24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T433,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample a137aab33d1f… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample a137aab33d1f…. Threat score 0/100. 0/6 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a137aab33d1fbd54627b742c02c6006cb11a7dcd93121476c25289faf208f06f","keywords":["malware analysis","sandbox report","threat intelligence","a137aab33d1fbd54627b742c02c6006cb11a7dcd93121476c25289faf208f06f"],"about":{"@type":"SoftwareApplication","name":"https://script.google.com/macros/s/AKfycbweva0n4Akg-kPQGKrcuF7cPte_C0ivDEgT-Z6-uELmkaoxdURgfkLGj3BVPmKSSFA3/exec","applicationCategory":["url"],"identifier":"a137aab33d1fbd54627b742c02c6006cb11a7dcd93121476c25289faf208f06f"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":6},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T64d,Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2152:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2152:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:2152:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:2152:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6156:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6156:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:6156:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:6156:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4208:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4208:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:4208:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:4208:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6444:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6444:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\mfx_d3d_mutex" Process chrome.exe created mutex with name "mfx_d3d_mutex" Process chrome.exe created mutex with name "Local\SM0:6444:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:6444:304:WilStaging_02"26:T3caa,"GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Thu 15 Oct 2026 12:43:23 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 998428202 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Client-Data: CNHqygE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/javascript; charset=UTF-8 Date: Thu 15 Oct 2026 12:43:23 GMT Server: gws Expires: -1 Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Pragma: no-cache Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-S-sFjCkfjhSog3PnLNbZWQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Cache-Control: no-cache must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/ddljson?async=ntp:2 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 15 Oct 2026 12:43:23 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 998428202 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>0709C280295D7D270A7B2264646C6A736F6E223A7B7D7D03....... "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 X-Client-Data: CNHqygE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 15 Oct 2026 12:43:24 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 998428202 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/newtab_promos HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Thu 15 Oct 2026 12:43:24 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 999170223 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>C28708C280295D7D270A7B22757064617465223A7B7D7D03....... "GET /macros/s/AKfycbweva0n4Akg-kPQGKrcuF7cPte_C0ivDEgT-Z6-uELmkaoxdURgfkLGj3BVPmKSSFA3/exec HTTP/2 Host: script.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: navigate X-Browser-Year: 2026 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Sec-Fetch-User: ?1 Priority: u=0, i Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CNHqygE= Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Accept-Encoding: gzip, deflate, br, zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: document" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=utf-8 Date: Thu, 15 Oct 2026 12:43:25 GMT Server: ESF Expires: Mon, 01 Jan 1990 00:00:00 GMT X-Frame-Options: SAMEORIGIN Content-Encoding: gzip Pragma: no-cache Document-Policy: include-js-call-stacks-in-crash-reports Reporting-Endpoints: default="/macros/s/AKfycbweva0n4Akg-kPQGKrcuF7cPte_C0ivDEgT-Z6-uELmkaoxdURgfkLGj3BVPmKSSFA3/web-reports?bl=editors.maestro_20261006.01_p0&app=37&clss=1&context=eJwVww1Uk_UeB3B49jy_v8AA2ZgDARkbg2GKYIkao0WTN70iiFpc7tVDiFdEEYEIy26iRclNupnAyVQUJpEoGhzDi3hNXo6px5BQLikZ8bIROGeCuikv9-vnnI_jsFv03FEuHl_qf8S9jMKCMc4ZLy4f49rxRuhj7jbq9jzmYvDXzKfcEErrnnIq_FNr5Wz4-SYrV45O_7JyUtx638rtwi822LjjGHDNxgVj4U0btw-vSJ5xHdh07BnXggs-mOB0eOevU1w_Nk1PcS0o9pnm3NF75zTnj6Xv2olOYLbBXlSA9W2cqAmTCkWiFBwvEokm8I5BJLr34pBIZMQ7DryoH49ZXuVrsFkbzicmhvPdJVreiPXlWr4JxUsieHcsL4_gK3BLxut8Dp6NjeTPY-SKSD4O5bve4H2xMFvP78N38_X8h1hfqedb8egZPV-NO87p-Z04NzmKD8fhjCj-Ia7cEcWvxez_RvEFGGuM4hOwZlE0fxa7nsbwd7EkM5Yvww5JHP8_LGDL-d04urpCGEPJ3gpBhYG4BDXnK4QQlIYfE7xw0fgxIQKvtFcJHXjDUiXcxj1bDUIxepQYBA2uGzQI69Ezvlrww98Lq4U_UX6xWvDFE741wml8mFwjWDHnVI1Q_MdJ4QBWjZwUalE-v1bwxeQVtUIqRsXXCitRXVArhOGhtDqhEk35I4IFjZJR4Qke1N0XDmNty32hAT9-yyzsx_JDZqECPz5hFsrQtUZMctTMdKYQnGp0JjrvTD9fd6YBjPNwoWRc9r0LrcG0dhfKxKUVrhSJA_VuNIrr6iS0Hj9pkNDnmKiUUjKuWiylN7EXB_FKqpQ60PFXd5LgZXsZdWJ6vIy24e6dMvoU__mejIpw4KqMxlC4JiMZanAJFmEZXrolow7UrJhFS_C347PIhGm9sygTp3zkRHPk1J8ppxG8Ny0nI26u86BsnKj0JL7Kk5w9ZpMPhhfPJj16_9uL_NG-zZsc0OvUHFrMFKTDVVsUdPS8gqrxepUfdWHE734Uhfw8JYlxPFhJE5hbpKT30XefkgJxrEJJz1E2pSQfPK1V0TlszVPRdTTdUpEFa60qasAdtf50Ey34FKfvqon1qqnPP4CGsejNACrBqF8CaCWu4zW0Hj8iDX2GW1w0lINplRrKxBGjhh4hOxVOrjg9T0uu87VUHq-lClSURZAGU_a9Rmm4wUFH_8C2Kh3dwmKDjg7h122vUxUuPxJJqzG1M5Iy0GckktS4f6ueSrE3V0-DGFSgp1Bcs1dPf8MPv9fTJ9jSqKdraJYto8d49cEy6sQ9lij6EnMk0fQe_rY7mkx42BBNBvwuL4b-g-tPxdAmHO2JoTFs7ouhNrwQHEutKO2LJS-cfDBAgmWAWhIG6RomrR6kFMyyDVL-i5yRjn9rpG-xutZIdZi7wkTv48VVJmpH959M5I1DhmEy4y97R-gPPGAboUMYJhml13Co8T6Z0TnOTDLck26mYkzsMVMy2kc8IAe83GChq_jz3x_SHazRPqKzaEocIwuqvxun-bg27gmlY_uqJ3Qb-xZZaRgbn1npEg5NWMmM0ikreWGpnY2O4DyRjV7BLN5G-fiDk41-fNHDRjdR0WMjDQ5P2ciGsbufUwLqtkxQDCbVT1AK7kydpEI8880kNWLWuUnKx-jpSYrHem6KmrDh9DRdwCK9HSvB9HE7tg2ZzY65oqzSnvngOxt59gHyY8TE6OzgyGQ4Z6kjC8DxS45sAjvVTsxJI2ZS3NwlZtnYMCBm_KSYiXFpoAuLxL4gFzaMP5hc2I-YZHFlKTgmuLHnODPUjXngkTNu7ARm-EjYDrx8wZ114jmJnF3EmwvlrAf9VR5sHna_7cHuocnqwSy4qcCTZeFI_2z2CJ-v8WJOa73YIpkP-6rZhx3HakdfVoetCl_WhQvv-rJXMa_fl-3CviwFG0a7HgWbgYF9CrYAuRl-zBGLm_3YAax3UrIm3P-RkpWifYmKOSD7UsVcMWGmP3sLjZyaPcCDEjU7jD-dVLNu_GxBADtzI5A1YnFXIDuAtrlBzP6lINbVHMTuotvcYOaJ7qXBzBsrFr_MvkH3668wbyxzCmNH8Yu0xewrXF0ezv7ir2VrNVrWrYtgEvEM88HWbpr5aW_919xsWVxW_vbM9IR33t6akbs5fWNSWk5Gdp5yTvrGjLztObnB21LTc_Nytm9YGLIwLDQkJCw4JHRDdsj_AUrbS9Q&build-label=editors.maestro_20261006.01_p0&is-cached-offline=false" Content-Security-Policy: script-src 'report-sample' 'nonce-IN_yTUhBH9bcscH_TE2eWA' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache, no-store, max-age=0, must-revalidate Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 with no response body, "GET /static/macros/client/css/2208734863-mae_html_css_ltr.css HTTP/2 Host: script.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Browser-Year: 2026 Referer: https://script.google.com/macros/s/AKfycbweva0n4Akg-kPQGKrcuF7cPte_C0ivDEgT-Z6-uELmkaoxdURgfkLGj3BVPmKSSFA3/exec Sec-Fetch-Site: same-origin Accept-Language: en-US en;q=0.9 X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=0 Accept: text/css */*;q=0.1 X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CNHqygE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: style" Response ==> HTTP/2 200 OK Content-Type: text/css Date: Thu, 15 Oct 2026 12:43:25 GMT Server: sffe Expires: Thu, 15 Oct 2026 12:43:25 GMT Vary: Accept-Encoding, Origin Content-Encoding: gzip Last-Modified: Wed, 14 Oct 2026 19:16:46 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs Report-To: {"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]} Accept-Ranges: bytes Cache-Control: public, max-age=0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="docs" Age: 0 with no response body, "GET /static/macros/client/js/2978418290-warden_bin_i18n_warden.js HTTP/2 Host: script.