24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T433,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 4e3118b09842… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 4e3118b09842…. Threat score 0/100. 0/6 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4e3118b09842a67d5f3fbbd7524a605334908be127755628bb1dd7afcec4d517","keywords":["malware analysis","sandbox report","threat intelligence","4e3118b09842a67d5f3fbbd7524a605334908be127755628bb1dd7afcec4d517"],"about":{"@type":"SoftwareApplication","name":"https://script.google.com/macros/s/AKfycby6XCGNYgL2NBcedM4O1DpiKjtwwD9PNGKWdi9IWXmOPnJcct5h0KlFmFiZrcBZeZhr/exec","applicationCategory":["url"],"identifier":"4e3118b09842a67d5f3fbbd7524a605334908be127755628bb1dd7afcec4d517"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":6},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T42e,Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6300:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:6300:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5312:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5312:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:5312:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:5312:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7708:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7708:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\mfx_d3d_mutex" Process chrome.exe created mutex with name "Local\SM0:7708:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:7708:304:WilStaging_02" Process chrome.exe created mutex with name "mfx_d3d_mutex"26:T1b7f,"GET /async/newtab_promos HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:52 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 994176668 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>C28708C280295D7D270A7B22757064617465223A7B7D7D03....... "GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Tue 06 Oct 2026 23:54:52 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 994176668 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/ddljson?async=ntp:2 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:52 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 994176668 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Client-Data: CImAywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/javascript; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:52 GMT Server: gws Expires: -1 Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Pragma: no-cache Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-2tWjEBq3DGXyORQeEV60NA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Cache-Control: no-cache must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 X-Client-Data: CImAywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:52 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 994176668 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /jsapi HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Browser-Year: 2026 Sec-Fetch-Storage-Access: active Referer: https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: NID=CugBCAESmgEBOxGDSD1QoqCAFJSpZ-FiSZEbkPqm1Kj1W0A-0bWgsfPgMMdkvNPI3Nq4fNsuBWt1Wijiw00nEec4FfTQ6DWqlEMczg-9lmS_H2vKY4Q8NXEZcIQlqPDLEjkwB7JCt7Q7jLV_8jMjGDbjz3lnmq1O76x32L2RT8rAFZq96DQX7oP1-5EgxtvvSR1eoUMNMdpJxtPOOCP8yQQjKAEyRQHSrAfPbLGNTr6UKKoIk8CQ2Hv3hz217RMrdj_Fr1p3SSLv6BRO1Iz0RA04i_rye436lzpkF7y43vXr49eCrRnhuhsfAw X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=1 Accept: */* X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CImAywE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: script" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Tue 06 Oct 2026 23:28:40 GMT Server: sffe Expires: Tue 06 Oct 2026 23:58:40 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 Location: https://www.gstatic.com/charts/loader.js Cache-Control: public max-age=1800 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 1575 with no response body27:T181d,"POST /csp/proto/26981ed0d57bbad37e728ff58134270c HTTP/2 Host: csp.withgoogle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://script.google.