Report - assets.macroplant.com/download/51/Dupe%20Away-3.1.1.exe?1480711814

Report Overview

Visited public
2024-07-16 01:45:22
Tags
URL
assets.macroplant.com/download/51/Dupe%20Away-3.1.1.exe?1480711814
Finishing URL
about:privatebrowsing
IP / ASN
172.67.170.89
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
assets.macroplant.com	unknown	2009-11-25	2017-01-10 11:48:08	2024-04-17 15:24:18	520 B	2.1 MB	172.67.170.89
aus5.mozilla.org	2548	1998-01-24	2015-10-27 08:06:24	2024-07-14 18:12:58	512 B	1.2 kB	35.244.181.201
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-14 18:12:33	3.3 kB	8.9 kB	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
assets.macroplant.com/download/51/Dupe%20Away-3.1.1.exe?1480711814
IP
172.67.170.89
ASN
#13335 CLOUDFLARENET

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
Size
2.1 MB (2076632 bytes)
Hash
48417d816f9216d4d092f58e785a2e78
a4ea779eb1c3bc6bfa085ee4eeebe67049495055
2626a36cfa6969ca37703331afc0478075385acd2b50a7dad4f9dc4e9ae1882a

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/74

JavaScript (0)

HTTP Transactions (12)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
df85487917ffcb9ff9393daa9c628bc8
73e600fa168021b1cfd00f6a00dff1678e018aaa
c694b95afc4423cf3e039cea969256e7957ff30ee11fa6cd2c5432bd7b72686b

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C694B95AFC4423CF3E039CEA969256E7957FF30EE11FA6CD2C5432BD7B72686B"
Last-Modified: Mon, 15 Jul 2024 19:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4358
Expires: Tue, 16 Jul 2024 02:57:35 GMT
Date: Tue, 16 Jul 2024 01:44:57 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
0ba28ae3ca920c46edf9c7a1f79db3ca
b96f7bd71a6b1f9e08b5a0179c66553bf42875d2
e4acaf4113d4cda75edbbae5d28e17dffb959489cd6912b854c9e87a3ab50fd2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E4ACAF4113D4CDA75EDBBAE5D28E17DFFB959489CD6912B854C9E87A3AB50FD2"
Last-Modified: Mon, 15 Jul 2024 20:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15083
Expires: Tue, 16 Jul 2024 05:56:20 GMT
Date: Tue, 16 Jul 2024 01:44:57 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c827d32609521c1e56829aac4640ab87
f6721b2c6abc469be2b70d165a58c75d5637408d
a951edc9fce6d26583509aba1a0d759172986da854406dc2041f25dca4eb6798

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A951EDC9FCE6D26583509ABA1A0D759172986DA854406DC2041F25DCA4EB6798"
Last-Modified: Mon, 15 Jul 2024 19:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17259
Expires: Tue, 16 Jul 2024 06:32:36 GMT
Date: Tue, 16 Jul 2024 01:44:57 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
d69acaa73161ea261cea420c9548c854
1f7cab04c4264ca503bb3e2d8f1d838c226f35c2
e4e3975a941c93fda56279b3918d81448b74cd06d2a2bd0280dbcf8e58712c1d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E4E3975A941C93FDA56279B3918D81448B74CD06D2A2BD0280DBCF8E58712C1D"
Last-Modified: Mon, 15 Jul 2024 19:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10630
Expires: Tue, 16 Jul 2024 04:42:07 GMT
Date: Tue, 16 Jul 2024 01:44:57 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
aaea61f25ae478356ba17d6a880cf7e9
f98dbbbe8056956136db3881f5cf0b5f82bcc79f
87d137fcf3642e83d7d80b92c3071a241550f6e6e1f1981653373ae4367a723d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "87D137FCF3642E83D7D80B92C3071A241550F6E6E1F1981653373AE4367A723D"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11343
Expires: Tue, 16 Jul 2024 04:54:01 GMT
Date: Tue, 16 Jul 2024 01:44:58 GMT
Connection: keep-alive

assets.macroplant.com/download/51/Dupe%20Away-3.1.1.exe?1480711814

172.67.170.89

200 OK

2.1 MB

URL User Request GET HTTP/2
assets.macroplant.com/download/51/Dupe%20Away-3.1.1.exe?1480711814
IP
172.67.170.89:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectmacroplant.com
Fingerprint97:5D:3A:F7:D1:05:26:32:DE:C3:AE:FD:A1:FC:FF:E7:CD:A4:06:29
ValidityTue, 11 Jun 2024 18:18:34 GMT - Mon, 09 Sep 2024 18:18:33 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
Size
2.1 MB (2076632 bytes)
Hash
48417d816f9216d4d092f58e785a2e78
a4ea779eb1c3bc6bfa085ee4eeebe67049495055
2626a36cfa6969ca37703331afc0478075385acd2b50a7dad4f9dc4e9ae1882a

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/74

HTTP Headers

GET /download/51/Dupe%20Away-3.1.1.exe?1480711814 HTTP/1.1
Host: assets.macroplant.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Jul 2024 01:44:58 GMT
content-type: application/x-ms-dos-executable
content-length: 2076632
last-modified: Wed, 14 Oct 2020 13:42:54 GMT
etag: "48417d816f9216d4d092f58e785a2e78"
x-cache: Miss from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: BFsqVMz2vM2RtQEdnUrw-QoYbKHHxc1GNYCrU9xG_R-L4_UcULwizA==
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C7HS9LrTpQ83pB1aCF7YkLY5M1JxiqOPFLptN9XvShuk%2B9J8%2FU%2FyARecuefxHkAQFXwQOhHtS3cg0jFOxU303XpY8Ey8MCn1hgoB2TFCJ%2FpnOhwBQLPYUBnRNJpf5ObFiOKGnkEO0g4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a3e4f610f1d0b02-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8437
Expires: Tue, 16 Jul 2024 04:05:36 GMT
Date: Tue, 16 Jul 2024 01:44:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8437
Expires: Tue, 16 Jul 2024 04:05:36 GMT
Date: Tue, 16 Jul 2024 01:44:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8437
Expires: Tue, 16 Jul 2024 04:05:36 GMT
Date: Tue, 16 Jul 2024 01:44:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8437
Expires: Tue, 16 Jul 2024 04:05:36 GMT
Date: Tue, 16 Jul 2024 01:44:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c5fe3e5860e9afb843ae32b8f349f4c7
78e8faf3194e82bcb4fed0d89bd1989501dd8d2a
806921e95846539e7849756068c5afcd2fb93d1ccbb7604b5d8d18805538faf5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "806921E95846539E7849756068C5AFCD2FB93D1CCBB7604B5D8D18805538FAF5"
Last-Modified: Mon, 15 Jul 2024 20:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8437
Expires: Tue, 16 Jul 2024 04:05:36 GMT
Date: Tue, 16 Jul 2024 01:44:59 GMT
Connection: keep-alive

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/202402/aus.content-signature.mozilla.org-2024-09-02-22-40-36.chain; p384ecdsa=B87pF9P0CqmWB2j_YlngmQxWjuve4QG7OIrs9_ppXIlvxmfjI4ITzDcxi0XvMnC68cNrB8Qnv07JU3hIR5tejfYMLZv6CYqkGKvNZQUGosgdSDE9vsRKlHlKFsDNYKmO
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Tue, 16 Jul 2024 01:43:39 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 97
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (12)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers