24:32.932502031 CET	53	61919	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:32.932769060 CET	53	62413	1.1.1.1	192.168.2.16
Mar 28, 2024 16:24:45.028322935 CET	53	49211	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:04.111521006 CET	53	53667	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:22.788352013 CET	63309	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:25:22.788563967 CET	51788	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:25:22.884023905 CET	53	63309	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:22.885838032 CET	53	51788	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:26.603837013 CET	50437	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:25:26.604039907 CET	60407	53	192.168.2.16	1.1.1.1
Mar 28, 2024 16:25:26.698970079 CET	53	60407	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:26.699848890 CET	53	50437	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:27.032556057 CET	53	59555	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:27.226037025 CET	53	56635	1.1.1.1	192.168.2.16
Mar 28, 2024 16:25:30.470966101 CET	138	138	192.168.2.16	192.168.2.255

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:27 UTC	669	OUT	GET /uegGMX3eHYKZmZss5 HTTP/1.1 Host: forms.gle Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-28 15:24:27 UTC	1375	IN	HTTP/1.1 302 Found Connection: close Content-Length: 0 Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cache-Control: no-cache, no-store, max-age=0, must-revalidate Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DurableDeepLinkUi/cspreport,script-src 'report-sample' 'nonce-5ob_hwi4pmV0sWexdGJoUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport/allowlist Content-Type: application/binary Cross-Origin-Opener-Policy: unsafe-none Cross-Origin-Resource-Policy: same-site Expires: Mon, 01 Jan 1990 00:00:00 GMT Location: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform?usp=send_form Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=*
2024-03-28 15:24:27 UTC	348	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 38 20 4d 61 72 20 32 30 32 34 20 31 35 3a 32 34 3a 32 37 20 47 4d 54 0d 0a 58 2d 53 65 72 76 65 64 2d 42 79 3a 20 63 61 63 68 65 2d 65 77 72 31 38 31 37 36 2d 45 57 52 0d 0a 58 2d 43 61 63 68 65 3a 20 4d 49 53 53 0d 0a 58 2d 43 61 63 68 65 2d 48 69 74 73 3a 20 30 0d 0a 58 2d 54 69 6d 65 72 3a 20 53 31 37 31 31 36 33 39 34 36 38 2e 37 32 34 37 31 34 2c 56 53 30 2c 56 45 31 32 36 0d 0a 56 61 72 79 3a 20 53 65 63 2d 46 65 74 63 68 2d 44 65 73 74 2c 20 53 65 63 2d 46 65 74 63 68 2d 4d 6f 64 65 2c 20 53 65 63 2d 46 65 74 63 68 2d 53 69 74 65 2c 20 78 2d 66 68 2d 72 65 71 75 65 73 74 65 64 2d 68 6f 73 74 2c Data Ascii: Pragma: no-cacheAccept-Ranges: bytesDate: Thu, 28 Mar 2024 15:24:27 GMTX-Served-By: cache-ewr18176-EWRX-Cache: MISSX-Cache-Hits: 0X-Timer: S1711639468.724714,VS0,VE126Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, x-fh-requested-host,

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:28 UTC	936	OUT	GET /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform?usp=send_form HTTP/1.1 Host: docs.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2024-03-28 15:24:28 UTC	2737	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:28 GMT Content-Security-Policy-Report-Only: report-uri https://csp.withgoogle.com/csp/forms/prod;frame-ancestors 'none' Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-d7SGDdvuzhyelZR1s8osfA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Reporting-Endpoints: default="/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/web-reports?context=eJwNyWtMzXEYB_DH83_-TkcuqS0Ta6thLiuFYatzP__TZUaZ_GrDGDXXkBZyydo4w9xKypqdNS8sNLGZMW3H5Vgym2WuL1xaQ2k41dEpnHxffF59xvlNIVLki1LUEq1oaIKiyzGKEmMVBeIVpUxRVDlT0bwURTWpinYuUuR1KmqATkNRF7zZoOgrmDcpmgqDOxRJqaIlZYqy4HC5otNQUqmoAt4eUfQNSo_iYOkpRdnw7qyiHiioU1QMkQZFEy8qKmtUVA3H4AIkPVGUDr2DikagIoSD1mmF5AdzYiFNhSxQ0LyukO4CVRRSDPye850jMLomyKa1QbZuDrIHWh4F-TbU1_SzD8Y09LMZfn7u5yEoWDbAa6GvYIAHYXfVAO-H0dQQm-aHuCUtxLdBqw5xNAS3DfEw6JYwT4Bu6IM9jjAfgK7iMPdC1YkweyHydJjHdgzzydgRroXEphGeBb8W_uUwRB_6x3HgXxnhdhhHoxwL3dNHuQ8cMaTlgL-UtHbI7yatCEr2sFYKcwOsLYArz1m7Acc_sXYO9mqaVgXTvZo2A9Z3aNpmeD0pQz5AT1WGBOFsT4Y0QG0oQxoh-3ym5MH7-kzpAnNLpkyGsNMi5LJI3S2LXILZCVZJg1kLrZIKE4utEg-5uk1WgtVhEw-kFtlkMSx_apPV0LbVLgHovWqXfjj-yi7n4HC2Q47B3XqHPID4WqckwqprTlkDzx465SWcsrqkDpp3ueQmrKhwiYK2SpcEYG6rSxbA9lcuKYeRJLdwslssJ91iQJbfLSvg_ne3PIZbuiH3wD7ZkDz4kWRIBAK7DXkOCT5DkuFFmyFv4dsXQ35B0j6PpIO3xiNn4E1ntnyE6LgciYOB_TnyB-7rufIYMk254oaZ1T49Bcrv-PSDcG9jk94B-e-a9CJIeN-kJ0Ps-Kjr9Rdax8a0B5o_ckLU6i3Fez07y3b8Bx82WOw" Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; Domain=.docs.google.com; Expires=Thu, 28-Mar-2024 16:24:28 GMT; Path=/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ; Secure; HttpOnly; Priority=LOW; SameSite=none Set-Cookie: COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; Domain=.docs.google.com; Expires=Thu, 28-Mar-2024 16:24:28 GMT; Path=/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ; Secure; HttpOnly; Priority=LOW; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 37 30 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 48 42 31 65 43 64 2d 55 4d 72 6e 6d 62 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 73 70 72 65 61 64 73 68 65 65 74 73 2f 66 6f 72 6d 73 2f 66 61 76 69 63 6f 6e 5f 71 70 32 2e 70 6e 67 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 69 63 6f 6e 3f 66 61 6d 69 6c 79 3d 4d 61 74 65 72 69 61 6c 2b 49 63 6f 6e 73 2b 45 78 74 65 6e 64 65 64 22 20 72 Data Ascii: 7006<!DOCTYPE html><html lang="en" class="HB1eCd-UMrnmb"><head><link rel="shortcut icon" sizes="16x16" href="https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png"><link href="https://fonts.googleapis.com/icon?family=Material+Icons+Extended" r
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 5a 45 29 2c 20 2e 77 47 51 46 62 65 2e 42 36 56 68 71 65 3a 6e 6f 74 28 2e 52 44 50 5a 45 29 20 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 77 47 51 46 62 65 2e 69 39 78 66 62 62 20 3e 20 2e 4d 62 68 55 7a 64 2c 20 2e 77 47 51 46 62 65 2e 75 33 62 57 34 65 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 2e 31 35 29 3b 7d 2e 77 47 51 46 62 65 2e 77 47 51 46 62 65 3a 68 6f 76 65 72 20 3e 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 2e 30 34 29 3b 7d 2e 77 47 51 46 62 65 2e 77 47 51 46 62 65 3a 66 6f Data Ascii: ZE), .wGQFbe.B6Vhqe:not(.RDPZE) {border-color: rgb(103, 58, 183);}.wGQFbe.i9xfbb > .MbhUzd, .wGQFbe.u3bW4e > .MbhUzd {background-color: rgba(103, 58, 183, 0.15);}.wGQFbe.wGQFbe:hover > .MbhUzd {background-color: rgba(103, 58, 183, 0.04);}.wGQFbe.wGQFbe:fo
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 35 38 2c 20 31 38 33 29 3b 7d 2e 63 74 45 75 78 20 2e 43 65 6f 52 59 63 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 63 74 45 75 78 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 20 63 69 72 63 6c 65 20 66 61 72 74 68 65 73 74 2d 73 69 64 65 2c 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 2e 31 35 29 2c 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 2e 31 35 29 20 38 30 25 2c 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 29 20 31 30 30 25 20 29 3b 7d 2e 70 52 5a 68 57 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 31 30 39 2c 20 31 31 34 29 3b 7d 2e Data Ascii: 58, 183);}.ctEux .CeoRYc {background-color: rgb(103, 58, 183);}.ctEux .MbhUzd {background-image: radial-gradient( circle farthest-side,rgba(103, 58, 183, 0.15),rgba(103, 58, 183, 0.15) 80%,rgba(103, 58, 183, 0) 100% );}.pRZhW {color: rgb(103, 109, 114);}.
