{"report_id":"92edb2d0-34b6-4022-a2ba-04d780a0d190","version":6,"status":"done","tags":[],"date":"2024-07-10T12:03:28Z","url":{"schema":"http","addr":"raw.githubusercontent.com/Mx2Ro/Programs/main/Mxu.zip","fqdn":"raw.githubusercontent.com","domain":"raw.githubusercontent.com","tld":"githubusercontent.com"},"ip":{"addr":"185.199.108.133","port":0,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-25T10:15:08Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"r10.o.lencr.org","ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2020-06-29","domain_rank":0,"first_seen":"2024-06-06 21:45:11","last_seen":"2024-07-08 18:12:20","alert_count":0,"request_count":7,"received_data":6212,"sent_data":2289,"comment":"","tags":null,"fingerprints":null},{"fqdn":"raw.githubusercontent.com","ip":{"addr":"185.199.110.133","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2014-02-06","domain_rank":35802,"first_seen":"2014-03-01 08:08:08","last_seen":"2024-07-08 21:59:16","alert_count":1,"request_count":1,"received_data":10218319,"sent_data":507,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"36dea6285a709cb91836395c96c339e8","sha1":"95ef7158432d8e68963109534992f0c1c94ecf2e","sha256":"e9071dbb015ba6b783cf20d47a445d40149d39d8ca6cf5128d9cfb5e6cb3f29e","sha512":"90c0b3391aa7686b7607c879abf0a8b5297ddb1bfe0045c602b78e0e35dccf9021605896469014a1ea836deedea7fdf6f3c019704647527de9eb524adcbad33d","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","size":10217430,"url":{"schema":"https","addr":"raw.githubusercontent.com/Mx2Ro/Programs/main/Mxu.zip","fqdn":"raw.githubusercontent.com","domain":"raw.githubusercontent.com","tld":"githubusercontent.com"},"ip":{"addr":"185.199.110.133","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"archive":[{"path":"adwcleaner.exe","filename":"adwcleaner.exe","modified":"","Modified":"2024-06-28T16:23:03+03:00","magic":"PE32 executable (console) Intel 80386, for MS Windows, UPX compressed, 3 sections","size":8790880,"md5":"f0cb04ad4c15fba31532eb922fa6de6f","sha1":"097d5c12eae63ba6f9e7791aa4d65c6dddb4bce9","sha256":"91068efbef44f8ceedbbbdfeea8959633c4ecc9100c3ba08b2603d7c5d59ac22","sha512":"5ada7baa49edc7ad430f1e242b0fb648018b25dda7466059b2c963f95881de0be867e0237fc4fca997ad420c2c6a42c39db0a9e0242c58ac02b6a575388f0848","alerts":{"urlquery":null,"analyzer":null}},{"path":"DeviceCleanup.exe","filename":"DeviceCleanup.exe","modified":"","Modified":"2024-06-28T16:23:15+03:00","magic":"PE32+ executable (GUI) x86-64, for MS Windows, 6 sections","size":76832,"md5":"421697493452ba5ecb8cff039f848de2","sha1":"c6de1bd6914592bf0023e81b1d34372c7572d523","sha256":"76ecfda929285dbe75c877455332bbf30218269c03700b4e884345cf9b3ba6b5","sha512":"d58b15608a02e55212194bf3261b2ecb9568a9a79e6a73ff4e06269182ff8be518de4b5f985c55580f8f9561ba89f51dd1c0842b662f3c0209d3e3c29983e3db","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-05-27","alert":"Scan result 1/74","trigger":"76ecfda929285dbe75c877455332bbf30218269c03700b4e884345cf9b3ba6b5","verdict":"suspicious","severity":"","comment":"suspicious - 1/74","link":"https://www.virustotal.com/gui/file/76ecfda929285dbe75c877455332bbf30218269c03700b4e884345cf9b3ba6b5","meta":null}]}},{"path":"FilterKeysSetter.exe","filename":"FilterKeysSetter.exe","modified":"","Modified":"2024-06-28T16:23:28+03:00","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","size":184320,"md5":"f1d3764945a221d969ba6a1a00af5a8a","sha1":"e1a2b330f9ce78580c7628de30ee2d8d263da2b6","sha256":"1c838c8d8fff838cdb583cf76ff61c8002df9be7d617da6094175d4d78697023","sha512":"dd686059d744134931c98d6374275937407b2e1cd90f6b4edcd09c71783d1fbed21e56d9efc457fc4176fe5709381e7e579d2ed8c5f8fedc22f54ebd6845e935","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-07-04","alert":"Scan