24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 95dd2179361c… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 95dd2179361c…. Threat score 35/100. 0/6 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/95dd2179361c9b8244563efb362e63e20adff2037618851970790f312819d6fb","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","95dd2179361c9b8244563efb362e63e20adff2037618851970790f312819d6fb"],"about":{"@type":"SoftwareApplication","name":"https://get.gosecuredweb.com/?click_id=91218769967\u0026cid=3304\u0026dkw=myfacewhen.com\u0026pid=366710\u0026yid=swbt\u0026cachecode=FyPyvwLIvFzkIzVWxDgxHA%3D%3D\u0026rhi=3025f79b-50a7-4c84-bf8b-33b126240af9","applicationCategory":["url"],"identifier":"95dd2179361c9b8244563efb362e63e20adff2037618851970790f312819d6fb","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":6},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8de,Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3664:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:3664:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:3664:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3664:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4032:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4032:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:4032:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:4032:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4116:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4116:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:4116:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:4116:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3972:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:3972:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1732:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:1732:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3776:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:3776:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7124:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:7124:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1592:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1592:304:WilStaging_02" Process chrome.exe created mutex with name "SM0:1592:304:WilStaging_02" Process chrome.exe created mutex with name "Local\SM0:1592:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8:304:WilStaging_02"26:T2e55,"GET /app/fr?type=l1&dp1=91218769967&score=9 HTTP/1.1 Host: 7proof.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://get.gosecuredweb.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 Server: nginx Date: Tue 06 Oct 2026 23:54:56 GMT Content-Type: application/javascript;charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Access-Control-Allow-Origin: * Pragma: no-cache Cache-Control: no-cache no-transform Expires: Thu 01 Jan 1970 00:00:00 GMT with no response body "GET /async/newtab_promos HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:50 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 993487880 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>C28708C280295D7D270A7B22757064617465223A7B7D7D03....... "GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Tue 06 Oct 2026 23:54:50 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 993487880 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/ddljson?async=ntp:2 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:50 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 993487880 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Client-Data: CLCXywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/javascript; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:50 GMT Server: gws Expires: -1 Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Pragma: no-cache Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-G5ew9waiMA2RIvhHpwxsQw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Cache-Control: no-cache must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 X-Client-Data: CLCXywE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 06 Oct 2026 23:54:50 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 993487880 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /ajax/libs/font-awesome/6.0.0/js/all.min.js HTTP/2 Host: cdnjs.