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 3a 20 6e 6f 6e 65 3b 7d 2e 4b 48 43 77 4a 20 7b 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 7d 2e 6e 61 47 6f 68 62 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 63 6f 6c 6f 72 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 7d 2e 62 34 77 45 70 66 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 62 61 72 45 54 64 20 2e 58 31 63 6c 71 64 2c 20 2e 62 61 72 45 54 64 20 2e 71 52 55 6f 6c 63 2c 20 2e 62 61 72 45 54 64 20 2e 70 50 51 67 76 66 20 7b 63 6f 6c 6f 72 3a 20 23 32 30 32 31 32 34 3b 20 66 69 6c 6c 3a 20 23 35 46 36 33 36 38 3b 7d 2e 49 73 7a 42 52 63 2d 47 75 69 65 76 64 2d 4a 61 50 56 32 Data Ascii: : none;}.KHCwJ {display: none;}.naGohb {background-color: rgb(103, 58, 183);color: rgba(255, 255, 255, 1);}.b4wEpf {background-color: rgb(103, 58, 183);}.barETd .X1clqd, .barETd .qRUolc, .barETd .pPQgvf {color: #202124; fill: #5F6368;}.IszBRc-Guievd-JaPV2
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 63 69 6e 67 3a 20 30 3b 7d 2e 4f 49 43 39 30 63 2c 20 2e 4f 49 43 39 30 63 2e 52 6a 73 50 45 2c 20 2e 4f 49 43 39 30 63 20 2e 7a 48 51 6b 42 66 2c 20 2e 4f 49 43 39 30 63 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4f 49 43 39 30 63 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4f 49 43 39 30 63 20 2e 50 79 72 42 34 2c 20 2e 4f 49 43 39 30 63 20 2e 73 6e 42 79 61 63 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 74 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 35 70 74 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4f 49 43 39 30 63 20 2e 6f 4a 65 57 75 66 20 2e 7a 48 51 6b 42 66 20 7b 7d 2e 73 49 64 30 43 65 2c 20 2e 73 49 64 30 43 65 20 61 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 Data Ascii: cing: 0;}.OIC90c, .OIC90c.RjsPE, .OIC90c .zHQkBf, .OIC90c .Wic03c .tL9Q4c, .OIC90c .I9OJHe .KRoqRc, .OIC90c .PyrB4, .OIC90c .snByac {font-size: 11pt; line-height: 15pt;letter-spacing: 0;}.OIC90c .oJeWuf .zHQkBf {}.sId0Ce, .sId0Ce a {color: rgba(0, 0, 0, 0
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 48 76 6f 6f 2d 4e 71 6e 59 4f 65 22 2c 22 6a 65 22 3a 31 2c 22 73 73 74 75 22 3a 31 37 31 31 36 33 39 34 36 38 37 30 32 32 33 31 2c 22 73 69 22 3a 22 43 50 76 7a 6a 5f 53 68 6c 34 55 44 46 65 49 71 71 51 45 64 55 74 45 4d 65 77 22 2c 22 67 73 63 22 3a 6e 75 6c 6c 2c 22 65 69 22 3a 5b 35 37 30 31 38 37 37 2c 35 37 30 33 38 33 39 2c 35 37 30 34 36 32 31 2c 35 37 30 35 32 30 37 2c 35 37 30 35 38 39 31 2c 35 37 30 36 32 37 30 2c 35 37 30 37 34 36 31 2c 35 37 30 37 35 36 35 2c 35 37 31 31 32 32 36 2c 35 37 31 33 31 39 35 2c 35 37 31 33 35 35 34 2c 35 37 31 35 30 35 35 2c 35 37 31 38 36 38 30 2c 35 37 31 39 35 32 32 2c 35 37 32 36 36 39 35 2c 35 37 32 37 32 35 37 2c 35 37 32 39 37 39 36 2c 35 37 33 30 38 38 37 2c 35 37 33 31 34 37 30 2c 35 37 33 32 39 38 32 2c Data Ascii: Hvoo-NqnYOe","je":1,"sstu":1711639468702231,"si":"CPvzj_Shl4UDFeIqqQEdUtEMew","gsc":null,"ei":[5701877,5703839,5704621,5705207,5705891,5706270,5707461,5707565,5711226,5713195,5713554,5715055,5718680,5719522,5726695,5727257,5729796,5730887,5731470,5732982,
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 39 30 57 50 62 51 44 52 4a 51 22 2c 22 31 37 68 45 44 38 6b 47 35 30 6b 4c 55 6b 70 73 50 31 39 30 54 54 68 51 6e 33 44 41 22 2c 22 42 44 4e 5a 52 34 50 58 78 30 6b 4c 55 6b 70 73 50 31 39 30 53 4a 74 4e 50 6b 59 74 22 2c 22 45 74 6a 35 77 4a 43 51 6b 30 6b 4c 55 6b 70 73 50 31 39 30 4e 77 69 4c 38 55 4d 61 22 2c 22 78 43 4c 62 62 44 55 50 41 30 6b 4c 55 6b 70 73 50 31 39 30 58 6b 47 4a 69 50 55 6d 22 2c 22 32 4e 55 6b 6f 5a 65 68 57 30 6b 4c 55 6b 70 73 50 31 39 30 55 55 4e 4c 69 58 57 39 22 2c 22 79 75 76 59 74 64 35 35 39 30 6b 4c 55 6b 70 73 50 31 39 30 51 79 61 35 4b 34 55 52 22 2c 22 5a 48 34 72 7a 74 32 75 6b 30 6b 4c 55 6b 70 73 50 31 39 30 55 44 6b 46 35 42 6b 71 22 2c 22 75 51 55 51 68 6e 35 37 41 30 6b 4c 55 6b 70 73 50 31 39 30 57 48 6f 69 68 Data Ascii: 90WPbQDRJQ","17hED8kG50kLUkpsP190TThQn3DA","BDNZR4PXx0kLUkpsP190SJtNPkYt","Etj5wJCQk0kLUkpsP190NwiL8UMa","xCLbbDUPA0kLUkpsP190XkGJiPUm","2NUkoZehW0kLUkpsP190UUNLiXW9","yuvYtd5590kLUkpsP190Qya5K4UR","ZH4rzt2uk0kLUkpsP190UDkF5Bkq","uQUQhn57A0kLUkpsP190WHoih
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 6f 72 6d 22 2c 22 64 6f 63 73 2d 75 63 64 22 3a 22 22 2c 22 64 6f 63 73 2d 75 70 74 63 22 3a 5b 22 6c 73 72 70 22 2c 22 6e 6f 72 65 70 6c 69 63 61 22 2c 22 74 61 6d 22 2c 22 6e 74 64 22 2c 22 74 68 73 22 2c 22 61 70 70 5f 69 6e 73 74 61 6c 6c 5f 78 73 72 66 5f 74 6f 6b 65 6e 22 2c 22 6f 75 69 64 22 2c 22 63 61 22 2c 22 73 68 22 2c 22 66 72 6f 6d 43 6f 70 79 22 2c 22 73 6c 65 22 2c 22 64 6c 22 2c 22 68 69 22 2c 22 68 69 5f 65 78 74 22 2c 22 75 73 70 22 2c 22 75 72 70 22 2c 22 75 74 6d 5f 73 6f 75 72 63 65 22 2c 22 75 74 6d 5f 6d 65 64 69 75 6d 22 2c 22 75 74 6d 5f 63 61 6d 70 61 69 67 6e 22 2c 22 75 74 6d 5f 74 65 72 6d 22 2c 22 75 74 6d 5f 63 6f 6e 74 65 6e 74 22 2c 22 73 72 64 22 5d 2c 22 64 6f 63 73 2d 64 6f 64 64 6e 22 3a 22 63 73 63 61 70 69 74 61 6c Data Ascii: orm","docs-ucd":"","docs-uptc":["lsrp","noreplica","tam","ntd","ths","app_install_xsrf_token","ouid","ca","sh","fromCopy","sle","dl","hi","hi_ext","usp","urp","utm_source","utm_medium","utm_campaign","utm_term","utm_content","srd"],"docs-doddn":"cscapital
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 2d 61 64 6e 64 6c 64 63 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 68 6e 61 70 22 3a 22 64 6f 63 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 64 73 22 3a 22 68 74 74 70 73 22 2c 22 64 6f 63 73 2d 65 6d 6d 64 61 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 63 70 65 68 74 22 3a 22 22 2c 22 64 6f 63 73 2d 63 69 64 65 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 63 6e 22 3a 22 22 2c 22 64 6f 63 73 2d 64 70 72 66 6f 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 64 64 74 22 3a 22 22 2c 22 64 6f 63 73 2d 64 6f 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 61 63 72 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 61 63 77 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 65 72 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 63 69 72 22 3a 74 72 75 65 2c 22 64 6f 63 Data Ascii: -adndldc":false,"docs-dhnap":"docs.google.com","docs-ds":"https","docs-emmda":false,"docs-cpeht":"","docs-cide":true,"docs-cn":"","docs-dprfo":false,"docs-ddt":"","docs-dom":false,"docs-eacr":false,"docs-eacw":false,"docs-ecer":false,"docs-ecir":true,"doc
