| my.microsoftpersonalcontent.com/personal/2dbfbf3af7292f39/_layouts/15/download.aspx?UniqueId=f7292f39-bf3a-20bf-802d-933a00000000&Translate=false&tempauth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhcHBfZGlzcGxheW5hbWUiOiJHcmFwaCIsImFwcGlkIjoiMDAwMDAwMDMtMDAwMC0wMDAwLWMwMDAtMDAwMDAwMDAwMDAwIiwiYXVkIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL215Lm1pY3Jvc29mdHBlcnNvbmFsY29udGVudC5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8MDAwMzdmZmViZGQ3ZDA3NkBsaXZlLmNvbSIsImNpZCI6InU2azk4T3FKUDBDZTQ5WENYZmQwSkE9PSIsImVuZHBvaW50dXJsIjoiZWZCUTJJcEREVStUdjhXQUs1cnJONnp1cFFnNTRwWVNhUkF5Z1M4VnZ6TT0iLCJlbmRwb2ludHVybExlbmd0aCI6IjE1MyIsImV4cCI6IjE3MTM5ODU2OTMiLCJpcGFkZHIiOiI1Mi4xMDQuNjAuMTQwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJuYmYiOiIxNzEzOTgyMDkzIiwicHVpZCI6IjAwMDM3RkZFQkREN0QwNzYiLCJzY3AiOiJteWZpbGVzLnJlYWQgYWxsZmlsZXMud3JpdGUgYWxscHJvZmlsZXMucmVhZCIsInNpZCI6IjEyMzIxNjMyMTUxNzczODg4MDM1XzIyOGE2OTBkLTNiYWItNDNjYy05YmEyLTJiMTIxZjIwZThkMCIsInNpdGVpZCI6IlpUTTJNalk0TmpRdFpEQXlNUzAwTm1Jd0xUa3pPV0l0T0RnNFpERXlOalE0WldRMCIsInRpZCI6IjkxODgwNDBkLTZjNjctNGM1Yi1iMTEyLTM2YTMwNGI2NmRhZCIsInR0IjoiMiIsInVwbiI6ImtlbmcuZWxlZ2FuY2ViaXpAZ21haWwuY29tIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.9XuJ1M6gRCD_4QGXXbGIT09rmMW9qd-b8afPnrXyjHk&ApiVersion=2.0 |  52.105.41.25 | 200 OK | 335 kB |
URL User Request GET HTTP/2my.microsoftpersonalcontent.com/personal/2dbfbf3af7292f39/_layouts/15/download.aspx?UniqueId=f7292f39-bf3a-20bf-802d-933a00000000&Translate=false&tempauth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhcHBfZGlzcGxheW5hbWUiOiJHcmFwaCIsImFwcGlkIjoiMDAwMDAwMDMtMDAwMC0wMDAwLWMwMDAtMDAwMDAwMDAwMDAwIiwiYXVkIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL215Lm1pY3Jvc29mdHBlcnNvbmFsY29udGVudC5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8MDAwMzdmZmViZGQ3ZDA3NkBsaXZlLmNvbSIsImNpZCI6InU2azk4T3FKUDBDZTQ5WENYZmQwSkE9PSIsImVuZHBvaW50dXJsIjoiZWZCUTJJcEREVStUdjhXQUs1cnJONnp1cFFnNTRwWVNhUkF5Z1M4VnZ6TT0iLCJlbmRwb2ludHVybExlbmd0aCI6IjE1MyIsImV4cCI6IjE3MTM5ODU2OTMiLCJpcGFkZHIiOiI1Mi4xMDQuNjAuMTQwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJuYmYiOiIxNzEzOTgyMDkzIiwicHVpZCI6IjAwMDM3RkZFQkREN0QwNzYiLCJzY3AiOiJteWZpbGVzLnJlYWQgYWxsZmlsZXMud3JpdGUgYWxscHJvZmlsZXMucmVhZCIsInNpZCI6IjEyMzIxNjMyMTUxNzczODg4MDM1XzIyOGE2OTBkLTNiYWItNDNjYy05YmEyLTJiMTIxZjIwZThkMCIsInNpdGVpZCI6IlpUTTJNalk0TmpRdFpEQXlNUzAwTm1Jd0xUa3pPV0l0T0RnNFpERXlOalE0WldRMCIsInRpZCI6IjkxODgwNDBkLTZjNjctNGM1Yi1iMTEyLTM2YTMwNGI2NmRhZCIsInR0IjoiMiIsInVwbiI6ImtlbmcuZWxlZ2FuY2ViaXpAZ21haWwuY29tIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.9XuJ1M6gRCD_4QGXXbGIT09rmMW9qd-b8afPnrXyjHk&ApiVersion=2.0 IP52.105.41.25:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
CertificateIssuerDigiCert Inc Subjectmicrosoftpersonalcontent.com FingerprintA8:09:B0:F4:89:0A:FC:B3:68:53:0D:FD:29:5E:EF:35:19:FC:0B:F6 ValidityTue, 05 Sep 2023 00:00:00 GMT - Thu, 05 Sep 2024 23:59:59 GMT
File typePE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections Size335 kB (335360 bytes) Hash31dab06a97d7bc6435eb03ad27c7c16c a72ba7d99bbe54cad05c6c048eb3f57352d8e8d6 2d95ff9d84ab9eef14e6a5990f7b2a4c74323e550470955edfc023fa763e35f3
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | suspicious | |