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://get.gosecuredweb.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: u=1 Accept: */* Sec-Ch-Ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: script" Response ==> HTTP/2 200 OK Content-Type: application/javascript; charset=utf-8 Date: Tue 06 Oct 2026 23:54:54 GMT Server: cloudflare Cf-Ray: a468980d4c857af1-SJC Vary: Accept-Encoding Content-Encoding: br Cf-Cache-Status: BYPASS Cf-Cdnjs-Via: cfworker/r2 Strict-Transport-Security: max-age=15780000 Access-Control-Allow-Origin: * Last-Modified: Mon 07 Feb 2022 21:01:39 GMT X-Content-Type-Options: nosniff X-Cdnjs-Cache: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=oGIiotVFPZHSXCLtmcQM1i6qLLq%2BlD78npoAa88Fy%2B%2Fn%2BZx%2FZ%2FtusAGRnZNuE2fSrvFBZjAxUBW7zh1Wby2mPcmYkulesFBFU9RHILU%2FpOc6tEaFk4a7MrrWPO85GU3e2XhSXPr%2B"}]} Cache-Control: no-transform public s-maxage=30672000 max-age=30672000 immutable Alt-Svc: h3=":443"; ma=86400 Age: 1092767 with response body ==>BINARY_CONTENT....... "GET /json HTTP/2 Host: ipapi.co User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Referer: https://get.gosecuredweb.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Origin: https://get.gosecuredweb.com Priority: u=1, i Accept: */* Sec-Ch-Ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Tue 06 Oct 2026 23:54:56 GMT Allow: HEAD OPTIONS GET OPTIONS POST Server: cloudflare Cf-Ray: a46898161b2eeb32-SJC Vary: Host origin X-Frame-Options: DENY Content-Encoding: br Cross-Origin-Opener-Policy: same-origin Cf-Cache-Status: DYNAMIC Access-Control-Allow-Origin: https://get.gosecuredweb.com Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Content-Type-Options: nosniff Referrer-Policy: same-origin Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=7MMWPVKoQMjVIMbxZQPx3mgwzRnLgQiqPSt588RxqsDJzZMV2oIi%2FujEPrHpYPlF1xlJxt570KjyDzd2KU4jhShrO97uB9g2s4g39M%2FkPCqYegcYzhTPCxtL"}]} with response body ==>BINARY_CONTENT....... "GET /marketing-site/static/favicons/favicon-16x16.png HTTP/2 Host: cdn.mxpnl.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://get.gosecuredweb.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png X-Guploader-Uploadid: AP6rU81RTrLuLlIZk3Vc3WF0PIT86f3VsR6Lp-DnnbC3RJU-VrN75wswIoDIaubx3qGj3LLP Date: Mon 28 Sep 2026 12:53:05 GMT Server: UploadServer X-Guploader-Response-Body-Transformations: gunzipped Expires: Tue 28 Sep 2027 12:53:05 GMT X-Goog-Stored-Content-Length: 686 X-Goog-Metageneration: 1 X-Goog-Hash: md5=aULXLqKZtc1Rx1LSnVADKw== Access-Control-Allow-Origin: * Last-Modified: Fri 25 Sep 2026 22:55:32 GMT X-Goog-Stored-Content-Encoding: gzip Warning: 214 UploadServer gunzipped Etag: W/"6942d72ea299b5cd51c752d29d50032b" X-Goog-Generation: 1790376932559492 Cache-Control: public max-age=31536000 immutable Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 730911 X-Goog-Storage-Class: MULTI_REGIONAL with no response body27:T519,"POST /report/v4?s=KHhiwY1hAwTa4qEh3IIU32yrXKn9vdfQf1ncIj63znweR4q60rFO8fF0M9xT%2F8WhWyupz6vPaNs4iOC1oGALHu2b4Kf7svH%2F60xhs%2Bf6qR3ZjXh8I86praMAJH4NXCIaqbjMwZViag%3D%3D HTTP/2 Host: a.nel.cloudflare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Content-Type: application/reports+json Accept-Language: en-US,en;q=0.9 Origin: https://get.gosecuredweb.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd" with payload::==> "[{"age":0,"body":{"elapsed_time":447,"method":"GET","phase":"application","protocol":"h2","referrer":"https://get.gosecuredweb.com/?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=FyPyvwLIvFzkIzVWxDgxHA%3D%3D&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9","sampling_fraction":1.0,"server_ip":"172.67.210.112","status_code":206,"type":"abandoned"},"type":"network-error","url":"https://get.gosecuredweb.com/assets/videos/default/download-video.mp4","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"}]" HTTP/2 200 OK Access-Control-Allow-Origin: * Date: Tue 06 Oct 2026 23:54:56 GMT Vary: Origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Via: 1.1 google with no response body28:Tbab,The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 2C:E3:9D:6E:F7:C6:54:50:B1:76:F1:47:6B:94:21:21:AE:07:1A:27; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=WR3, O=Google