2024-03-28 15:24:28 UTC	2737	IN	Data Raw: 63 73 2d 63 61 72 75 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6c 69 65 6e 74 73 36 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 63 64 72 75 22 3a 22 68 74 74 70 73 3a 2f 2f 64 72 69 76 65 66 72 6f 6e 74 65 6e 64 2d 70 61 2e 63 6c 69 65 6e 74 73 36 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 63 62 61 75 22 3a 22 68 74 74 70 73 3a 2f 2f 64 72 69 76 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 63 66 72 75 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 68 33 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 64 6f 63 73 2d 63 74 61 6b 22 3a 22 41 49 7a 61 53 79 41 57 47 72 66 43 43 72 37 61 6c 62 4d 33 6c 6d 43 63 39 33 37 67 78 34 75 49 70 68 62 70 65 4b 51 22 2c 22 64 6f 63 73 2d 63 67 61 76 22 3a 30 2c 22 64 6f 63 73 2d 63 63 69 22 3a 32 2c Data Ascii: cs-caru":"https://clients6.google.com","docs-cdru":"https://drivefrontend-pa.clients6.google.com","docs-cbau":"https://drive.google.com","docs-cfru":"https://lh3.google.com","docs-ctak":"AIzaSyAWGrfCCr7albM3lmCc937gx4uIphbpeKQ","docs-cgav":0,"docs-cci":2,

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:31 UTC	1431	OUT	POST /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 3069 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform?usp=send_form Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2024-03-28 15:24:31 UTC	3069	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 37 31 31 36 33 39 34 37 31 30 31 35 30 30 30 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 25 35 42 31 37 31 31 36 33 39 34 37 31 30 31 35 30 30 30 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 37 31 36 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 25 35 44 25 35 44 25 32 43 25 35 42 25 32 32 43 50 76 7a 6a 5f 53 68 6c 34 55 44 46 65 49 71 71 51 45 64 55 74 45 4d 65 77 25 32 32 25 32 43 31 37 31 31 36 33 39 34 37 31 30 31 33 30 30 30 25 32 43 31 37 31 31 36 33 39 34 36 38 37 30 32 32 33 31 25 32 43 25 32 32 41 44 46 4e 2d 63 75 76 76 37 74 6a 47 4e 58 76 58 Data Ascii: impressionBatch=%5B%5B%5Bnull%2Cnull%2C1%2C1711639471015000%2Cnull%2Cnull%2Cnull%2C%5B%5B1711639471015000%5D%2Cnull%2C1%5D%2Cnull%2C716%2Cnull%2C1%2C1%5D%5D%2C%5B%22CPvzj_Shl4UDFeIqqQEdUtEMew%22%2C1711639471013000%2C1711639468702231%2C%22ADFN-cuvv7tjGNXvX
2024-03-28 15:24:31 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:31 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-9PhJ5s7q59My2nlcC02vbw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:31 UTC	1416	OUT	POST /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 246 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2024-03-28 15:24:31 UTC	246	OUT	Data Raw: 66 61 6d 69 6c 69 65 73 3d 41 6d 61 74 69 63 25 32 30 53 43 25 32 43 43 61 76 65 61 74 25 32 43 43 6f 6d 66 6f 72 74 61 61 25 32 43 45 42 25 32 30 47 61 72 61 6d 6f 6e 64 25 32 43 4c 65 78 65 6e 64 25 32 43 4c 6f 62 73 74 65 72 25 32 43 4c 6f 72 61 25 32 43 4d 65 72 72 69 77 65 61 74 68 65 72 25 32 43 4d 6f 6e 74 73 65 72 72 61 74 25 32 43 4e 75 6e 69 74 6f 25 32 43 4f 73 77 61 6c 64 25 32 43 50 61 63 69 66 69 63 6f 25 32 43 50 6c 61 79 66 61 69 72 25 32 30 44 69 73 70 6c 61 79 25 32 43 52 6f 62 6f 74 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 4d 6f 6e 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 53 65 72 69 66 25 32 43 53 70 65 63 74 72 61 6c 26 75 73 65 41 6c 6c 53 75 62 73 65 74 73 3d 74 72 75 65 26 66 6f 72 6d 61 74 3d 77 6f 66 66 32 Data Ascii: families=Amatic%20SC%2CCaveat%2CComfortaa%2CEB%20Garamond%2CLexend%2CLobster%2CLora%2CMerriweather%2CMontserrat%2CNunito%2COswald%2CPacifico%2CPlayfair%20Display%2CRoboto%2CRoboto%20Mono%2CRoboto%20Serif%2CSpectral&useAllSubsets=true&format=woff2
2024-03-28 15:24:32 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:32 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:32 UTC	580	IN	Data Raw: 37 30 30 36 0d 0a 29 5d 7d 27 0a 7b 22 66 6f 6e 74 4d 65 74 61 64 61 74 61 4d 61 70 22 3a 7b 22 43 61 76 65 61 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 66 6f 6e 74 46 61 63 65 73 22 3a 5b 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c Data Ascii: 7006)]}'{"fontMetadataMap":{"Caveat":{"documentFont":false,"fontFaces":[{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 52 65 67 75 6c 61 72 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 Data Ascii: amily":"Caveat Regular"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAsc
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 Data Ascii: lse,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/W
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 63 42 39 53 49 63 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 41 4c 4c 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 2a 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 Data Ascii: se,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjcB9SIc.woff2"}],"style":"normal","subset":"ALL","subsetValue":"*","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STy
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 Data Ascii: ubsetValue":"cyrillic-ext","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap"
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 Data Ascii: ,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"u
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 53 78 36 65 49 69 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 5f 45 58 54 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 Data Ascii: amily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjSx6eIipYQ.woff2"}],"style":"normal","subset":"CYRILLIC_EXT","subsetValue":"cyrillic-ext","weight":600,"weigh