GET /personal/2dbfbf3af7292f39/_layouts/15/download.aspx?UniqueId=f7292f39-bf3a-20bf-802d-933a00000000&Translate=false&tempauth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhcHBfZGlzcGxheW5hbWUiOiJHcmFwaCIsImFwcGlkIjoiMDAwMDAwMDMtMDAwMC0wMDAwLWMwMDAtMDAwMDAwMDAwMDAwIiwiYXVkIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL215Lm1pY3Jvc29mdHBlcnNvbmFsY29udGVudC5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8MDAwMzdmZmViZGQ3ZDA3NkBsaXZlLmNvbSIsImNpZCI6InU2azk4T3FKUDBDZTQ5WENYZmQwSkE9PSIsImVuZHBvaW50dXJsIjoiZWZCUTJJcEREVStUdjhXQUs1cnJONnp1cFFnNTRwWVNhUkF5Z1M4VnZ6TT0iLCJlbmRwb2ludHVybExlbmd0aCI6IjE1MyIsImV4cCI6IjE3MTM5ODU2OTMiLCJpcGFkZHIiOiI1Mi4xMDQuNjAuMTQwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJuYmYiOiIxNzEzOTgyMDkzIiwicHVpZCI6IjAwMDM3RkZFQkREN0QwNzYiLCJzY3AiOiJteWZpbGVzLnJlYWQgYWxsZmlsZXMud3JpdGUgYWxscHJvZmlsZXMucmVhZCIsInNpZCI6IjEyMzIxNjMyMTUxNzczODg4MDM1XzIyOGE2OTBkLTNiYWItNDNjYy05YmEyLTJiMTIxZjIwZThkMCIsInNpdGVpZCI6IlpUTTJNalk0TmpRdFpEQXlNUzAwTm1Jd0xUa3pPV0l0T0RnNFpERXlOalE0WldRMCIsInRpZCI6IjkxODgwNDBkLTZjNjctNGM1Yi1iMTEyLTM2YTMwNGI2NmRhZCIsInR0IjoiMiIsInVwbiI6ImtlbmcuZWxlZ2FuY2ViaXpAZ21haWwuY29tIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.9XuJ1M6gRCD_4QGXXbGIT09rmMW9qd-b8afPnrXyjHk&ApiVersion=2.0 HTTP/1.1
Host: my.microsoftpersonalcontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: private
via: 190404;194019
content-type: application/octet-stream
accept-ranges: bytes
etag: "{F7292F39-BF3A-20BF-802D-933A00000000},2"
x-networkstatistics: 0,525568,0,0,319,0,24154
x-sharepointhealthscore: 3
docid: my.microsoftpersonalcontent.com_e3626864-d021-46b0-939b-888d12648ed4_f7292f39-bf3a-20bf-802d-933a00000000
x-download-options: noopen
content-disposition: attachment;filename*=utf-8''nn%5FFengShui100Update%2Eexe;filename="nn_FengShui100Update.exe"
ctag: {F7292F39-BF3A-20BF-802D-933A00000000},2,2
spnumhops: 1
x-databoundary: NONE
x-1dscollectorurl: https://mobile.events.data.microsoft.com/OneCollector/1.0/
x-ariacollectorurl: https://browser.pipe.aria.microsoft.com/Collector/3.0/
sprequestguid: 813722a1-b018-8000-ac27-a8cb58c155b7
request-id: 813722a1-b018-8000-ac27-a8cb58c155b7
ms-cv: oSI3gRiwAICsJ6jLWMFVtw.0
report-to: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&destinationEndpoint=194019&frontEnd=FarmDirect&RemoteIP=52.105.41.0"}]}
nel: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}
strict-transport-security: max-age=31536000
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.office365.com *.powerapps.com *.yammer.com engage.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
sprequestduration: 1017
spiislatency: 1
x-powered-by: ASP.NET
microsoftsharepointteamservices: 16.0.0.24727, 16.0.0.24810
x-content-type-options: nosniff
x-ms-invokeapp: 1; RequireReadOnly
p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
date: Wed, 24 Apr 2024 18:08:14 GMT
content-length: 335360
X-Firefox-Spdy: h2
|
| 3eyzcc3jnhur11lv81tbsa.on.drv.tw/My_Universe/FengShui100/USB_Thai2/nn_FengShui100Update.exe |  47.251.10.111 | 302 Found | 335 kB |
URL User Request GET HTTP/23eyzcc3jnhur11lv81tbsa.on.drv.tw/My_Universe/FengShui100/USB_Thai2/nn_FengShui100Update.exe IP47.251.10.111:443 ASN#45102 Alibaba US Technology Co., Ltd.