Trust Services, C=US" (SHA1: 51:7A:A2:26:49:2C:70:60:03:DB:D1:48:F5:AF:94:D0:47:F3:D4:AE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: E2:51:CB:7D:AF:59:31:04:5A:80:45:45:A0:F4:5B:C2:26:A0:BD:76; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 41:A1:6F:D0:32:4C:C5:6C:AA:87:D1:27:4B:22:3B:93:31:5B:75:D5; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 4B:5D:D4:D0:79:EB:14:47:27:3D:6E:FC:90:2A:C9:E3:C2:11:E4:2B; see report for more information) The input sample is signed with a certificate issued by "CN=WR3, O=Google Trust Services, C=US" (SHA1: 31:6E:B3:34:80:04:15:98:FD:29:9B:81:81:3D:11:CD:03:FF:D6:28; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 70:B5:44:5C:25:65:CF:4A:4B:DB:6F:16:E1:4E:D9:85:C7:F3:75:4E; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 8D:07:75:6D:C9:3E:05:B5:3E:13:A8:E5:04:2D:BD:63:D3:44:18:69; see report for more information)29:T408,Found http requests in header "GET /app/fr?type=l1&dp1=91218769967&score=9" Found http requests in header "GET /async/newtab_promos" Found http requests in header "GET /async/folae?async=_fmt:pb" Found http requests in header "GET /async/ddljson?async=ntp:2" Found http requests in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE" Found http requests in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0" Found http requests in header "GET /ajax/libs/font-awesome/6.0.0/js/all.min.js" Found http requests in header "GET /beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495" Found http requests in header "GET /json" Found http requests in header "GET /marketing-site/static/favicons/favicon-16x16.png" Found http requests in header "POST /report/v4?s=KHhiwY1hAwTa4qEh3IIU32yrXKn9vdfQf1ncIj63znweR4q60rFO8fF0M9xT%2F8WhWyupz6vPaNs4iOC1oGALHu2b4Kf7svH%2F60xhs%2Bf6qR3ZjXh8I86praMAJH4NXCIaqbjMwZViag%3D%3D"2a:T5d1,Pattern match: "https://get.gosecuredweb.com/?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=fypyvwlivfzkizvwxdgxha%3d%3d&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9" Pattern match: "https://get.gosecuredweb.com" Pattern match: "https://clients2.google.com/cr/report" Pattern match: "https://fonts.googleapis.com" Heuristic match: "myfacewhen.com" Heuristic match: "7proof.com" Pattern match: "https://get.gosecuredweb.com/accept-encoding" Pattern match: "www.google.com" Heuristic match: "cdnjs.cloudflare.com" Heuristic match: "static.cloudflareinsights.com" Pattern match: "beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495" Heuristic match: "ipapi.co" Heuristic match: "cdn.mxpnl.com" Heuristic match: "a.nel.cloudflare.com" Pattern match: "https://get.gosecuredweb.com/?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=fypyvwlivfzkizvwxdgxha%3d%3d&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9,sampling_fraction:1.0,server_ip:172.67.210.112,status_code:206,type" Heuristic match: "accounts.google.com" Heuristic match: "android.clients.google.com" Heuristic match: "clients1.google.com" Heuristic match: "clients2.google.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "get.gosecuredweb.com" Heuristic match: "mtalk.google.com" Heuristic match: "ogads-pa.clients6.google.com" Heuristic match: "play.google.com" Pattern match: "www.gstatic.com"2b:T478,Short term registered certificate: "a.nel.cloudflare.com" (90 days old) Short term registered certificate: "accounts.google.com" (83 days old) Short term registered certificate: "android.clients.google.com" (83 days old) Short term registered certificate: "cdn.mxpnl.com" (90 days old) Short term registered certificate: "cdnjs.cloudflare.com" (90 days old) Short term registered certificate: "clients1.google.com" (83 days old) Short term registered certificate: "clients2.google.com" (83 days old) Short term registered certificate: "fonts.googleapis.com" (83 days old) Short term registered certificate: "fonts.gstatic.com" (83 days old) Short term registered certificate: "ipapi.co" (90 days old) Short term registered certificate: "mtalk.google.com" (83 days old) Short term registered certificate: "ogads-pa.clients6.google.com" (83 days old) Short term registered certificate: "play.google.com" (83 days old) Short term registered certificate: "static.cloudflareinsights.com" (90 