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Browser-Year: 2026 Referer: https://script.google.com/macros/s/AKfycbweva0n4Akg-kPQGKrcuF7cPte_C0ivDEgT-Z6-uELmkaoxdURgfkLGj3BVPmKSSFA3/exec Sec-Fetch-Site: same-origin Accept-Language: en-US en;q=0.9 X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=1 Accept: */* X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CNHqygE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: script" Response ==> HTTP/2 200 OK Content-Type: text/javascript Date: Thu, 15 Oct 2026 12:43:25 GMT Server: sffe Expires: Thu, 15 Oct 2026 12:43:25 GMT Vary: Accept-Encoding, Origin Content-Encoding: gzip Last-Modified: Tue, 06 Oct 2026 19:15:05 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs Report-To: {"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]} Accept-Ranges: bytes Cache-Control: public, max-age=0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="docs" Age: 0 with response body ==>BINARY_CONTENT......., "GET /favicon.ico HTTP/2 Host: script.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Browser-Year: 2026 Referer: https://script.google.com/macros/s/AKfycbweva0n4Akg-kPQGKrcuF7cPte_C0ivDEgT-Z6-uELmkaoxdURgfkLGj3BVPmKSSFA3/exec Sec-Fetch-Site: same-origin Accept-Language: en-US en;q=0.9 X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=1 i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CNHqygE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: application/binary Date: Thu, 15 Oct 2026 12:43:27 GMT Server: ESF Expires: Mon, 01 Jan 1990 00:00:00 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-832kvP5xLW5-vErJu-KBBA' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Location: https://www.gstatic.com/script/favicon.ico Cache-Control: no-cache, no-store, max-age=0, must-revalidate Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Pragma: no-cache with no response body, "GET /jsapi HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Browser-Year: 2026 Sec-Fetch-Storage-Access: active Referer: https://n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=1 Accept: */* X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CNHqygE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: script" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Thu, 15 Oct 2026 12:22:07 GMT Server: sffe Expires: Thu, 15 Oct 2026 12:52:07 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 Location: https://www.gstatic.com/charts/loader.js Cache-Control: public, max-age=1800 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Age: 1280 with no response body27:Te76,"POST /wardeninit?_reqid=20606&rt=j HTTP/2 Host: script.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Sec-Fetch-Mode: cors X-Browser-Year: 2026 Referer: https://script.google.com/macros/s/AKfycbweva0n4Akg-kPQGKrcuF7cPte_C0ivDEgT-Z6-uELmkaoxdURgfkLGj3BVPmKSSFA3/exec Sec-Fetch-Site: same-origin Accept-Language: en-US,en;q=0.9 Origin: https://script.google.com X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=1, i X-Same-Domain: 1 Accept: */* X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CNHqygE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: empty" with payload::==> "f.req=%5B%22wisp%22%2C1%2C2%5D&" HTTP/2 200 OK Content-Type: application/json; charset=utf-8 Date: Thu, 15 Oct 2026 12:43:26 GMT Server: ESF Expires: Mon, 01 Jan 1990 00:00:00 GMT Content-Security-Policy: frame-ancestors 'self' Content-Disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Frame-Options: SAMEORIGIN Content-Encoding: gzip Cache-Control: no-cache, no-store, max-age=0, must-revalidate Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Pragma: no-cache with response body ==>BINARY_CONTENT......., "POST /csp/proto/26981ed0d57bbad37e728ff58134270c HTTP/2 Host: csp.withgoogle.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Origin: https://n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com Priority: u=4 i Accept: */* Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty" with payload::==> "{"origin":"https://n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com" "type":"HEARTBEAT"}" HTTP/2 204 No Content Content-Type: text/html; charset=utf-8 Date: Thu, 15 Oct 2026 12:43:27 GMT Server: ESF Expires: Mon, 01 Jan 1990 00:00:00 GMT X-Frame-Options: SAMEORIGIN Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Accept-Ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com Reporting-Endpoints: default="/csp/_/CspCollectorHttp/web-reports?context=eJzj4tDikmJw05BiEOLmeD_l8DU2gQfL33Er6SXlF8YXpyaXFmWWVOomFxfoJufn5KQml-QX6WaUlBTEGxkYmRkaGBrrGZjEFxgAACSCFvw" Content-Security-Policy: require-trusted-types-for 'script';report-uri /csp/_/CspCollectorHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Cache-Control: no-cache, no-store, max-age=0, must-revalidate Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 with no response body28:T650,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 41:A1:6F:D0:32:4C:C5:6C:AA:87:D1:27:4B:22:3B:93:31:5B:75:D5; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 81:58:83:A3:C8:EB:81:F3:A5:FE:6C:6B:D8:F7:B3:E8:49:83:32:0F; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 03:3E:EE:10:60:2A:F5:44:91:31:20:DC:E6:80:5E:4D:67:43:70:1A; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: A6:C0:81:49:02:5D:55:F8:AA:9D:F1:C6:9E:4A:41:81:F1:AB:0A:88; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 4C:54:E7:A0:1B:BC:44:26:80:75:11:ED:9B:4C:7A:93:68:20:C3:A1; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 16:0C:4D:76:D5:B6:8B:3A:61:C8:AA:BB:4E:70:A9:F9:C1:D7:36:7A; see report for more information)29:T4ff,Pattern match: "script.google.com/macros/s/akfycbwevaondakg-kpqgkrcuf7cpte" Pattern match: "script.google.com/macros/s/akiycbxuzvibkednje-02sviol3cowcb-hd" Pattern match: "jscript.google.com/macros/s/akfycbwevaondakg-kpqgkrcuf" Pattern match: "https://script.google.com/macros/s/akfycbweva0n4akg-kpqgkrcuf7cpte_c0ivdegt-z6-uelmkaoxdurgfklgj3bvpmkssfa3/exec" Pattern match: "https://script.google.com" Pattern match: "https://clients2.google.com/cr/report" Pattern match: "https://csp.withgoogle.com/csp/proto/+encodeuricomponent(b),json.stringify(c)" Pattern match: "www.google.com" Heuristic match: "script.google.com" Heuristic match: "csp.withgoogle.com" Pattern match: "https://n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com,type:heartbeat" Heuristic match: "accounts.google.com" Heuristic match: "android.clients.google.com" Heuristic match: "clients1.google.com" Heuristic match: "clients2.google.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "mtalk.google.com" Heuristic match: "n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com" Heuristic match: "ogads-pa.clients6.google.com" Heuristic match: "play.google.com" Pattern match: "www.gstatic.com"2a:T421,Short term registered certificate: "accounts.google.com" (83 days old) Short term registered certificate: "android.clients.google.com" (83 days old) Short term registered certificate: "clients1.google.com" (83 days old) Short term registered certificate: "clients2.google.com" (83 days old) Short term registered certificate: "csp.withgoogle.com" (83 days old) Short term registered certificate: "fonts.googleapis.com" (83 days old) Short term registered certificate: "fonts.gstatic.com" (83 days old) Short term registered certificate: "mtalk.google.com" (83 days old) Short term registered certificate: "n-q7brt7rvdqzncvm5oxhe56vblmfpto6bjwc4o6a-0lu-script.googleusercontent.com" (83 days old) Short term registered certificate: "ogads-pa.clients6.google.com" (83 days old) Short term registered certificate: "play.google.com" (83 days old) Short term registered certificate: "script.google.com" (83 days old) Short term registered certificate: "www.google.com" (83 days old) Short term registered certificate: "www.gstatic.com" (83 days old)2b:T3fe8,"