| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash8e079c5dee743a12781698cf3686981d 0fb3a53635ad1ccf86f4b27f8505f715858aa46c 65f787250e6664f653d28538711fb6da227887f523b657dfba40d22af5cf46ad
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "65F787250E6664F653D28538711FB6DA227887F523B657DFBA40D22AF5CF46AD"
Last-Modified: Thu, 12 Sep 2024 17:29:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3987
Expires: Fri, 13 Sep 2024 22:14:54 GMT
Date: Fri, 13 Sep 2024 21:08:27 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash8ddc0c958da73dfad4d42a6ae9a6dff6 6ed3ed6b818e91ac249cbfbb1fb14c96f19117c3 4320d78c549884fe858d0985285c94e70ac95e66ac557e8043514247c23feb0c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4320D78C549884FE858D0985285C94E70AC95E66AC557E8043514247C23FEB0C"
Last-Modified: Fri, 13 Sep 2024 09:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11472
Expires: Sat, 14 Sep 2024 00:19:39 GMT
Date: Fri, 13 Sep 2024 21:08:27 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash6f417a1a5ebcee1534c03d401bc1e686 8044ec315b73dfc62fbba88aa848b26e6b9d0572 797b7242665c53d103116e758891ec7b61c10602e290a9f1bb0f190148860c7b
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "797B7242665C53D103116E758891EC7B61C10602E290A9F1BB0F190148860C7B"
Last-Modified: Thu, 12 Sep 2024 12:20:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9131
Expires: Fri, 13 Sep 2024 23:40:38 GMT
Date: Fri, 13 Sep 2024 21:08:27 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hashdf2d88b80b39ed651ca6b7ee3465b1c4 1bd6e2288cd500728b6ea8a9ebe97c25aeedc550 604a907a35f947c7cf17c8f09efd5fbd8836864aedc55fbc49b66b8cc95bd089
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "604A907A35F947C7CF17C8F09EFD5FBD8836864AEDC55FBC49B66B8CC95BD089"
Last-Modified: Thu, 12 Sep 2024 14:37:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9152
Expires: Fri, 13 Sep 2024 23:40:59 GMT
Date: Fri, 13 Sep 2024 21:08:27 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hasha90d1d70418e0bf8b2428c9e237794b4 25bd2901ccbc6b81d53336610cfa738314a657ba e8f8bc42bf2e718fd4f5b54da5fef6e8f6cfc6c2b084818e558f63102c5f9a1e
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E8F8BC42BF2E718FD4F5B54DA5FEF6E8F6CFC6C2B084818E558F63102C5F9A1E"
Last-Modified: Thu, 12 Sep 2024 14:33:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18647
Expires: Sat, 14 Sep 2024 02:19:15 GMT
Date: Fri, 13 Sep 2024 21:08:28 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash459ce1936692de6452b2c2cf292cd49b ca749a873cd27e6ada1f96e6356b8da3d3916d21 b915b57c146de52c273642947cbb71ea15f650c0bb3c69ec37e0de60368427d7
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B915B57C146DE52C273642947CBB71EA15F650C0BB3C69EC37E0DE60368427D7"
Last-Modified: Wed, 11 Sep 2024 04:41:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4389
Expires: Fri, 13 Sep 2024 22:21:37 GMT
Date: Fri, 13 Sep 2024 21:08:28 GMT
Connection: keep-alive
|
|
| dwnld5.t1mnsft.com/offergate/TelamonCleaner.exe?clid=66e3bf6ceb457og&sub1=0ysc0c0sc800cgos&sub2=29857&sub3=&extra1= | 172.67.194.176 | 200 OK | 2.5 MB |
URL User Request GET HTTP/2dwnld5.t1mnsft.com/offergate/TelamonCleaner.exe?clid=66e3bf6ceb457og&sub1=0ysc0c0sc800cgos&sub2=29857&sub3=&extra1= IP 172.67.194.176:443
CertificateIssuerGoogle Trust Services Subjectt1mnsft.com Fingerprint34:14:D1:3A:76:BC:1D:DD:81:99:43:BE:08:1E:0C:44:28:E5:DA:06 ValidityWed, 17 Jul 2024 06:45:39 GMT - Tue, 15 Oct 2024 06:45:38 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 10 sections Size2.5 MB (2510392 bytes) Hashc11b2532d2f6238b6413dd354ca860a4 e641b7816f204f6e1b7fbd67449b4324a0a13b06 31eb5bc6161a8ef7f6f1bf98d06c2aa51845b5129c81792d6387e542b4f9999d
Analyzer | Verdict | Alert | VirusTotal | malicious | |
GET /offergate/TelamonCleaner.exe?clid=66e3bf6ceb457og&sub1=0ysc0c0sc800cgos&sub2=29857&sub3=&extra1= HTTP/1.1