days old) Short term registered certificate: "www.google.com" (83 days old) Short term registered certificate: "www.gstatic.com" (83 days old)2c:T71e,POST request #1: URL: https://get.gosecuredweb.com/api/signal/ Data size: 1168 bytes Body: ------WebKitFormBoundaryks7CzKS7BmsEbDdZ Content-Disposition: form-data; name="signals" [{"val":"{\"design_test_group\":null,\"design_test_id\":null,\"test_group\":\"B\",\"test_id\":\"installer\",\"referrer\":\"unknown\",\"host\":\"get.gosecuredweb.com\",\"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\",\"design_group\":\"Main\",\"device\":\"desktop\",\"tracking\":true,\"user_id\":\"91218769967\",\"otid\":\"3304_2026-10 POST request #2: URL: https://get.gosecuredweb.com/cdn-cgi/rum? Data size: 843 bytes Body: {"startTime":1791330891669 "pageloadId":"e6dcf5c5-fa7d-4ce3-ab22-96e75949edff" "eventType":1 "nt":"navigate" "location":"https://get.gosecuredweb.com/" "versions":{"fl":"2024.11.0" "js":"2026.9.1" "timings":2} "bi":{"be":"Blink" "bev":"145" "bv":"145" "ov":"11"} "memory":{"totalJSHeapSize":8658322 "usedJSHeapSize":6220838 "jsHeapSizeLimit":2248146944} "firstPaint":1544 "firstContentfulPaint":1544 "timingsV2":{"nextHopProtocol":"h2" "domainLookupStart":25 "domainLookupEnd":25 "connectStart":25 "c POST request #3: URL: https://get.gosecuredweb.com/api/signal/ Data size: 1862 bytes Body: ------WebKitFormBoundaryrOt1kt8bAeXsZBw5 Content-Disposition: form-data; name="signals" [{"val":"{\"design_test_group\":null \"design_test_id\":null \"test_group\":\"B\" \"test_id\":\"installer\" \"referrer\":\"unknown\" \"host\":\"get.gosecuredweb.com\" \"ua\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\" \"design_group\":\"Main\" \"device\":\"desktop\" \"tracking\":true \"user_id\":\"91218769967\" \"otid\":\"3304_2026-102d:T7fa,--window-position=20,54 --window-size=1280,840 --disable-dev-shm-usage --disable-application-cache --disable-background-networking --disable-component-update --disable-sync --safebrowsing-disable-auto-update --disable-component-extensions-with-background-pages --remote-allow-origins=* --safebrowsing-disable-download-protection --disable-search-engine-choice-screen --disable-browser-side-navigation --disable-save-password-bubble --disable-single-click-autofill --allow-file-access-from-files --disable-prompt-on-repost --dns-prefetch-disable --disable-translate --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-device-discovery-notifications --disable-oopr-debug-crash-dump --disable-top-sites --ash-no-nudges --no-crash-upload --deny-permission-prompts "--simulate-outdated-no-au=\"Tue, 31 Dec 2099 23:59:59 GMT\"" --disable-ipc-flooding-protection --disable-password-generation --disable-domain-reliability --disable-breakpad --disable-features=OptimizationHints,OptimizationHintsFetching,Translate,ComponentUpdater,OptimizationTargetPrediction,OptimizationGuideModelDownloading,DownloadBubble,DownloadBubbleV2,InsecureDownloadWarnings,InterestFeedContentSuggestions,PrivacySandboxSettings4,SidePanelPinning,UserAgentClientHint,DisableLoadExtensionCommandLineSwitch,Bluetooth,WebBluetooth,UnifiedWebBluetooth,WebAuthentication,PasskeyAuth,OptimizationGuideOnDeviceModel,HttpsUpgrades,BackForwardCache,SpareRendererForSitePerProcess,AutofillServerCommunication --enable-unsafe-extension-debugging --no-pings --homepage=chrome://version/ --animation-duration-scale=0 --wm-window-animations-disabled --enable-privacy-sandbox-ads-apis --disable-background-timer-throttling --disable-popup-blocking --remote-debugging-host=127.0.0.1 --remote-debugging-port=9222 --user-data-dir=C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t --lang=en-US --no-default-browser-check --no-first-run --no-service-autorun --password-store=basic --profile-directory=Default --log-level=02e:Tbac,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAIhklEQVR4XqWXe1BTdxbHmWp9AHmpceruX53u2roiKiDgo9aKK4o8JIgVLAUF7Vrq1IorLqKiISrI0xGtqDvdjo+1rrotilYF8iSBQBIeCYFAeCa8FHU7a7d2O9899waQl626Z+Y7ucO9ud/POb/zO7/g5PSCMV/2APOlnZgns2GurAVz5U1wl1swV2nGXFUt5qsNmKfWw6tMA69yNRZWFmHkO14pvEoewbPkITxk91nzebJ2FmCOvJHUAHdFHdyVtZhbWkUQlSyAb4UMS/R3sbTqFlbUfvtqID4lT+At/Te8pI/hSdl7yHrIvIPMW+Eua8YcGQNQBze5CXOU1XBXVVEFKuCh0VL2BGC4g2XVBVhhvIbVDRcgsp59cRBv6Q/wLuk3l/bBQ9qD+bIuArA7sidzN9bcAeCmqCYIPQFo4VmmhneFHAt1RSyAf90lrDZfQEjTaUR2HP51CJ+S/7CZL5B+zwJ4SZnyMwB2tgJs9lT62YwxKyNdMwBVVIVKzNeUw1vLVOC7foCLCGnMx1qrAyCyQ/x8CF/pj/AheUsHyk/rL71PAN0sgLvcsfZucjObPWM8W16DP8irMFvBAOioF7TUB3LqgdtYXnMN/qbzBHAa61szsdEmQbR9HzZ1J46G8Cl5CiZ7HylTgSdUgX+RHpMxs/Z2+rRR9gxAPZnWDhqP1BxlJUGUUSNSExoK4Fd7BYENpxHWnIXIdjGZJyGuN2EMADb7p2DXnwX4Hh7FDzHr2zbMKrCSmvDOjQYCsLDlH2k8IDeljnpBg0WVtwngG/jVMAD5CLOmI6JNgk2dCdjSsx3xfbHPIHxKfmLNB7KfeakFwoN3wEu4Dv6emxAk3caUpELSDUxNvI43jhTirX9UjjJ3ADBbUQrv8mIs1t2kbXgBAeZ8rG8WI6I1GTG2zxHX9Qnie6OGAjyFLwG4/fMB+El3wEm8A26yFLwDKvDFaggkZZgi0WCqpBTTxHJMO1iMaftv4Q1xIWbeNIxYAi3mlSrhq72Bpbqv4Vf1JdbU5SK4Ph0bWv6C6I7tiLVvxZ+6o7C9NwxOPrL/kvlPmHnBBueE7+C6VwFOSjm4qQbwjtaAn26EIMOIKaSpmUYIM6shPKaD8KgaQnExhMkFeOuqoxpuCh0NJRUBqLBAXYjFldew3HAOgXXZEFlS8IE1EZHNO7DZthUfd0VhW896OC269wSzrvRi8q5iOCdr4HJQD47ECG6aGbz0evAzGyDIsmBKjgVTSdNySTlmTM82YvqxCkyXyCHcdxNvF2poKioxT1kMD9Ut+JZdwbsVX2G5/hQCjRKEmvdiveVzfNQSh03tMYizReBjuwhOngWPwNlfjknJWjgfrIaLpA6uR+rBSbOAe8wCXkYj+FmNEGQ3EUQTpuY2EUQ9Zhw3YXpuHYRZegglKsxIuwc3KQNwjwBuYqHmPN7VnsP7lXkIMoohMicRwE5stG5FTGsMYtvCHQDv/L0HE/dWYtKBakwWm+AsqYfLYdLRhuEQmQ4IfnIp3txxfdQ2EqbKMPN6ETyVV+GtugTf0r9hqTYffhXpCKzeg+DaPVhn/hQfNsUgumUjC7ClIxROwuwGTEiuwsQUEyaJzZicamYhnPshXNMIJN0BwdsthcvqtFHmA/H2l7fhKb9IABexSH0GSzUZWK5NR4AhEcE1uyAyxSPCHImoxnBsahYhrjUYToIMC17fb8SEAyZMPGjGpEMOiMkjIfao4BKQBteQ488F8LzMAHwFH0UeFqsy8V5ZOlaWJ8JfuwtBhm0IrYlFuDEKH1rW4SNLEOKa/eE0PrkW4wng9QN1mJBSRxB1LMSkoRCpJrgEZ5F5Ljii088HkJ6Fl/wcAZwggGN4r/QQ/NS7CCAeQboYiGqi8YFpPVVBhKj6VYix+MFp3F4C2GciCNNoCGZJGIj4QrgEEYDoFDhh+c8HKM7BAlkeFimOkg7jfVUCVmgS4F++DWvKoxGij4LIEI4IUxAijKsRZV4Bp9f2GjEu2TgmxMR+COewk3BdewKcdWfgGn5uTADPkhPwLM6maZpOc0WMJYr9WKbcCT/VJ/BXRzsAKkQQ6YKxzhCASONKx3uO3LWjq/cxOhn1PIKdZOt+yKqjqw/tnX1o63yAVjvJdh+pF8vBF43+ceFZlE4AmfAuPoRF0v1YIt2JZYpP4aeMxcrSaASUbUCwNhQifRDCCGDwi4zpy0RTWy84z6mC970U+BSlYGHxbgJIIIBtBLAZf1RGIkAdijWaUISUBw3/LpPpy4SlpZsA/krLMTYEE4vvbceSks+wVBqL5bKNWCHfgFWK8LGfZ8o7NB7/+DNWXu+Ez2U7K8/zHYi/2zN4v97a5QCgKnDCzoz90peJFlrXkXFA8xA76Ffw7860QpBjhVt+y+A9U6N9EIBLTckV5YMT+sULgwgCM8APOPbseWt77xDrZ3FU3ceO399mN+L3NP8HorbBNhyAtiWXZgOXILihp8ANyRsFww3MBn9NFikTAkYBGc+esbR2D7F1xJHSPnb8HlY+wOarNryZ3jB4r9rcPjaA6AvwCIC39iQpD7yQE+AHHyflgh+UAz4DEZhFABkQrBoCUN/cNcQaOKx6AFcavxK5Y2l2FNB/Q7mNg/f1prb/EyBzeIVMTfbBl0sU99mDKFU2vC8e/vDz4HVlbQu7A14JgJZhmDkTtRbb4Mu3fNMJsXTsnhiI8upmdhxz1p0lgPwXBMgGb032aHMmquvbR3r8YmgMVhrLeXQoUdOFMcYOcy6dE2MCBOVCEJgztjkT+rq2kR6/GKW6RozbrcPkTdfAofOBG3oSXDJlPh3GJObvwSfAI/ORfqNCSyWtqGmBlhFdMyUuq7Kymar1TShlRKaqfu28bMZrSUYwh9j4pGpM+HMZnZZ34fJZCQQJUszYVYTfxH7968b98T+P3LEt9Qr17wAAAABJRU5ErkJggg==2f:T523,--type=gpu-process --disable-breakpad --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,5726301064166812012,5123426593805914977,262144 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708988185955192 --log-level=0 --mojo-platform-channel-handle=2020 /prefetch:230:T4dd,--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --metrics-shmem-handle=2116,i,13777023306389502899,18032489856366412568,524288 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708989122997041 --log-level=0 --mojo-platform-channel-handle=2172 /prefetch:1131:T4df,--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --metrics-shmem-handle=2244,i,3171291146734375144,17646302616780546072,524288 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708990060038890 --log-level=0 --mojo-platform-channel-handle=2768 /prefetch:1332:T5c5,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3205310445 --metrics-shmem-handle=3276,i,2685305979707650691,11113555924211940464,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708990997080739 --log-level=0 --mojo-platform-channel-handle=3284 /prefetch:133:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3206744545 --metrics-shmem-handle=4024,i,3362704499914632572,17139373963345867868,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708991934122588 --log-level=0 --mojo-platform-channel-handle=3176 /prefetch:134:T4e7,--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --metrics-shmem-handle=4424,i,3805585715832593984,7753888246329078145,524288 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708992871164437 --log-level=0 --mojo-platform-channel-handle=4540 /prefetch:1435:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3210793163 --metrics-shmem-handle=5192,i,10309066416939447426,4894140278309162315,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708993808206286 --log-level=0 --mojo-platform-channel-handle=5220 /prefetch:136:T4de,--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --metrics-shmem-handle=4124,i,11938702012442098482,17539389873168840484,524288 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708994745248135 --log-level=0 --mojo-platform-channel-handle=3284 /prefetch:1437:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3214351254 --metrics-shmem-handle=4056,i,4285917563730901577,6646422345208114756,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708996619331833 --log-level=0 --mojo-platform-channel-handle=4484 /prefetch:138:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3214876213 --metrics-shmem-handle=4456,i,6764927676746162497,16287861258513266489,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708997556373682 --log-level=0 --mojo-platform-channel-handle=4504 /prefetch:139:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3215325199 --metrics-shmem-handle=5516,i,13764897399311366398,2701841890267317458,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708998493415531 --log-level=0 --mojo-platform-channel-handle=4456 /prefetch:13a:T5df,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3215788267 --metrics-shmem-handle=3524,i,6757529244756174898,6822845042717741230,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190708999430457380 --log-level=0 --mojo-platform-channel-handle=5516 /prefetch:13b:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3216362570 --metrics-shmem-handle=5672,i,16202066596690076479,4872234365657387573,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709000367499229 --log-level=0 --mojo-platform-channel-handle=5600 /prefetch:13c:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3216758051 --metrics-shmem-handle=4324,i,10369688707480470015,2785588992692110373,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709001304541078 --log-level=0 --mojo-platform-channel-handle=5644 /prefetch:13d:T5e0,--type=renderer --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --time-ticks-at-unix-epoch=-1791327680659566 --launch-time-ticks=3217215508 --metrics-shmem-handle=5500,i,17538075222574029427,8687953455612930421,2097152 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709002241582927 --log-level=0 --mojo-platform-channel-handle=5672 /prefetch:13e:T5c3,--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --disable-breakpad --user-data-dir="C:\Users\HAPUBWS\AppData\Local\Temp\tmp3y3v6_8t" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5476,i,15920983316847908540,12832499826481857447,262144 --field-trial-handle=2024,i,12876642632844565401,14662567654298822192,262144 --enable-features=AllowURNsInIframes,BrowsingTopics,ConversionMeasurement,FencedFrames,Fledge,InterestGroupStorage,OverridePrivacySandboxSettingsLocalTesting,PrivacySandboxAdsAPIsOverride,PrivateAggregationApi,SharedStorageAPI --disable-features=AutofillServerCommunication,BackForwardCache,Bluetooth,ComponentUpdater,DisableLoadExtensionCommandLineSwitch,DownloadBubble,DownloadBubbleV2,HttpsUpgrades,InsecureDownloadWarnings,InterestFeedContentSuggestions,OptimizationGuideModelDownloading,OptimizationGuideOnDeviceModel,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction,PasskeyAuth,PrivacySandboxSettings4,SidePanelPinning,SpareRendererForSitePerProcess,Translate,UnifiedWebBluetooth,UserAgentClientHint,WebAuthentication,WebBluetooth --variations-seed-version --trace-process-track-uuid=3190709003178624776 --log-level=0 --mojo-platform-channel-handle=5652 /prefetch:101b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"95dd2179361c9b8244563efb362e63e20adff2037618851970790f312819d6fb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1791331117654,"unified_at":"2026-10-06T23:58:37.654Z","metadata":{"hashes":{"sha256":"95dd2179361c9b8244563efb362e63e20adff2037618851970790f312819d6fb","sha1":"b8011ab7b4b277737a3cdf64e842764dcbd63ffb","md5":"52f3ff13e6511e799f3ab48f1965d0fa","sha512":"758967c90e8aeed1cbeae1982f1e22d8e2fbb261f03feff5eeb1208c7f9017cdf68559e5f9e6dc5e9b870fdfd93539f907754a46d0ffeb3fd8a3b7a578dd7efc","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://get.gosecuredweb.com/?