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Origin: https://script.google.com Priority: u=4, i Accept: */* Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"origin":"https://script.google.com","type":"HEARTBEAT"}" HTTP/2 204 No Content Content-Type: text/html; charset=utf-8 Date: Tue, 06 Oct 2026 23:54:54 GMT Server: ESF Expires: Mon, 01 Jan 1990 00:00:00 GMT X-Frame-Options: SAMEORIGIN Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://script.google.com Reporting-Endpoints: default="/csp/_/CspCollectorHttp/web-reports?context=eJzj4tDikmJw0JBiEOLhODdl2jU2gRWzzjYyKekl5RfGF6cmlxZlllTqJhcX6Cbn5-SkJpfkF-lmlJQUxBsZGJkZGhiY6hmYxBcYAAAa-Ba8" Content-Security-Policy: require-trusted-types-for 'script';report-uri /csp/_/CspCollectorHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Cache-Control: no-cache, no-store, max-age=0, must-revalidate Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 with no response body, "POST /csp/proto/26981ed0d57bbad37e728ff58134270c HTTP/2 Host: csp.withgoogle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Origin: https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com Priority: u=4 i Accept: */* Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty" with payload::==> "{"origin":"https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com" "type":"HEARTBEAT"}" HTTP/2 204 No Content Content-Type: text/html; charset=utf-8 Date: Tue, 06 Oct 2026 23:54:55 GMT Server: ESF Expires: Mon, 01 Jan 1990 00:00:00 GMT X-Frame-Options: SAMEORIGIN Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com Reporting-Endpoints: default="/csp/_/CspCollectorHttp/web-reports?context=eJzj4tDikmJw0ZBiEOLhOD9l2jU2gQNLm-8yKekl5RfGF6cmlxZlllTqJhcX6Cbn5-SkJpfkF-lmlJQUxBsZGJkZGhiY6hmYxBcYAAAmqRb2" Content-Security-Policy: require-trusted-types-for 'script';report-uri /csp/_/CspCollectorHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Cache-Control: no-cache, no-store, max-age=0, must-revalidate Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 with no response body, "POST /csp/report-to/maestro HTTP/2 Host: csp.withgoogle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/reports+json Accept-Language: en-US en;q=0.9 Origin: https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com Priority: u=4 i Accept-Encoding: gzip deflate br zstd" with payload::==> "[{"age":59591 "body":{"blockedURL":"https://www.google.com/jsapi" "destination":"script" "disposition":"reporting" "type":"corp"} "type":"coep" "url":"https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com/blank" "user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"}]" HTTP/2 204 No Content Content-Type: text/html; charset=utf-8 Date: Tue, 06 Oct 2026 23:55:55 GMT Server: ESF Expires: Mon, 01 Jan 1990 00:00:00 GMT X-Frame-Options: SAMEORIGIN Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com Reporting-Endpoints: default="/csp/_/CspCollectorHttp/web-reports?context=eJzj4tDikmII1JBiEOLh6J467RqbwIaHNzcyKekl5RfGF6cmlxZlllTqJhcX6Cbn5-SkJpfkF-lmlJQUxBsZGJkZGhiY6hmYxBcYAAAr-xcW" Content-Security-Policy: require-trusted-types-for 'script';report-uri /csp/_/CspCollectorHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Cache-Control: no-cache, no-store, max-age=0, must-revalidate Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 with no response body28:T716,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 41:A1:6F:D0:32:4C:C5:6C:AA:87:D1:27:4B:22:3B:93:31:5B:75:D5; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 4B:5D:D4:D0:79:EB:14:47:27:3D:6E:FC:90:2A:C9:E3:C2:11:E4:2B; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 5D:96:49:C1:92:72:B3:C0:9F:20:D2:06:8E:23:F4:E9:C8:79:7C:76; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 8D:07:75:6D:C9:3E:05:B5:3E:13:A8:E5:04:2D:BD:63:D3:44:18:69; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 4C:54:E7:A0:1B:BC:44:26:80:75:11:ED:9B:4C:7A:93:68:20:C3:A1; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 81:58:83:A3:C8:EB:81:F3:A5:FE:6C:6B:D8:F7:B3:E8:49:83:32:0F; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 26:7E:93:E6:E3:1A:7D:88:ED:C8:FC:60:E9:19:8B:B8:C9:D7:53:24; see report for more information)29:T573,Pattern match: "https://script.google.com/macros/s/akfycby6xcgnygl2nbcedm4o1dpikjtwwd9pngkwdi9iwxmopnjcct5h0klfmfizrcbzezhr/exec" Pattern match: "https://script.google.com" Pattern match: "https://clients2.google.com/cr/report" Pattern match: "https://csp.withgoogle.com/csp/proto/+encodeuricomponent(b),json.stringify(c)" Pattern match: "google.com/macros/s/akfycby6xcgnygl2nbcedmao" Pattern match: "www.google.com" Heuristic match: "csp.withgoogle.com" Pattern match: "https://script.google.com,type:heartbeat" Pattern match: "https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com,type:heartbeat" Pattern match: "https://www.google.com/jsapi,destination:script,disposition:reporting,type:corp},type:coep,url:https://n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com/blank,user_agent:mozilla/5.0" Heuristic match: "accounts.google.com" Heuristic match: "android.clients.google.com" Heuristic match: "clients1.google.com" Heuristic match: "clients2.google.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "mtalk.google.com" Heuristic match: "n-kcjc6ej2lwhfqxocxtnwapsq2mjcgmbi3rxm2xi-0lu-script.googleusercontent.com" Heuristic match: "ogads-pa.clients6.google.com" Heuristic match: "play.google.com" Heuristic match: "script.google.com" Pattern match: "www.gstatic.com"2a:T3fe6,"