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 4c 41 54 49 4e 5f 45 58 54 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 53 65 6d 69 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c Data Ascii: off2"}],"style":"normal","subset":"LATIN_EXT","subsetValue":"latin-ext","weight":600,"weightedFontFamily":"Caveat SemiBold"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":fal
2024-03-28 15:24:32 UTC	1252	IN	Data Raw: 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 36 30 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f Data Ascii: ,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":160,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"fo

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:31 UTC	541	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://docs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-28 15:24:32 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Mar 2024 15:24:32 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:32 UTC	1033	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 2558 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2024-03-28 15:24:32 UTC	2558	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 31 31 36 33 39 34 37 31 30 31 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 31 37 31 31 36 33 39 34 37 31 30 31 35 30 30 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 31 37 31 31 36 33 39 34 37 31 30 31 35 30 30 30 5d 2c 6e 75 6c 6c 2c 31 5d 2c 6e 75 6c 6c 2c 37 31 36 2c 6e 75 6c 6c 2c 31 2c 31 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,null,[1,0,0,0,0]]],2035,[["1711639471016",null,null,null,null,null,null,"[[[null,null,1,1711639471015000,null,null,null,[[1711639471015000],null,1],null,716,null,1,1
2024-03-28 15:24:32 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k; expires=Fri, 27-Sep-2024 15:24:32 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Mar 2024 15:24:32 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 28 Mar 2024 15:24:32 GMT Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:32 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-03-28 15:24:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:33 UTC	672	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:33 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Thu, 28 Mar 2024 15:24:33 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-28 15:24:33 UTC	982	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-03-28 15:24:33 UTC	573	IN	Data Raw: 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d Data Ascii: der-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 15:24:33 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=229136 Date: Thu, 28 Mar 2024 15:24:33 GMT Connection: close X-CID: 2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://forms.gle/uegGMX3eHYKZmZss5

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Windows Analysis Report
https://forms.gle/uegGMX3eHYKZmZss5

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-28 15:24:34 UTC	774	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=229115 Date: Thu, 28 Mar 2024 15:24:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-28 15:24:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:34 UTC	1429	OUT	POST /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 8652 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:34 UTC	8652	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 34 31 25 32 43 6e 75 6c 6c 25 32 43 32 25 32 43 31 37 31 31 36 33 39 34 37 31 30 37 39 30 30 30 25 32 43 25 35 42 25 35 42 25 35 42 31 32 38 30 25 32 43 39 30 37 25 32 43 31 32 38 30 25 32 43 39 38 34 25 35 44 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 66 61 6c 73 65 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 66 61 6c 73 65 25 32 43 74 72 75 65 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c Data Ascii: impressionBatch=%5B%5B%5B41%2Cnull%2C2%2C1711639471079000%2C%5B%5B%5B1280%2C907%2C1280%2C984%5D%2Cfalse%2Cnull%2Cnull%2C1%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cfalse%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5Bfalse%2Ctrue%5D%2Cnull%2Cnull
2024-03-28 15:24:35 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:35 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-4EgGdooxPovks4sLY1j7_w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:34 UTC	1045	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 6286 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:34 UTC	6286	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 31 31 36 33 39 34 37 34 30 32 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],2035,[["1711639474020",null,null,null
2024-03-28 15:24:34 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Mar 2024 15:24:34 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:34 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-03-28 15:24:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:41 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=LmZ8tPpHRSf6xbp&MD=vYUzOsaG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-03-28 15:24:41 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: bc98e29d-d9ee-4fd0-82ed-75f2b177b6bd MS-RequestId: fef48892-4f84-4e4a-a778-8aa0564260aa MS-CV: fXABiMjNKEmHHq7F.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Mar 2024 15:24:40 GMT Connection: close Content-Length: 24490
2024-03-28 15:24:41 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-03-28 15:24:41 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:52 UTC	1045	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 2911 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:52 UTC	2911	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 31 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 31 31 36 33 39 34 39 31 39 34 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,1,0,0,0]]],2035,[["1711639491948",null,null,null
2024-03-28 15:24:52 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Mar 2024 15:24:52 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:52 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-03-28 15:24:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:52 UTC	1632	OUT	POST /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/formResponse HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 200 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://docs.google.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/viewform?fbzx=5249834211992654252 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:52 UTC	200	OUT	Data Raw: 65 6e 74 72 79 2e 31 35 37 38 39 33 39 36 31 39 3d 43 6f 6e 6a 6f 69 6e 74 25 32 38 65 25 32 39 26 65 6e 74 72 79 2e 31 35 37 38 39 33 39 36 31 39 5f 73 65 6e 74 69 6e 65 6c 3d 26 66 76 76 3d 31 26 70 61 72 74 69 61 6c 52 65 73 70 6f 6e 73 65 3d 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 32 32 35 32 34 39 38 33 34 32 31 31 39 39 32 36 35 34 32 35 32 25 32 32 25 35 44 26 70 61 67 65 48 69 73 74 6f 72 79 3d 30 26 66 62 7a 78 3d 35 32 34 39 38 33 34 32 31 31 39 39 32 36 35 34 32 35 32 26 73 75 62 6d 69 73 73 69 6f 6e 54 69 6d 65 73 74 61 6d 70 3d 2d 31 26 63 6f 6e 74 69 6e 75 65 3d 31 Data Ascii: entry.1578939619=Conjoint%28e%29&entry.1578939619_sentinel=&fvv=1&partialResponse=%5Bnull%2Cnull%2C%225249834211992654252%22%5D&pageHistory=0&fbzx=5249834211992654252&submissionTimestamp=-1&continue=1
2024-03-28 15:24:53 UTC	2119	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noindex, nofollow, nosnippet Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:53 GMT Content-Security-Policy-Report-Only: report-uri https://csp.withgoogle.com/csp/forms/prod;frame-ancestors 'none' Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-IoZ_2u4R5WK6i7Q9rnBrkA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Reporting-Endpoints: default="/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/web-reports?context=eJwNy1lIVHEYxuGv73wns2kxBSMLQaloQdsX0Bmd5YyjbWbZX6GiqIloGUvFyhZDKKlo01wiYhq6iAzJgogiwZaJNIIo2qFFpNSkGnVytBp7L56r3_uO7IgIkiLvCEUNJkX9oxVdjlIUH63IH6soabyi0imKZiYpqkxWVDBfUYVNUR28MBS1wZuNir5B5GZFE6BvpyLxKFpUqCgDDhUrOgVbShWVwNvDijrAcwQNFp9U5IJ3ZxR1Qm61IjeE6xSNOa-o8IKicjgKNZDwWNEcaHmOD3T1KRqEkiA20Dgxj5ohMj6PJkAGKLi6Po_uAJXkURT8nv6dwzC0NsAR6wJs2RpgJzQ8DPAtqK3sYS8Mq-vhSPj5pYf7IXdpL6-D7txe7oPdZb28D4aSgxwxK8gNs4N8C7TyIJsgsL2fB0A3h3g0tEM3FFlDvB_a3CHugrLjIa6AcMsAD28d4BPRg1wF8b5Bngq_5v3lEJgO_uMYaM4J8xMYSUMcDe2ThrgbrFGkZUKzh7QnsLKdtHzYUsSaB2b4WZsLV56xdh2OfWbtLOzRNK0MJlVo2mTY0KppW-H12BT5CJ1lKRKAM50pUgdVwRS5AK5zqZIN72tTpQ0iG1JlHIRsZiG7WapvmuUiTIuzyGyYOs8iyTDGbZFYyNLTJAcs1jRxQnJ-miyE5S1psgaatqWLH7rq06UHjr1Kl7NwyGWVo3Cn1ir3IbbKJvGw-ppN1sLTBzZ5CSctdqmGq7vscgNWlNhFQVOpXfwwo9Euc2HHK7sUw2CCQzjRIeYTDjEgo9khK-Ded4c8gpu6IXchfZwh2fAjwZAw-Hcb8gzivIYkwvMmQ95Cx1dDfkHCXqfMgYpKp5wG--kMWQJJl1yyAN68cMknMMVkSgz07suUP3BPz5JHkBqRJQ4wVnn1ZTCl3KsnQfFtr34Ang7z6R_g7iaf3gor3_n0fIh779MTIdo0wl9b0zg8qqO-LSZulLOgcGeOu2hXgafI_R-gV2g0" Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 48 42 31 65 43 64 2d 55 4d 72 6e 6d 62 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 64 6f 63 73 2f 73 70 72 65 61 64 73 68 65 65 74 73 2f 66 6f 72 6d 73 2f 66 61 76 69 63 6f 6e 5f 71 70 32 2e 70 6e 67 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 69 63 6f 6e 3f 66 61 6d 69 6c 79 3d 4d 61 74 65 72 69 61 6c 2b 49 63 6f 6e 73 2b 45 78 74 65 6e 64 65 64 22 20 72 Data Ascii: 8000<!DOCTYPE html><html lang="en" class="HB1eCd-UMrnmb"><head><link rel="shortcut icon" sizes="16x16" href="https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png"><link href="https://fonts.googleapis.com/icon?family=Material+Icons+Extended" r
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 49 6f 5a 5f 32 75 34 52 35 57 4b 36 69 37 51 39 72 6e 42 72 6b 41 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 53 70 61 54 34 65 22 3a 22 65 64 69 74 6f 72 73 22 2c 22 54 53 44 74 56 22 3a 22 25 2e 40 2e 5d 22 2c 22 65 4e 6e 6b 77 66 22 3a 22 31 37 31 31 36 33 39 34 37 32 22 2c 22 6e 51 79 41 45 22 3a 7b 7d 2c 22 Data Ascii: tent="width=device-width, initial-scale=1"><meta name="referrer" content="strict-origin-when-cross-origin"><script data-id="_gd" nonce="IoZ_2u4R5WK6i7Q9rnBrkA">window.WIZ_global_data = {"SpaT4e":"editors","TSDtV":"%.@.]","eNnkwf":"1711639472","nQyAE":{},"
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 20 63 69 72 63 6c 65 20 66 61 72 74 68 65 73 74 2d 73 69 64 65 2c 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 2e 31 35 29 2c 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 2e 31 35 29 20 38 30 25 2c 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 29 20 31 30 30 25 20 29 3b 7d 2e 54 46 42 6e 56 65 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 54 46 42 6e 56 65 2e 52 44 50 5a 45 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 61 28 31 30 33 2c 20 35 38 2c 20 31 38 33 2c 20 30 2e 35 29 3b 7d 2e 54 46 42 6e 56 65 2e 75 33 62 57 34 65 20 2e 43 65 6f 52 59 63 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 Data Ascii: age: radial-gradient( circle farthest-side,rgba(103, 58, 183, 0.15),rgba(103, 58, 183, 0.15) 80%,rgba(103, 58, 183, 0) 100% );}.TFBnVe {color: rgb(103, 58, 183);}.TFBnVe.RDPZE {color: rgba(103, 58, 183, 0.5);}.TFBnVe.u3bW4e .CeoRYc {background-color: rgba
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 6f 72 3a 20 23 33 43 34 30 34 33 3b 7d 2e 49 71 32 78 50 62 20 2e 6b 61 41 74 32 2e 4b 4b 6a 76 58 62 20 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 49 71 32 78 50 62 20 2e 6b 61 41 74 32 2e 52 44 50 5a 45 20 20 7b 63 6f 6c 6f 72 3a 20 23 37 30 37 35 37 61 3b 20 63 75 72 73 6f 72 3a 20 64 65 66 61 75 6c 74 3b 7d 2e 49 71 32 78 50 62 20 2e 52 44 50 5a 45 20 2b 20 2e 73 37 62 49 63 66 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 37 30 37 35 37 61 3b 7d 2e 49 71 32 78 50 62 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 20 63 69 72 63 6c 65 20 66 61 72 74 68 65 73 74 2d 73 69 64 65 2c 72 67 62 61 28 31 30 33 2c 20 Data Ascii: or: #3C4043;}.Iq2xPb .kaAt2.KKjvXb {color: rgb(103, 58, 183);}.Iq2xPb .kaAt2.RDPZE {color: #70757a; cursor: default;}.Iq2xPb .RDPZE + .s7bIcf {background-color: #70757a;}.Iq2xPb .MbhUzd {background-image: radial-gradient( circle farthest-side,rgba(103,