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=FyPyvwLIvFzkIzVWxDgxHA%3D%3D&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1791330853000,"last_seen":1791330853000,"last_multi_scan":1791330853000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["fake_captcha","social_engineering","extracted_domain","phishing","captcha","url_encoding"]},"stats":{"av":{"malicious_count":0,"suspicious_count":1,"total_engines":6},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":18},"sandbox_signatures":{"informative_count":27,"suspicious_count":2,"malicious_count":0,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"bforeai":{"name":"BforeAI","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"BforeAI","permalink":"https://bfore.ai/"},"cleandns":{"name":"CleanDNS","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"CleanDNS","permalink":"https://www.cleandns.com/","extra_fields":[{"name":"domain","value":"get.gosecuredweb.com"},{"name":"percent","value":0},{"name":"reports_count","value":0}]},"criminalip":{"name":"Criminal IP","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"Criminal IP","permalink":"https://www.criminalip.io/","report_link":"https://www.criminalip.io/domain/report?scan_id=71614192","extra_fields":[{"name":"is_fake_domain","value":false},{"name":"phishing_probability","value":0},{"name":"credential_input","value":"safe"},{"name":"critical_abuse_record_count","value":0},{"name":"dga_score","value":0},{"name":"is_suspicious_cookie","value":false},{"name":"suspicious_html_element_count","value":2},{"name":"is_mitm_attack","value":false},{"name":"is_url_analysis","value":true},{"name":"dangerous_abuse_record_count","value":0},{"name":"phishing_record_count","value":0},{"name":"is_invalid_ssl","value":false},{"name":"suspicious_file_count","value":0},{"name":"percent","value":30}]},"scamadviser":{"name":"ScamAdviser","success":true,"verdict":"suspicious","threat_name":"suspicious","status":"suspicious","progress":100,"data_source":"ScamAdviser","permalink":"https://www.scamadviser.com/?utm_source=hybridanalysis","report_link":"https://www.scamadviser.com/check-website/get.gosecuredweb.com?utm_source=hybridanalysis","extra_fields":[{"name":"domain","value":"get.gosecuredweb.com"},{"name":"percent","value":70}]},"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/01a113a3-a5f4-7391-833a-7a13e68a30e9/","extra_fields":[{"name":"percent","value":0}]},"vipre":{"name":"Vipre","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"Vipre","permalink":"https://vipre.com/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Detected suspicious domain extracted during analysis"},{"type":"informative","value":"Detected URL or domain pattern embedded within URL path"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Execution","technique":"Malicious Link","attack_id":"T1204.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/001","identifiers":[{"type":"suspicious","value":"Detected social engineering methods via fake CAPTCHA site in HTML"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Remote JavaScript loaded at runtime during browser detonation"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Detection of obfuscated or encoded content in URLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Identifies external resources in HTML content"},{"type":"informative","value":"GETs files from a web server"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Contacts random domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"chrome.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"chrome.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003664)\n \"chrome.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004032)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"7proof.com\"\n \"www.google.com\"\n \"cdnjs.cloudflare.com\"\n \"static.cloudflareinsights.com\"\n \"ipapi.co\"\n \"cdn.mxpnl.com\"\n \"a.nel.cloudflare.