Host: dwnld5.t1mnsft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 13 Sep 2024 21:08:28 GMT
content-type: application/octet-stream
content-length: 2510392
last-modified: Thu, 12 Sep 2024 13:15:00 GMT
etag: "66e2e954-264e38"
content-disposition: attachment; filename="TelamonCleaner_id66e3bf6ceb457og.exe"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kszgphehUTbZBzHadKeDtkbsz2zPlFb%2FvY7RuRTlR9%2FKLUFhQfry5oVtEyYsgALtH%2FC5AnMljSbphsOx%2BO8LfvxbGtUtF8ki8vJNlriv2xYfQtGtyANDZCq91nK9SoTgpatwBnk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8c2b1cdbedee0b49-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hashfebe52c02ad9fcf24ec163ca99b93dc6 1162862407e7c45eb6c212a6d9d30e3eac81cf0e efd2dc7b47ba70be090d5b3d8191a8ac473f1bb000e22fadc04b31f27775e6e9
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "EFD2DC7B47BA70BE090D5B3D8191A8AC473F1BB000E22FADC04B31F27775E6E9"
Last-Modified: Fri, 13 Sep 2024 01:49:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3736
Expires: Fri, 13 Sep 2024 22:10:45 GMT
Date: Fri, 13 Sep 2024 21:08:29 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash6002601a8837228e424ce5aef3bb9855 8e2999033c471078ec1f31cadd163d67b9d7f6db c26dd37b475e226bf37672bba7f5d90fbc9f578e1c862c3d44cc1f530c8c4d3c
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C26DD37B475E226BF37672BBA7F5D90FBC9F578E1C862C3D44CC1F530C8C4D3C"
Last-Modified: Thu, 12 Sep 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6295
Expires: Fri, 13 Sep 2024 22:53:25 GMT
Date: Fri, 13 Sep 2024 21:08:30 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash6002601a8837228e424ce5aef3bb9855 8e2999033c471078ec1f31cadd163d67b9d7f6db c26dd37b475e226bf37672bba7f5d90fbc9f578e1c862c3d44cc1f530c8c4d3c
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C26DD37B475E226BF37672BBA7F5D90FBC9F578E1C862C3D44CC1F530C8C4D3C"
Last-Modified: Thu, 12 Sep 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6295
Expires: Fri, 13 Sep 2024 22:53:25 GMT
Date: Fri, 13 Sep 2024 21:08:30 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash6002601a8837228e424ce5aef3bb9855 8e2999033c471078ec1f31cadd163d67b9d7f6db c26dd37b475e226bf37672bba7f5d90fbc9f578e1c862c3d44cc1f530c8c4d3c
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C26DD37B475E226BF37672BBA7F5D90FBC9F578E1C862C3D44CC1F530C8C4D3C"
Last-Modified: Thu, 12 Sep 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6295
Expires: Fri, 13 Sep 2024 22:53:25 GMT
Date: Fri, 13 Sep 2024 21:08:30 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash6002601a8837228e424ce5aef3bb9855 8e2999033c471078ec1f31cadd163d67b9d7f6db c26dd37b475e226bf37672bba7f5d90fbc9f578e1c862c3d44cc1f530c8c4d3c
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C26DD37B475E226BF37672BBA7F5D90FBC9F578E1C862C3D44CC1F530C8C4D3C"
Last-Modified: Thu, 12 Sep 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6295
Expires: Fri, 13 Sep 2024 22:53:25 GMT
Date: Fri, 13 Sep 2024 21:08:30 GMT
Connection: keep-alive
|
|
| aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml | 35.244.181.201 | | 444 B |
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP 35.244.181.201:0
ASN#396982 GOOGLE-CLOUD-PLATFORM
File typeXML 1.0 document, ASCII text, with very long lines (332) Hash3b324dec137a87ef7e24a30a65b13dd0 c0faa95b2f1018e264b3a14aaf50d1003e6c27b3 6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463
GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/202402/aus.content-signature.mozilla.org-2024-11-02-12-44-24.chain; p384ecdsa=ZGNr_knufSX55PGuJ7Eb8wDkoRlLUv8-Fzjeilid0BPE0O_LxBmZPC7mZfWYP-ZfmolvlqUk5m-zLTFIDpwC4NLsCuU1mcVFodyjle3YbHCuspdTQHQylWjuFTop1aOC
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
date: Fri, 13 Sep 2024 21:06:42 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 124
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
|
|