result 3/74","trigger":"1c838c8d8fff838cdb583cf76ff61c8002df9be7d617da6094175d4d78697023","verdict":"suspicious","severity":"","comment":"suspicious - 3/74","link":"https://www.virustotal.com/gui/file/1c838c8d8fff838cdb583cf76ff61c8002df9be7d617da6094175d4d78697023","meta":null}]}},{"path":"MSIModeTool.exe","filename":"MSIModeTool.exe","modified":"","Modified":"2024-06-28T16:23:41+03:00","magic":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","size":36352,"md5":"e8d5d8ff6f7a450b41db1c43f50850a9","sha1":"b03a00f45d26342a19e6c2c9f5ed09258a3e2721","sha256":"0142afc21fe61aa4209a4b0d994d724f743718f1f42ec07e41fc63cc43fb6ca6","sha512":"2562592019b45c0a2fe14015cf48b886ce42e2bbd2e9aca855224a3265af8147778bf532e26de638858f16a4305a966e52f603a3d9218fd60b95f0fd002b9efc","alerts":{"urlquery":null,"analyzer":null}},{"path":"Optimizer.exe","filename":"Optimizer.exe","modified":"","Modified":"2024-06-28T16:23:52+03:00","magic":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","size":2234368,"md5":"2f348d2a190018f08e51989935fe61de","sha1":"ef48a23bdee3f46858e5dcdfd0e7ba9dde8950d6","sha256":"0f225c69528a10e2e4616bf00cb5164b8a010f630d774ac2989916d477cf75fd","sha512":"0ad3f4b18219ffe3ce6181914c9055e2d39528b2f67a769bba50f55a6beb12c66d54ef9826d044e42c957dab95d417e7377a3f3edbd1ed1a3ca5762b99a09e6e","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-07-10","alert":"Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen","trigger":"Optimizer.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"iam-py-test","date":"2022-11-19","description":"Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen","false_positives":"Files modifying Defender for legitimate purposes, files containing registry keys related to Defender (i.e. diagnostic tools)","rule":"Disable_Defender","yarahub_author_twitter":"@iam_py_test","yarahub_license":"CC0 1.0","yarahub_reference_md5":"799a7f1507e5e7328081a038987e9a6f","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"1fcd3702-cf5b-47b4-919d-6372c5412151"}},{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-02-12","alert":"Scan result 10/72","trigger":"0f225c69528a10e2e4616bf00cb5164b8a010f630d774ac2989916d477cf75fd","verdict":"suspicious","severity":"","comment":"suspicious - 10/72","link":"https://www.virustotal.com/gui/file/0f225c69528a10e2e4616bf00cb5164b8a010f630d774ac2989916d477cf75fd","meta":null}]}},{"path":"UnparkCpu.exe","filename":"UnparkCpu.exe","modified":"","Modified":"2024-06-28T16:24:00+03:00","magic":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","size":897728,"md5":"254fe03a202beb7d68bc322f200a480c","sha1":"8b7b41baa2f7fa830b52a4f70641d6f933018c7a","sha256":"8fce32ef6687aeb691c1a9427cfbf11fd6e9c0407bb8dcbab1f839d88077172e","sha512":"e69df4072539a443fef25bd4a061ff832e905b30789acd683b982f0c98636830af29ed84f2e11c0f074ea7bc7b2854adb9cb2f8d9fdd8c4496c5f952ab39ebdf","alerts":{"urlquery":null,"analyzer":null}},{"path":"WPD.exe","filename":"WPD.exe","modified":"","Modified":"2024-06-28T16:24:18+03:00","magic":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","size":590336,"md5":"65325f636ac238568a21f389387f0299","sha1":"acf8022648f3eab3b6da50e0f90301eefe64a3f7","sha256":"c21e9de5b28de8edfb6b2264b33846e842f7954ad70fa07b3c652feb5f0a09d7","sha512":"9580e5f040f7adb0cfd5dc8749ddc501c97c849fd7bde4b2d66af6beb5d4a2505546b053723d53009ece3014ee87723bbc23729e43c6aec0698ff514c2ac33a2","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-07-05","alert":"Scan result 1/74","trigger":"c21e9de5b28de8edfb6b2264b33846e842f7954ad70fa07b3c652feb5f0a09d7","verdict":"suspicious","severity":"","comment":"suspicious - 1/74","link":"https://www.virustotal.com/gui/file/c21e9de5b28de8edfb6b2264b33846e842f7954ad70fa07b3c652feb5f0a09d7","meta":null}]}}],"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-07-10","alert":"Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen","trigger":"Optimizer.