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.151.119:443\"\n \"142.250.31.84:443\"\n \"142.251.218.206:80\"\n \"142.251.151.119\"\n \"142.251.218.163:443\"\n \"142.251.218.234:443\"\n \"142.251.108.100:443\"\n \"142.251.121.95:443\"\n \"104.17.24.14:443\"\n \"104.16.80.73:443\"\n \"142.250.141.94:443\"\n \"130.211.5.208:443\"\n \"35.190.80.1:443\"\n \"52.116.53.155:443\"\n \"104.26.9.44:443\"\n \"104.17.24.14\"\n \"142.251.218.142:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"General","name":"GETs files from a web server","description":"$26","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-8622","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"General","name":"POSTs data to a web server","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-8621","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"7proof.com\"\n \"a.nel.cloudflare.com\"\n \"accounts.google.com\"\n \"android.clients.google.com\"\n \"cdn.mxpnl.com\"\n \"cdnjs.cloudflare.com\"\n \"clients1.google.com\"\n \"clients2.google.com\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"get.gosecuredweb.com\"\n \"ipapi.co\"\n \"mtalk.google.com\"\n \"ogads-pa.clients6.google.com\"\n \"play.google.com\"\n \"static.cloudflareinsights.com\"\n \"www.google.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$28","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpsget.gosecuredweb.comclick_id_91218769967_cid_3304_dkw_myfacewhen.com_pid_366710_yid_swbt_cachecode_FyPyvwLIvFzkIzVWxDgxHA%3\" has type \"HTML document Unicode text UTF-8 text with very long lines (1239)\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00003664)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00004032)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00004116)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00001592)\n \"chrome.exe\" opens a process \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 00000000-00006624)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"Contacts random domain names","description":"\"cdnjs.cloudflare.com\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.218.206 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"Detected URL or domain pattern embedded within URL path","description":"Discovered embedded domains:\n-> ?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=fypyvwlivfzkizvwxdgxha==&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9\n\nSource URL: https://get.gosecuredweb.com/?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=FyPyvwLIvFzkIzVWxDgxHA%3D%3D&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":8,"id":"network-8607","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"Detection of obfuscated or encoded content in URLs","description":"Original URL:\nhttps://get.gosecuredweb.com/?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=FyPyvwLIvFzkIzVWxDgxHA%3D%3D&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9\n\nDecoded URL:\nhttps://get.gosecuredweb.com/?click_id=91218769967&cid=3304&dkw=myfacewhen.com&pid=366710&yid=swbt&cachecode=FyPyvwLIvFzkIzVWxDgxHA==&rhi=3025f79b-50a7-4c84-bf8b-33b126240af9\n","origin":"Network Traffic","mitre_attack_id":"T1027","relevance":8,"id":"network-8615","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cdnjs.cloudflare.com\" has high entropy\n Contacted domain: \"static.cloudflareinsights.com\" has high entropy\n Contacted domain: \"android.clients.google.com\" has high entropy\n Contacted domain: \"fonts.googleapis.com\" has high entropy\n Contacted domain: \"get.gosecuredweb.com\" has high entropy\n Contacted domain: \"ogads-pa.clients6.google.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"$2b","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Pattern Matching","name":"Browser-observed domain contacts (CDP)","description":"Domains contacted (12):\n www.gstatic.com\n ogads-pa.clients6.google.com\n play.google.com\n get.gosecuredweb.com\n fonts.googleapis.com\n cdnjs.cloudflare.com\n static.cloudflareinsights.com\n fonts.gstatic.com\n ipapi.co\n accounts.google.com\n cdn.mxpnl.com\n 7proof.com","origin":"Unknown","relevance":10,"id":"cdp-8615","sources":[{"report_type":"sandbox","report_id":"6ac58a24ba515ad4e601231d"}]},{"level":"informative","category":"Pattern Matching","name":"Detected CAPTCHA implementation in HTML content","description":"CAPTCHA Implementation Detected:\n\nCaptcha Elements:\n-> id=\"captcha-container\"\n\nCaptcha Scripts:\n->