{"report_id":"160041db-5433-40ab-be54-a3966d22d7d3","version":6,"status":"done","tags":[],"date":"2024-07-10T12:01:47Z","url":{"schema":"http","addr":"download.hitpaw.com/downloads/hitpaw-watermark-remover_5680.exe","fqdn":"download.hitpaw.com","domain":"hitpaw.com","tld":"com"},"ip":{"addr":"104.18.24.102","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-25T10:15:09Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"r10.o.lencr.org","ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2020-06-29","domain_rank":0,"first_seen":"2024-06-06 21:45:11","last_seen":"2024-07-08 18:12:20","alert_count":0,"request_count":5,"received_data":4438,"sent_data":1635,"comment":"","tags":null,"fingerprints":null},{"fqdn":"download.hitpaw.com","ip":{"addr":"104.18.24.102","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-03-11","domain_rank":0,"first_seen":"2021-04-01 08:54:29","last_seen":"2024-01-24 12:37:02","alert_count":1,"request_count":1,"received_data":1824173,"sent_data":517,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"831d7de6eeb41c6df36bef3729aad265","sha1":"e859a2e141d942c25ab2773a154ef0baf08197e9","sha256":"eecb4425b1d532cbd0212510193ada9f0e28e92be1637714d4c6c64488926bb6","sha512":"d888073b1da4038e041393298374cb5843082ff677e754bd16bc0041ccde7b0dfdf097780b91b022edf42fdbcb38e629eb30e98d753cf8dd8f969ba856bf56b3","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections","size":1823496,"url":{"schema":"https","addr":"download.hitpaw.com/downloads/hitpaw-watermark-remover_5680.exe","fqdn":"download.hitpaw.com","domain":"hitpaw.com","tld":"com"},"ip":{"addr":"104.18.24.102","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-05-31","alert":"Scan result 1/65","trigger":"eecb4425b1d532cbd0212510193ada9f0e28e92be1637714d4c6c64488926bb6","verdict":"suspicious","severity":"","comment":"suspicious - 1/65","link":"https://www.virustotal.com/gui/file/eecb4425b1d532cbd0212510193ada9f0e28e92be1637714d4c6c64488926bb6","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:01:21.157308862Z","timestamp":1720612881157,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"41E6A348AAC9E9DB44BFA14B3AA29D411F4489B375AE1F1BE6B0D280AF98541D\"\r\nLast-Modified: Mon, 08 Jul 2024 01:53:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=5273\r\nExpires: Wed, 10 Jul 2024 13:29:14 GMT\r\nDate: Wed, 10 Jul 2024 12:01:21 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"b34ca6af54e2b9fea57d418f5d1928f7","sha1":"510b69f4470789a573217726d6f1a3d6ee765460","sha256":"41e6a348aac9e9db44bfa14b3aa29d411f4489b375ae1f1be6b0d280af98541d","sha512":"56fc288af1ca048d6ad95019c5fe4a6be829ae0e6d834e51d920e79cb96aa3de97763b94d41b4c691f461b7a46ef961dd157b791947e0463310e5d0abd1422c8","ssdeep":"","tlshash":"def0055627d5a6016a710a911de5d31a1e2058fb305018f223d451e33923bbe1ec8446","first_seen":"2024-07-08T05:19:45Z","last_seen":"2024-08-19T17:39:41.553406Z","times_seen":34939,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:01:21.160056027Z","timestamp":1720612881160,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"EE690BACDDF55FD12AE0C9C39E330E0A1A18776B9EDC91B4AA6C5BAE28824F1E\"\r\nLast-Modified: Tue, 09 Jul 2024 15:28:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=21080\r\nExpires: Wed, 10 Jul 2024 17:52:41 GMT\r\nDate: Wed, 10 Jul 2024 12:01:21 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"e08576e0904dc9903a9c20fa9e3d15b8","sha1":"74feff76140500fd4a61e89c7e9d8d0a60df1183","sha256":"ee690bacddf55fd12ae0c9c39e330e0a1a18776b9edc91b4aa6c5bae28824f1e","sha512":"ce87a5e7c77473d402b395ff6dfc4697ae83d56b168eccca85aed994fbe8d48ed47831aa316978afcefccc1a8ab551ac5279cfc7f3ffc559b7eaea1b2770e2b3","ssdeep":"","tlshash":"01f07e43242b3f20b7aa120838f8cc0d2e202ab6284408c438b282c33807bea8ee1407","first_seen":"2024-07-09T22:22:49Z","last_seen":"2024-08-19T17:27:32.492818Z","times_seen":16077,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:01:21.636563743Z","timestamp":1720612881636,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"5D1BC1C01894FD88A0D4680490977488D6458BB58A98ACE24EF8AA103538BC1F\"\r\nLast-Modified: Tue, 09 Jul 2024 23:47:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=16520\r\nExpires: Wed, 10 Jul 2024 16:36:41 GMT\r\nDate: Wed, 10 Jul 2024 12:01:21 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"e7492695b5254a3a63fcffb4f1ee8cec","sha1":"0361713c6d8129210245347284c7c6babfd28fb7","sha256":"5d1bc1c01894fd88a0d4680490977488d6458bb58a98ace24ef8aa103538bc1f","sha512":"ec0e52128f983dbd74415511de8ce735b2b718b43605e9ac47400438cd5e97c87e35eb9ba74da906afc0cc7f6d28beca431b3cd9f15b958bce49500f659db147","ssdeep":"","tlshash":"d5f0549736b6bc516ab835253dfbda3e7a309924b15049bceca51291ec383a7418040c","first_seen":"2024-07-10T02:50:08Z","last_seen":"2024-08-19T17:26:17.073472Z","times_seen":39709,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"download.hitpaw.com/downloads/hitpaw-watermark-remover_5680.exe","fqdn":"download.hitpaw.com","domain":"hitpaw.com","tld":"com"},"ip":{"addr":"104.18.24.102","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-07-10T12:01:21.873Z","timestamp":1720612881873,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hitpaw.