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 7b 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 77 68 69 74 65 3b 7d 2e 49 73 7a 42 52 63 2d 47 75 69 65 76 64 2d 48 4c 76 6c 76 64 20 2e 62 61 72 45 54 64 20 7b 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 62 6c 61 63 6b 3b 7d 2e 49 4f 6e 63 50 20 2e 48 76 4f 70 72 66 20 7b 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 49 4f 6e 63 50 20 2e 48 76 4f 70 72 66 20 2e 43 65 6f 52 59 63 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 30 33 2c 20 35 38 2c 20 31 38 33 29 3b 7d 2e 49 4f 6e 63 50 20 2e 48 76 4f 70 72 66 20 2e 4d 62 68 55 7a 64 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 20 63 69 72 63 6c 65 20 66 61 72 74 Data Ascii: {border: 2px solid white;}.IszBRc-Guievd-HLvlvd .barETd {border: 2px solid black;}.IOncP .HvOprf {color: rgb(103, 58, 183);}.IOncP .HvOprf .CeoRYc {background-color: rgb(103, 58, 183);}.IOncP .HvOprf .MbhUzd {background-image: radial-gradient( circle fart
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 2e 4c 67 4e 63 51 65 2c 20 2e 4c 67 4e 63 51 65 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4c 67 4e 63 51 65 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4c 67 4e 63 51 65 20 2e 50 79 72 42 34 2c 20 2e 4c 67 4e 63 51 65 20 2e 73 6e 42 79 61 63 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 64 6f 63 73 2d 52 6f 62 6f 74 6f 27 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 7d 2e 4d 37 65 4d 65 2c 20 2e 4d 37 65 4d 65 20 2e 57 69 63 30 33 63 20 2e 74 4c 39 51 34 63 2c 20 2e 4d 37 65 4d 65 20 2e 49 39 4f 4a 48 65 20 2e 4b 52 6f 71 52 63 2c 20 2e 4d 37 65 4d 65 20 2e 50 79 72 42 34 2c 20 Data Ascii: .LgNcQe, .LgNcQe .Wic03c .tL9Q4c, .LgNcQe .I9OJHe .KRoqRc, .LgNcQe .PyrB4, .LgNcQe .snByac {font-size: 24pt;font-family: 'docs-Roboto', Helvetica, Arial, sans-serif;letter-spacing: 0;}.M7eMe, .M7eMe .Wic03c .tL9Q4c, .M7eMe .I9OJHe .KRoqRc, .M7eMe .PyrB4,
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 64 6f 63 73 2d 65 70 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 72 64 64 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 64 73 65 64 77 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 6d 73 65 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 73 64 6f 64 77 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 73 69 64 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 73 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 73 70 64 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 73 66 64 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 74 73 73 77 6d 22 3a 66 61 6c 73 65 2c 22 64 6f 63 73 2d 65 75 64 64 77 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 65 64 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 69 70 64 77 6d 22 3a 74 72 75 65 2c 22 64 6f 63 73 2d 65 6f Data Ascii: docs-epdwm":false,"docs-erddm":true,"docs-edsedw":false,"docs-emsedwm":false,"docs-esdodwm":true,"docs-esidm":true,"docs-esdwm":false,"docs-espdwm":false,"docs-esfdm":true,"docs-etsswm":false,"docs-euddwm":true,"docs-eedm":true,"docs-eipdwm":true,"docs-eo
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 31 39 32 34 32 31 39 2c 37 31 39 36 30 30 30 34 2c 37 31 39 36 30 33 38 38 2c 39 34 33 32 37 36 32 39 2c 39 34 33 33 39 36 32 39 2c 39 34 33 35 33 32 37 36 2c 39 34 34 33 37 38 35 31 2c 39 34 34 36 32 39 32 32 2c 39 34 34 39 33 30 31 37 2c 39 34 34 39 33 32 31 38 5d 2c 22 63 72 63 22 3a 31 2c 22 63 76 69 22 3a 5b 33 33 30 30 31 30 37 2c 33 33 30 30 31 33 34 2c 33 33 31 33 33 32 31 2c 33 33 32 31 39 31 30 2c 33 33 33 30 31 39 37 2c 33 33 36 31 39 31 30 2c 33 33 36 32 38 32 31 2c 33 33 36 36 36 32 30 2c 33 33 36 38 32 30 39 2c 33 33 36 38 32 34 39 2c 33 33 36 39 31 35 39 2c 33 33 36 39 33 35 33 2c 33 33 36 39 34 33 36 2c 33 33 36 39 38 30 33 2c 33 33 36 39 38 34 34 2c 33 33 36 39 38 36 36 2c 33 33 37 30 30 32 33 2c 34 35 34 32 34 37 36 31 5d 7d 2c 22 64 6f Data Ascii: 1924219,71960004,71960388,94327629,94339629,94353276,94437851,94462922,94493017,94493218],"crc":1,"cvi":[3300107,3300134,3313321,3321910,3330197,3361910,3362821,3366620,3368209,3368249,3369159,3369353,3369436,3369803,3369844,3369866,3370023,45424761]},"do
2024-03-28 15:24:53 UTC	2119	IN	Data Raw: 72 31 58 30 6b 4c 55 6b 70 73 50 31 39 30 53 61 52 6a 4e 52 6a 77 22 2c 22 54 34 76 67 71 71 6a 4b 37 30 6b 4c 55 6b 70 73 50 31 39 30 53 63 50 65 68 67 41 57 22 2c 22 4a 79 46 52 32 74 59 57 5a 30 6b 4c 55 6b 70 73 50 31 39 30 52 6e 33 48 7a 6b 78 54 22 2c 22 75 66 58 6a 37 76 6d 65 4a 30 6b 4c 55 6b 70 73 50 31 39 30 51 55 52 68 76 4a 6e 32 22 2c 22 4b 46 6b 73 37 55 65 5a 33 30 6b 4c 55 6b 70 73 50 31 39 30 55 55 4d 52 36 63 76 68 22 2c 22 4c 63 54 61 36 45 6a 65 43 30 6b 4c 55 6b 70 73 50 31 39 30 52 4b 67 76 57 35 71 69 22 2c 22 73 33 55 46 63 6a 47 6a 74 30 6b 4c 55 6b 70 73 50 31 39 30 5a 34 35 66 74 57 52 72 22 2c 22 6f 39 39 65 77 42 51 58 79 30 6b 4c 55 6b 70 73 50 31 39 30 4e 71 32 71 72 36 74 66 22 2c 22 50 48 56 79 79 35 75 53 53 30 6b 4c 55 Data Ascii: r1X0kLUkpsP190SaRjNRjw","T4vgqqjK70kLUkpsP190ScPehgAW","JyFR2tYWZ0kLUkpsP190Rn3HzkxT","ufXj7vmeJ0kLUkpsP190QURhvJn2","KFks7UeZ30kLUkpsP190UUMR6cvh","LcTa6EjeC0kLUkpsP190RKgvW5qi","s3UFcjGjt0kLUkpsP190Z45ftWRr","o99ewBQXy0kLUkpsP190Nq2qr6tf","PHVyy5uSS0kLU