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"iam-py-test","date":"2022-11-19","description":"Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen","false_positives":"Files modifying Defender for legitimate purposes, files containing registry keys related to Defender (i.e. diagnostic tools)","rule":"Disable_Defender","yarahub_author_twitter":"@iam_py_test","yarahub_license":"CC0 1.0","yarahub_reference_md5":"799a7f1507e5e7328081a038987e9a6f","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"1fcd3702-cf5b-47b4-919d-6372c5412151"}},{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-07-04","alert":"Scan result 6/68","trigger":"e9071dbb015ba6b783cf20d47a445d40149d39d8ca6cf5128d9cfb5e6cb3f29e","verdict":"suspicious","severity":"","comment":"suspicious - 6/68","link":"https://www.virustotal.com/gui/file/e9071dbb015ba6b783cf20d47a445d40149d39d8ca6cf5128d9cfb5e6cb3f29e","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:02:59.403770574Z","timestamp":1720612979403,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"41E6A348AAC9E9DB44BFA14B3AA29D411F4489B375AE1F1BE6B0D280AF98541D\"\r\nLast-Modified: Mon, 08 Jul 2024 01:53:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=17867\r\nExpires: Wed, 10 Jul 2024 17:00:46 GMT\r\nDate: Wed, 10 Jul 2024 12:02:59 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"b34ca6af54e2b9fea57d418f5d1928f7","sha1":"510b69f4470789a573217726d6f1a3d6ee765460","sha256":"41e6a348aac9e9db44bfa14b3aa29d411f4489b375ae1f1be6b0d280af98541d","sha512":"56fc288af1ca048d6ad95019c5fe4a6be829ae0e6d834e51d920e79cb96aa3de97763b94d41b4c691f461b7a46ef961dd157b791947e0463310e5d0abd1422c8","ssdeep":"","tlshash":"def0055627d5a6016a710a911de5d31a1e2058fb305018f223d451e33923bbe1ec8446","first_seen":"2024-07-08T05:19:45Z","last_seen":"2024-08-19T17:39:41.553406Z","times_seen":34939,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:02:59.441475255Z","timestamp":1720612979441,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"5F9FEB641B1E74A7C14EEE1104953D1E9FAA0341D1F27FDBD50FA8207E6C0AC8\"\r\nLast-Modified: Tue, 09 Jul 2024 15:27:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=7648\r\nExpires: Wed, 10 Jul 2024 14:10:27 GMT\r\nDate: Wed, 10 Jul 2024 12:02:59 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"c2f3e4e1f94efa7a80f9deeb3d459176","sha1":"7a8f013a3d13ffe4241b8e2a8b9ca63daeeace53","sha256":"5f9feb641b1e74a7c14eee1104953d1e9faa0341d1f27fdbd50fa8207e6c0ac8","sha512":"b31001673f2a70424a77c868b62170411fff1d9ced6cee20cb26b7538d349bc4573cbb80b198779afa9ff558e6719d8d04b694a26cb451f792e8895bf9b29f5f","ssdeep":"","tlshash":"b9f0054712a5ff50a2f0175515f1ea05dd207d792c5015c2759443f23869bf4d5c840e","first_seen":"2024-07-09T21:40:33Z","last_seen":"2024-08-19T17:27:56.105485Z","times_seen":18846,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:02:59.72306877Z","timestamp":1720612979723,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"5D1BC1C01894FD88A0D4680490977488D6458BB58A98ACE24EF8AA103538BC1F\"\r\nLast-Modified: Tue, 09 Jul 2024 23:47:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=16567\r\nExpires: Wed, 10 Jul 2024 16:39:06 GMT\r\nDate: Wed, 10 Jul 2024 12:02:59 