IP192.229.221.95:0
Hashd9384188294bc30d2d829805a0f2776e 7c0d45a8769e599a3c17911578074a1955215a04 9d38713e998148177651a3523a2aae44587dca5a8075de76260948bc8b54a18f
POST / HTTP/1.1
Host: status.rapidssl.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4564
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Wed, 08 May 2024 00:09:41 GMT
Last-Modified: Tue, 07 May 2024 22:53:37 GMT
Server: ECAcc (ska/F775)
X-Cache: HIT
Content-Length: 471
|
| www.ashampoo.com/ashampoo_winoptimizer_27_sm.exe?cjevent=3718f9770ccf11ef838a02f10a1cb825 | 18.197.209.74 | 302 Found | 566 B |
URL User Request GET HTTP/1.1www.ashampoo.com/ashampoo_winoptimizer_27_sm.exe?cjevent=3718f9770ccf11ef838a02f10a1cb825 IP18.197.209.74:443
CertificateIssuerDigiCert Inc Subjectashampoo.com FingerprintD5:E7:32:D8:53:C4:9B:28:01:C3:36:39:98:E0:DE:CF:8E:F4:F8:55 ValidityFri, 26 Apr 2024 00:00:00 GMT - Fri, 25 Apr 2025 23:59:59 GMT
File typeHTML document, ASCII text Hashda7a5d515db228f7811abb325d4e1bd3 ac556ae7fc04ee981d8209e1fcbc64a1e73f2555 2196a6338dda9e7d8f8cdcb371626749e7d0607ed9d2b2bb08fad7a5d234b15f
GET /ashampoo_winoptimizer_27_sm.exe?cjevent=3718f9770ccf11ef838a02f10a1cb825 HTTP/1.1
Host: www.ashampoo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Wed, 08 May 2024 00:09:41 GMT
Server: Apache
Strict-Transport-Security: max-age=31556926
Cache-Control: no-cache, private
Location: https://cdn1.ashampoo.net/ashampoo/6906/ashampoo_winoptimizer_27_27.00.01_sm.exe
Set-Cookie: XSRF-TOKEN=eyJpdiI6Im8vRjc0K1BxMUgzSjBPbFJCVndPTkE9PSIsInZhbHVlIjoiUnFVM2MyTlpxeDBDdThTaG1iVkxCQk1tVUR2WGRlK2MvY2VXMW5hMUo1K0cxU21Vd1FjQjhuYzhwVkNsam15UjV4bWRqa2daYnQyTlhxZmFZYXFFTTN1aEZyTjJ5QmFYYm5pcG91cG56bUtRWGFEbkNjSTREZUV4YVYyaTc4bnUiLCJtYWMiOiJiOWVmYTQwZjAwZTQ2MjhmNDRhZTZkNDNhMWQzZmE5MGQ5ODI2MjA4YWRjZGQ3NDdhMDk0MTZkYjQyODE0NDAzIiwidGFnIjoiIn0%3D; expires=Wed, 08 May 2024 02:09:41 GMT; Max-Age=7200; path=/; secure; samesite=lax
ashampoo_session=eyJpdiI6ImM0b3Zjak5DVkNmVVNLRXFUZ2dzbVE9PSIsInZhbHVlIjoiM0xyUGxGck9tbVZKUmR2NE9MZGg4Wk5XMWhGTjRJK2ZmaDZKRUNpNXA1cDNldE9DQytDOW5RTzB2UWZCZ2hUZG1TNUdTSEdjK1JKMFFMOEZ2Rlk1RWZwYjh0VDBOcXBFUHZmbk9Tb1B3OE1sRmw4MFpCd3RsZE9OLzFnZkYwbVgiLCJtYWMiOiJmYWY0YzBlYjZiMzVhMDc3NGU2NmE1MzY2ZGFiM2UzMGU0MDlmZDBhYTIxYTRiZDRiOGI3NGRiMmZmYWZiOWZiIiwidGFnIjoiIn0%3D; expires=Wed, 08 May 2024 02:09:41 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Access-Control-Allow-Origin: *
Content-Security-Policy: frame-ancestors 'self' https://*.ashampoo.com https://*.cms.test
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
|
| ocsp.r2m03.amazontrust.com/ | 143.204.53.97 | | 471 B |
URL ocsp.r2m03.amazontrust.com/ IP143.204.53.97:0
Hash6df1f506e42b51f2b63dbb0c95f3a28c 250613bde76f14b677110c31eeba8bfa777edcbe b4fbf24ccfbf2f46a4124028bbf48ef2e829ce9deb24604ceaaa90c3fd6f63d9
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Wed, 08 May 2024 00:09:41 GMT
Last-Modified: Tue, 07 May 2024 23:22:24 GMT
Server: ECAcc (amb/6AD5)
X-Cache: Miss from cloudfront
Via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: hTh0TgnmFKgxc6-UACoRIhZ81UMfZ4egdAJ9bUCIl17K1pF2styIZA==
Age: 2837
|
| cdn1.ashampoo.net/ashampoo/6906/ashampoo_winoptimizer_27_27.00.01_sm.exe | 143.204.55.82 | 200 OK | 29 MB |
URL User Request GET HTTP/2cdn1.ashampoo.net/ashampoo/6906/ashampoo_winoptimizer_27_27.00.01_sm.exe IP143.204.55.82:443
CertificateIssuerAmazon Subject*.ashampoo.net Fingerprint91:F0:B0:BD:BF:9C:EA:41:7F:38:38:19:89:BA:3D:CB:E8:53:06:DE ValiditySun, 15 Oct 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections Size29 MB (28892600 bytes) Hash18a02efdb9540f4ede0ca994c988881d 9135d4d5cdca43d59e3680a822ad19861a325a8d 706009d472afc60f2d9293a07161bcb0fed6e8475968b7b6f538dba05bdb2164
Analyzer | Verdict | Alert | VirusTotal | suspicious | |
GET /ashampoo/6906/ashampoo_winoptimizer_27_27.00.01_sm.exe HTTP/1.1
Host: cdn1.ashampoo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
content-length: 28892600
date: Tue, 07 May 2024 12:08:05 GMT
last-modified: Tue, 07 May 2024 10:30:05 GMT
etag: "18a02efdb9540f4ede0ca994c988881d"
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 dbfaae0db03f11cf713bbcbdb25be4a2.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: dHHnC_lBzbAX_QFQ8i7GbUMbkQQVfAkPlCHMbv3mKkm6kUuUKmZuLg==
age: 43297
X-Firefox-Spdy: h2
|