CertificateIssuerLet's Encrypt Subjectdrv.tw Fingerprint4B:B2:04:3C:DD:0F:86:4A:61:1B:25:6A:B8:34:52:F2:F7:0E:C2:82 ValidityTue, 27 Feb 2024 15:36:01 GMT - Mon, 27 May 2024 15:36:00 GMT
Size335 kB (335360 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /My_Universe/FengShui100/USB_Thai2/nn_FengShui100Update.exe HTTP/1.1
Host: 3eyzcc3jnhur11lv81tbsa.on.drv.tw
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx/1.14.0 (Ubuntu)
date: Wed, 24 Apr 2024 18:08:13 GMT
content-type: text/html
vary: Origin, Sec-Fetch-Mode, X-Requested-Wtih
etag: "c:{F7292F39-BF3A-20BF-802D-933A00000000},2"
location: https://my.microsoftpersonalcontent.com/personal/2dbfbf3af7292f39/_layouts/15/download.aspx?UniqueId=f7292f39-bf3a-20bf-802d-933a00000000&Translate=false&tempauth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhcHBfZGlzcGxheW5hbWUiOiJHcmFwaCIsImFwcGlkIjoiMDAwMDAwMDMtMDAwMC0wMDAwLWMwMDAtMDAwMDAwMDAwMDAwIiwiYXVkIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL215Lm1pY3Jvc29mdHBlcnNvbmFsY29udGVudC5jb21AOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8MDAwMzdmZmViZGQ3ZDA3NkBsaXZlLmNvbSIsImNpZCI6InU2azk4T3FKUDBDZTQ5WENYZmQwSkE9PSIsImVuZHBvaW50dXJsIjoiZWZCUTJJcEREVStUdjhXQUs1cnJONnp1cFFnNTRwWVNhUkF5Z1M4VnZ6TT0iLCJlbmRwb2ludHVybExlbmd0aCI6IjE1MyIsImV4cCI6IjE3MTM5ODU2OTMiLCJpcGFkZHIiOiI1Mi4xMDQuNjAuMTQwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJuYmYiOiIxNzEzOTgyMDkzIiwicHVpZCI6IjAwMDM3RkZFQkREN0QwNzYiLCJzY3AiOiJteWZpbGVzLnJlYWQgYWxsZmlsZXMud3JpdGUgYWxscHJvZmlsZXMucmVhZCIsInNpZCI6IjEyMzIxNjMyMTUxNzczODg4MDM1XzIyOGE2OTBkLTNiYWItNDNjYy05YmEyLTJiMTIxZjIwZThkMCIsInNpdGVpZCI6IlpUTTJNalk0TmpRdFpEQXlNUzAwTm1Jd0xUa3pPV0l0T0RnNFpERXlOalE0WldRMCIsInRpZCI6IjkxODgwNDBkLTZjNjctNGM1Yi1iMTEyLTM2YTMwNGI2NmRhZCIsInR0IjoiMiIsInVwbiI6ImtlbmcuZWxlZ2FuY2ViaXpAZ21haWwuY29tIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.9XuJ1M6gRCD_4QGXXbGIT09rmMW9qd-b8afPnrXyjHk&ApiVersion=2.0
cache-control: public, s-maxage=1429, max-age=1429
x-d2w-target-length: 335360
x-cache: BYPASS
set-cookie: uid=rBI/+mYpSo2OQytbGZKYAg==; path=/
X-Firefox-Spdy: h2
|