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:54 UTC	1433	OUT	POST /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/naLogImpressions HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 3310 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/formResponse Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:54 UTC	3310	OUT	Data Raw: 69 6d 70 72 65 73 73 69 6f 6e 42 61 74 63 68 3d 25 35 42 25 35 42 25 35 42 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 37 31 31 36 33 39 34 39 34 30 38 35 30 30 30 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 6e 75 6c 6c 25 32 43 25 35 42 25 35 42 31 37 31 31 36 33 39 34 39 34 30 38 35 30 30 30 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 31 25 35 44 25 32 43 6e 75 6c 6c 25 32 43 37 31 36 25 32 43 6e 75 6c 6c 25 32 43 31 25 32 43 31 25 35 44 25 35 44 25 32 43 25 35 42 25 32 32 43 4d 4f 50 33 50 2d 68 6c 34 55 44 46 65 49 71 71 51 45 64 55 74 45 4d 65 77 25 32 32 25 32 43 31 37 31 31 36 33 39 34 39 34 30 38 34 30 30 30 25 32 43 31 37 31 31 36 33 39 34 39 33 30 31 39 36 39 31 25 32 43 25 32 32 41 44 46 4e 2d 63 76 71 51 46 49 75 2d 6c 6b 4f 67 Data Ascii: impressionBatch=%5B%5B%5Bnull%2Cnull%2C1%2C1711639494085000%2Cnull%2Cnull%2Cnull%2C%5B%5B1711639494085000%5D%2Cnull%2C1%5D%2Cnull%2C716%2Cnull%2C1%2C1%5D%5D%2C%5B%22CMOP3P-hl4UDFeIqqQEdUtEMew%22%2C1711639494084000%2C1711639493019691%2C%22ADFN-cvqQFIu-lkOg
2024-03-28 15:24:54 UTC	616	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:54 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-F79UO-wDaBbgqp2pgVBmGw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:54 UTC	1432	OUT	POST /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive Content-Length: 246 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Same-Domain: 1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/formResponse Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:54 UTC	246	OUT	Data Raw: 66 61 6d 69 6c 69 65 73 3d 41 6d 61 74 69 63 25 32 30 53 43 25 32 43 43 61 76 65 61 74 25 32 43 43 6f 6d 66 6f 72 74 61 61 25 32 43 45 42 25 32 30 47 61 72 61 6d 6f 6e 64 25 32 43 4c 65 78 65 6e 64 25 32 43 4c 6f 62 73 74 65 72 25 32 43 4c 6f 72 61 25 32 43 4d 65 72 72 69 77 65 61 74 68 65 72 25 32 43 4d 6f 6e 74 73 65 72 72 61 74 25 32 43 4e 75 6e 69 74 6f 25 32 43 4f 73 77 61 6c 64 25 32 43 50 61 63 69 66 69 63 6f 25 32 43 50 6c 61 79 66 61 69 72 25 32 30 44 69 73 70 6c 61 79 25 32 43 52 6f 62 6f 74 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 4d 6f 6e 6f 25 32 43 52 6f 62 6f 74 6f 25 32 30 53 65 72 69 66 25 32 43 53 70 65 63 74 72 61 6c 26 75 73 65 41 6c 6c 53 75 62 73 65 74 73 3d 74 72 75 65 26 66 6f 72 6d 61 74 3d 77 6f 66 66 32 Data Ascii: families=Amatic%20SC%2CCaveat%2CComfortaa%2CEB%20Garamond%2CLexend%2CLobster%2CLora%2CMerriweather%2CMontserrat%2CNunito%2COswald%2CPacifico%2CPlayfair%20Display%2CRoboto%2CRoboto%20Mono%2CRoboto%20Serif%2CSpectral&useAllSubsets=true&format=woff2
2024-03-28 15:24:55 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:55 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:55 UTC	580	IN	Data Raw: 37 30 30 36 0d 0a 29 5d 7d 27 0a 7b 22 66 6f 6e 74 4d 65 74 61 64 61 74 61 4d 61 70 22 3a 7b 22 43 61 76 65 61 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 66 6f 6e 74 46 61 63 65 73 22 3a 5b 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c Data Ascii: 7006)]}'{"fontMetadataMap":{"Caveat":{"documentFont":false,"fontFaces":[{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 52 65 67 75 6c 61 72 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 Data Ascii: amily":"Caveat Regular"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAsc
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 Data Ascii: lse,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/W
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 63 42 39 53 49 63 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 41 4c 4c 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 2a 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 Data Ascii: se,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjcB9SIc.woff2"}],"style":"normal","subset":"ALL","subsetValue":"*","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STy
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 35 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 4d 65 64 69 75 6d 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 Data Ascii: ubsetValue":"cyrillic-ext","weight":500,"weightedFontFamily":"Caveat Medium"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap"
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 39 32 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 Data Ascii: ,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":192,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"u
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f 72 6d 61 74 22 3a 22 77 6f 66 66 32 22 2c 22 69 73 4c 6f 63 61 6c 22 3a 66 61 6c 73 65 2c 22 75 72 6c 22 3a 22 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 63 61 76 65 61 74 2f 76 31 38 2f 57 6e 7a 6e 48 41 63 35 62 41 66 59 42 32 51 52 61 68 37 70 63 70 4e 76 4f 78 2d 70 6a 53 78 36 65 49 69 70 59 51 2e 77 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 43 59 52 49 4c 4c 49 43 5f 45 58 54 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 63 79 72 69 6c 6c 69 63 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 Data Ascii: amily":"Caveat","menuFont":false,"sources":[{"format":"woff2","isLocal":false,"url":"//fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjSx6eIipYQ.woff2"}],"style":"normal","subset":"CYRILLIC_EXT","subsetValue":"cyrillic-ext","weight":600,"weigh
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 6f 66 66 32 22 7d 5d 2c 22 73 74 79 6c 65 22 3a 22 6e 6f 72 6d 61 6c 22 2c 22 73 75 62 73 65 74 22 3a 22 4c 41 54 49 4e 5f 45 58 54 22 2c 22 73 75 62 73 65 74 56 61 6c 75 65 22 3a 22 6c 61 74 69 6e 2d 65 78 74 22 2c 22 77 65 69 67 68 74 22 3a 36 30 30 2c 22 77 65 69 67 68 74 65 64 46 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 20 53 65 6d 69 42 6f 6c 64 22 7d 2c 7b 22 66 6f 6e 74 44 72 61 77 53 69 7a 65 22 3a 7b 22 53 54 79 70 6f 41 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 53 54 79 70 6f 44 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c Data Ascii: off2"}],"style":"normal","subset":"LATIN_EXT","subsetValue":"latin-ext","weight":600,"weightedFontFamily":"Caveat SemiBold"},{"fontDrawSize":{"STypoAscender":960,"STypoDescender":-300,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":fal