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"e7492695b5254a3a63fcffb4f1ee8cec","sha1":"0361713c6d8129210245347284c7c6babfd28fb7","sha256":"5d1bc1c01894fd88a0d4680490977488d6458bb58a98ace24ef8aa103538bc1f","sha512":"ec0e52128f983dbd74415511de8ce735b2b718b43605e9ac47400438cd5e97c87e35eb9ba74da906afc0cc7f6d28beca431b3cd9f15b958bce49500f659db147","ssdeep":"","tlshash":"d5f0549736b6bc516ab835253dfbda3e7a309924b15049bceca51291ec383a7418040c","first_seen":"2024-07-10T02:50:08Z","last_seen":"2024-08-19T17:26:17.073472Z","times_seen":39709,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:02:59.795310775Z","timestamp":1720612979795,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"22F599883DC87540746708049EA46EC4EB88C81C924BA145A58BEBD5EE3199CB\"\r\nLast-Modified: Tue, 09 Jul 2024 16:21:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=16831\r\nExpires: Wed, 10 Jul 2024 16:43:30 GMT\r\nDate: Wed, 10 Jul 2024 12:02:59 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"9b556e25e514a3cd5829bc4d938e5517","sha1":"85eeba07dc1438e7433ce7a145500164d842d5db","sha256":"22f599883dc87540746708049ea46ec4eb88c81c924ba145a58bebd5ee3199cb","sha512":"75b458449c7f8a18c99e53cbb9d4e5b8fdb1f10a8ade5519dbf3e6d1af98b058d7c3d6cb1c193a1db1b5647af3b0cdb0cdd0bfa08b2dd8af44895f225fe59f02","ssdeep":"","tlshash":"d2f0759324a5fd6039f00d1419a4f60c3d414aed281440f9e0a507ff2c51396890c84c","first_seen":"2024-07-09T19:23:51Z","last_seen":"2024-08-19T17:28:50.065285Z","times_seen":12065,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"raw.githubusercontent.com/Mx2Ro/Programs/main/Mxu.zip","fqdn":"raw.githubusercontent.com","domain":"raw.githubusercontent.com","tld":"githubusercontent.com"},"ip":{"addr":"185.199.110.133","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-07-10T12:02:59.883Z","timestamp":1720612979883,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.github.io","organization":"GitHub, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Fri, 15 Mar 2024 00:00:00 GMT","end":"Fri, 14 Mar 2025 23:59:59 GMT"},"fingerprint":{"sha1":"97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28","sha256":"09:01:0C:CE:9B:72:21:55:C7:E6:86:B0:77:39:D3:D2:DC:06:05:DE:A1:A4:98:4A:0B:96:5E:18:77:77:26:B5"}}},"request":{"raw":"GET /Mx2Ro/Programs/main/Mxu.zip HTTP/1.1\r\nHost: raw.githubusercontent.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=300\r\ncontent-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox\r\ncontent-type: application/zip\r\netag: W/\"95165c04acd5cba2232319f88965bc8db4b3fa251afd99c979bda1911576e2af\"\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nx-frame-options: deny\r\nx-xss-protection: 1; mode=block\r\nx-github-request-id: 4E30:370AF7:233A5A2:25093A2:668E785B\r\naccept-ranges: bytes\r\ndate: Wed, 10 Jul 2024 12:02:59 GMT\r\nvia: 1.1 varnish\r\nx-served-by: cache-hel1410020-HEL\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1720612980.924105,VS0,VE1\r\nvary: Authorization,Accept-Encoding,Origin\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-fastly-request-id: 885e4c4dc30d722796d02e8458d2551165b53559\r\nexpires: Wed, 10 Jul 2024 12:07:59 GMT\r\nsource-age: 24\r\ncontent-length: 10217430\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":10217430,"size_decoded":10217430,"mime_type":"application/zip","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","md5":"36dea6285a709cb91836395c96c339e8","sha1":"95ef7158432d8e68963109534992f0c1c94ecf2e","sha256":"e9071dbb015ba6b783cf20d47a445d40149d39d8ca6cf5128d9cfb5e6cb3f29e","sha512":"90c0b3391aa7686b7607c879abf0a8b5297ddb1bfe0045c602b78e0e35dccf9021605896469014a1ea836deedea7fdf6f3c019704647527de9eb524adcbad33d","ssdeep":"196608:6MTU2hxWKGXE2sgp0e45Z1u2YpzagZKpbpiC0vwbh2/c8ZDRrlm1C5w7a:6KFhxWKGUxo0eCYpzRZKpbpiC0YFmQCD","tlshash":"96a63321c6c189c6d9f7823c22396c3a14ac3f7537af3113494a75aa47ac89c3e95b7d","first_seen":"2024-07-07T09:06:25Z","last_seen":"2024-08-19T17:45:00.258253Z","times_seen":3,"resource_available":false,"data":null}},"time_used":740,"timings":{"blocked":35,"dns":1,"connect":13,"send":0,"wait":14,"receive":654,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-07-04","alert":"Scan