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Jun 2024 13:59:20 GMT","end":"Fri, 06 Sep 2024 14:59:15 GMT"},"fingerprint":{"sha1":"4D:1C:C7:B4:E2:51:99:47:64:49:89:14:AB:ED:1C:C9:80:EC:02:D0","sha256":"01:F2:A1:EF:B6:A2:D2:1E:C6:58:5F:81:36:C2:F8:12:1F:55:AB:9C:6A:97:DD:29:B7:FF:36:2E:0D:FA:15:7B"}}},"request":{"raw":"GET /downloads/hitpaw-watermark-remover_5680.exe HTTP/1.1\r\nHost: download.hitpaw.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 10 Jul 2024 12:01:21 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1823496\r\ncf-ray: 8a10660febdbb527-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 35865\r\ncache-control: public, max-age=691200\r\ncontent-disposition: attachment;filename=hitpaw-watermark-remover.exe\r\netag: \"65b76307-1bd308\"\r\nexpires: Thu, 18 Jul 2024 12:01:21 GMT\r\nlast-modified: Mon, 29 Jan 2024 08:34:15 GMT\r\nvary: Accept-Encoding\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1823496,"size_decoded":1823496,"mime_type":"application/octet-stream","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections","md5":"831d7de6eeb41c6df36bef3729aad265","sha1":"e859a2e141d942c25ab2773a154ef0baf08197e9","sha256":"eecb4425b1d532cbd0212510193ada9f0e28e92be1637714d4c6c64488926bb6","sha512":"d888073b1da4038e041393298374cb5843082ff677e754bd16bc0041ccde7b0dfdf097780b91b022edf42fdbcb38e629eb30e98d753cf8dd8f969ba856bf56b3","ssdeep":"49152:4IjHDqp+cDpJd+IzotwWqOLRGhF4y1IONChr9ax:4WcDB+aoN1ROV1I3hrUx","tlshash":"b685027a81c8d769c11130389384b4a3556a1fddbbc1d6c2ecb9b8ef99fcb934625312","first_seen":"2024-05-24T04:03:48Z","last_seen":"2024-09-20T20:15:36.183739Z","times_seen":233,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":30,"dns":1,"connect":2,"send":0,"wait":28,"receive":209,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-05-31","alert":"Scan result 1/65","trigger":"eecb4425b1d532cbd0212510193ada9f0e28e92be1637714d4c6c64488926bb6","verdict":"suspicious","severity":"","comment":"suspicious - 1/65","link":"https://www.virustotal.com/gui/file/eecb4425b1d532cbd0212510193ada9f0e28e92be1637714d4c6c64488926bb6","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.77.32","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:01:22.496890654Z","timestamp":1720612882496,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"C86804EFF01A7BB9FF866508BFDB1B071CFA4A26617D11094B9F5226E1A4B970\"\r\nLast-Modified: Tue, 09 Jul 2024 16:18:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=16902\r\nExpires: Wed, 10 Jul 2024 16:43:04 GMT\r\nDate: Wed, 10 Jul 2024 12:01:22 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"fc076d7a99abd74b9da6b35304bb93e9","sha1":"9d541501d5141dcf7b4d839d6fcffabec81e1a14","sha256":"c86804eff01a7bb9ff866508bfdb1b071cfa4a26617d11094b9f5226e1a4b970","sha512":"ff10580406ed0db383ff2d2dded09db4544cc042b2e609083d89b33b2d0bf6e77591dffa46e88fc3d5460d288e7416f8d1a145bd1bc80cae5f950955f7d88a14","ssdeep":"","tlshash":"5bf00e0210d8be02933a0f056899e22a6c00d6ac728051f730dc05957672b9b87c8848","first_seen":"2024-07-09T20:48:14Z","last_seen":"2024-08-19T17:28:08.063831Z","times_seen":23416,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.36.76.226","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:01:23.809554088Z","timestamp":1720612883809,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2\"\r\nLast-Modified: Mon, 08 Jul 2024 05:32:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=9133\r\nExpires: Wed, 10 Jul 2024 14:33:36 GMT\r\nDate: Wed, 10 Jul 2024 12:01:23 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"d7b2c37e4b6c062d80ad32046f42d3d8","sha1":"131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c","sha256":"317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2","sha512":"e8d8acac8c0eb8cc7d365eca9121ee37756ccf1d8b77d6177f316593c50a660d3af8ab40f67f47a8fd9fe0fe75f51070e6cf3c69b49f57aed1b4afc155ca5cd3","ssdeep":"","tlshash":"02f00e023df7bd80b3e944911ebde63bf8107aa7305075e630c0828328b87a74744c9a","first_seen":"2024-07-08T09:56:38Z","last_seen":"2024-08-19T17:38:29.907666Z","times_seen":36963,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}