2024-03-28 15:24:55 UTC	1252	IN	Data Raw: 2c 22 53 54 79 70 6f 4c 69 6e 65 47 61 70 22 3a 30 2c 22 61 73 63 65 6e 64 65 72 22 3a 39 36 30 2c 22 63 6d 61 70 46 6f 72 6d 61 74 32 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 70 6f 69 6e 74 34 65 30 30 22 3a 66 61 6c 73 65 2c 22 64 65 73 63 65 6e 64 65 72 22 3a 2d 33 30 30 2c 22 66 73 53 65 6c 65 63 74 69 6f 6e 22 3a 31 36 30 2c 22 6c 69 6e 65 47 61 70 22 3a 30 2c 22 75 6c 43 6f 64 65 50 61 67 65 52 61 6e 67 65 31 22 3a 31 35 31 2c 22 75 6e 69 74 73 50 65 72 45 6d 22 3a 31 30 30 30 2c 22 75 73 57 69 6e 41 73 63 65 6e 74 22 3a 39 37 34 2c 22 75 73 57 69 6e 44 65 73 63 65 6e 74 22 3a 33 31 35 7d 2c 22 66 6f 6e 74 46 61 6d 69 6c 79 22 3a 22 43 61 76 65 61 74 22 2c 22 6d 65 6e 75 46 6f 6e 74 22 3a 66 61 6c 73 65 2c 22 73 6f 75 72 63 65 73 22 3a 5b 7b 22 66 6f Data Ascii: ,"STypoLineGap":0,"ascender":960,"cmapFormat2":false,"codepoint4e00":false,"descender":-300,"fsSelection":160,"lineGap":0,"ulCodePageRange1":151,"unitsPerEm":1000,"usWinAscent":974,"usWinDescent":315},"fontFamily":"Caveat","menuFont":false,"sources":[{"fo

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:55 UTC	981	OUT	GET /forms/d/e/1FAIpQLSfjStKBev-KZoDUt77zXrQzLhhnzBWfQE4iQVduo99aAn6DMQ/font/getmetadata HTTP/1.1 Host: docs.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: S=spreadsheet_forms=SdjUfKMLoBANZN7vBM8COU3_R7cOlK3tdZxRE8Bho5U; COMPASS=spreadsheet_forms=CjIACWuJV-5e2QvTa1pXONYZlHsYTzXtpxpnOyuXdgB0IeZxLuxCk0ScE6zCRnU6EqfpNhC8s5awBhpDAAlriVe78DBGIvuuCzitMpZEuNVoWOlEksuTb28O_sRjp4R5XQkxFT9jt3XSfAgttTWOwphhVJoZj4_AX7Dm_4b8ig==; NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:56 UTC	903	IN	HTTP/1.1 400 Bad Request Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 28 Mar 2024 15:24:56 GMT Content-Type: text/html; charset=utf-8 x-chromium-appcache-fallback-override: disallow-fallback Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt Content-Security-Policy: base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-mRL5W0m66PqieWq-y4mw3A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:56 UTC	349	IN	Data Raw: 62 64 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 62 20 77 6f 72 64 20 70 72 6f 63 65 73 73 69 6e 67 2c 20 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 20 61 6e 64 20 73 70 72 65 61 64 73 68 65 65 74 73 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c Data Ascii: bdb<!DOCTYPE html><html lang="en"><head><meta name="description" content="Web word processing, presentations and spreadsheets"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=0"><
2024-03-28 15:24:56 UTC	1252	IN	Data Raw: 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 72 6f 64 75 63 74 2b 53 61 6e 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 72 72 79 4c 54 7a 47 53 61 39 63 5f 69 5f 70 6a 30 4a 57 4c 4e 77 22 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 72 79 4c 54 7a 47 53 61 39 63 5f 69 5f 70 6a 30 4a 57 4c 4e 77 22 3e 2e 67 6f 6f 67 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 Data Ascii: ta name="referrer" content="strict-origin-when-cross-origin"><link href="//fonts.googleapis.com/css?family=Product+Sans" rel="stylesheet" type="text/css" nonce="rryLTzGSa9c_i_pj0JWLNw"><style nonce="rryLTzGSa9c_i_pj0JWLNw">.goog-inline-block{position:rela
2024-03-28 15:24:56 UTC	1252	IN	Data Raw: 39 63 5f 69 5f 70 6a 30 4a 57 4c 4e 77 22 3e 62 6f 64 79 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 7d 61 2c 20 61 3a 6c 69 6e 6b 2c 20 61 3a 76 69 73 69 74 65 64 20 7b 63 6f 6c 6f 72 3a 20 23 31 31 32 41 42 42 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 72 72 79 4c 54 7a 47 53 61 39 63 5f 69 5f 70 6a 30 4a 57 4c 4e 77 22 3e 2e 65 72 72 6f 72 4d 65 73 73 61 67 65 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 74 3b 20 66 6f 6e 74 2d 77 65 Data Ascii: 9c_i_pj0JWLNw">body {background-color: #fff; font-family: Arial,sans-serif; font-size: 13px; margin: 0; padding: 0;}a, a:link, a:visited {color: #112ABB;}</style><style type="text/css" nonce="rryLTzGSa9c_i_pj0JWLNw">.errorMessage {font-size: 12pt; font-we
2024-03-28 15:24:56 UTC	189	IN	Data Raw: 3a 20 61 75 74 6f 3b 7d 23 6f 75 74 65 72 43 6f 6e 74 61 69 6e 65 72 20 7b 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 20 6d 61 78 2d 77 69 64 74 68 3a 20 37 35 30 70 78 3b 7d 23 69 6e 6e 65 72 43 6f 6e 74 61 69 6e 65 72 20 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 30 70 78 3b 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 34 30 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: : auto;}#outerContainer {margin: auto; max-width: 750px;}#innerContainer {margin-bottom: 20px; margin-left: 40px; margin-right: 40px; margin-top: 80px; position: relative;}</style></html>
2024-03-28 15:24:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-03-28 15:24:57 UTC	1045	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 6476 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://docs.google.com X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=512=NcKYKm1mTH-17shAU6IUwPBvcu4SJ9PRrn7gtvqcLKFw4nCkARpq43JiUhmJc2XW_11nOTjEzrF0lR9jYiIAJV8zbptaF7aBNgIVFQDiSh0xR_gm195kdxch7mrYHb8dYbi3BHVj3Y-bmZwgaPNpBWkYfeFhYUSkv8ZqTB_ZHc1xbQOPt9bXE6k
2024-03-28 15:24:57 UTC	6476	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 32 30 33 35 2c 5b 5b 22 31 37 31 31 36 33 39 34 39 37 30 38 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],2035,[["1711639497089",null,null,null
2024-03-28 15:24:58 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://docs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Thu, 28 Mar 2024 15:24:58 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-28 15:24:58 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-03-28 15:24:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0