result 6/68","trigger":"e9071dbb015ba6b783cf20d47a445d40149d39d8ca6cf5128d9cfb5e6cb3f29e","verdict":"suspicious","severity":"","comment":"suspicious - 6/68","link":"https://www.virustotal.com/gui/file/e9071dbb015ba6b783cf20d47a445d40149d39d8ca6cf5128d9cfb5e6cb3f29e","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:03:02.285110042Z","timestamp":1720612982285,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2\"\r\nLast-Modified: Mon, 08 Jul 2024 05:32:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=6251\r\nExpires: Wed, 10 Jul 2024 13:47:13 GMT\r\nDate: Wed, 10 Jul 2024 12:03:02 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"d7b2c37e4b6c062d80ad32046f42d3d8","sha1":"131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c","sha256":"317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2","sha512":"e8d8acac8c0eb8cc7d365eca9121ee37756ccf1d8b77d6177f316593c50a660d3af8ab40f67f47a8fd9fe0fe75f51070e6cf3c69b49f57aed1b4afc155ca5cd3","ssdeep":"","tlshash":"02f00e023df7bd80b3e944911ebde63bf8107aa7305075e630c0828328b87a74744c9a","first_seen":"2024-07-08T09:56:38Z","last_seen":"2024-08-19T17:38:29.907666Z","times_seen":36963,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:03:02.286048545Z","timestamp":1720612982286,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2\"\r\nLast-Modified: Mon, 08 Jul 2024 05:32:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=6251\r\nExpires: Wed, 10 Jul 2024 13:47:13 GMT\r\nDate: Wed, 10 Jul 2024 12:03:02 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"d7b2c37e4b6c062d80ad32046f42d3d8","sha1":"131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c","sha256":"317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2","sha512":"e8d8acac8c0eb8cc7d365eca9121ee37756ccf1d8b77d6177f316593c50a660d3af8ab40f67f47a8fd9fe0fe75f51070e6cf3c69b49f57aed1b4afc155ca5cd3","ssdeep":"","tlshash":"02f00e023df7bd80b3e944911ebde63bf8107aa7305075e630c0828328b87a74744c9a","first_seen":"2024-07-08T09:56:38Z","last_seen":"2024-08-19T17:38:29.907666Z","times_seen":36963,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"r10.o.lencr.org/","fqdn":"r10.o.lencr.org","domain":"lencr.org","tld":"org"},"ip":{"addr":"23.33.119.57","port":0,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-07-10T12:03:02.286683555Z","timestamp":1720612982286,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST / HTTP/1.1\r\nHost: r10.o.lencr.org\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/ocsp-request\r\nContent-Length: 85\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Type: application/ocsp-response\r\nContent-Length: 504\r\nETag: \"317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2\"\r\nLast-Modified: Mon, 08 Jul 2024 05:32:00 UTC\r\nCache-Control: public, no-transform, must-revalidate, max-age=6251\r\nExpires: Wed, 10 Jul 2024 13:47:13 GMT\r\nDate: Wed, 10 Jul 2024 12:03:02 GMT\r\nConnection: keep-alive\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":504,"size_decoded":504,"mime_type":"application/octet-stream","magic":"data","md5":"d7b2c37e4b6c062d80ad32046f42d3d8","sha1":"131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c","sha256":"317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2","sha512":"e8d8acac8c0eb8cc7d365eca9121ee37756ccf1d8b77d6177f316593c50a660d3af8ab40f67f47a8fd9fe0fe75f51070e6cf3c69b49f57aed1b4afc155ca5cd3","ssdeep":"","tlshash":"02f00e023df7bd80b3e944911ebde63bf8107aa7305075e630c0828328b87a74744c9a","first_seen":"2024-07-08T09:56:38Z","last_seen":"2024-08-19T17:38:29.907666Z","times_seen":36963,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}