IP 104.18.15.101:0
Hash604f4c98b40249638143e487e16fdbdc 64d9a57367e7c988827fd65c9f864190a95b909b 86996b1a60e210c76a051bf5b46ebbd93b3fbf03b0a1ff1c84e912cef4836088
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 07 Sep 2023 01:12:18 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Tue, 05 Sep 2023 22:51:00 GMT
Expires: Tue, 12 Sep 2023 22:50:59 GMT
Etag: "64d9a57367e7c988827fd65c9f864190a95b909b"
Cache-Control: max-age=510335,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 802b15288860b51b-OSL
|
| webtools.avanquest.com/download.cfm?tracking=AQ_FR_PP_SNW_OSPCC&keyword=NDcjNDgxIzIyIzEwNTJ8NTE5N3xGUnwyfDF8fGN6SnoqU2taRE1UYzNOMTkzT1RSQ1ZrOXVOVkpqTFZCalYzWkNWM2RrU0VwWHx8&campaignID=SNW&clickid=MzAjNDgxIzIyIzEwNTJ8NTE5N3xGUnwyfDF8fGN6SnoqU2taRE1UYzNOMTkzT1RSQ1ZrOXVOVkpqTFZCalYzWkNWM2RrU0VwWHx8&filter=294&skip=&gclid=&uid=&go=https://cdn.onesafe-software.com/OneSafe_PC_Cleaner/OneSafe_PC_Cleaner.exe |  37.59.71.200 | 302 Found | 208 B |
URL User Request GET HTTP/1.1webtools.avanquest.com/download.cfm?tracking=AQ_FR_PP_SNW_OSPCC&keyword=NDcjNDgxIzIyIzEwNTJ8NTE5N3xGUnwyfDF8fGN6SnoqU2taRE1UYzNOMTkzT1RSQ1ZrOXVOVkpqTFZCalYzWkNWM2RrU0VwWHx8&campaignID=SNW&clickid=MzAjNDgxIzIyIzEwNTJ8NTE5N3xGUnwyfDF8fGN6SnoqU2taRE1UYzNOMTkzT1RSQ1ZrOXVOVkpqTFZCalYzWkNWM2RrU0VwWHx8&filter=294&skip=&gclid=&uid=&go=https://cdn.onesafe-software.com/OneSafe_PC_Cleaner/OneSafe_PC_Cleaner.exe IP37.59.71.200:443
CertificateIssuerSectigo Limited Subject*.avanquest.com Fingerprint31:76:7C:48:AE:2B:27:7D:69:32:B5:DE:2C:FD:74:D9:A3:C5:3D:6C ValidityWed, 26 Apr 2023 00:00:00 GMT - Mon, 20 May 2024 23:59:59 GMT
File typeASCII text, with CRLF line terminators Hash9b67200d79ec006d5be9003f58c9794b 0b78197a61e57106255d029d4d7246d90290d686 bf5d1aa2a1d94cafb3fa17c05dc0019dbcc145574c07f443a65a026620ed6f4c
GET /download.cfm?tracking=AQ_FR_PP_SNW_OSPCC&keyword=NDcjNDgxIzIyIzEwNTJ8NTE5N3xGUnwyfDF8fGN6SnoqU2taRE1UYzNOMTkzT1RSQ1ZrOXVOVkpqTFZCalYzWkNWM2RrU0VwWHx8&campaignID=SNW&clickid=MzAjNDgxIzIyIzEwNTJ8NTE5N3xGUnwyfDF8fGN6SnoqU2taRE1UYzNOMTkzT1RSQ1ZrOXVOVkpqTFZCalYzWkNWM2RrU0VwWHx8&filter=294&skip=&gclid=&uid=&go=https://cdn.onesafe-software.com/OneSafe_PC_Cleaner/OneSafe_PC_Cleaner.exe HTTP/1.1
Host: webtools.avanquest.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
Location: https://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/OneSafe_PC_Cleaner.exe
Set-Cookie: LOGINTOKEN=293359718; Path=/
LOGINTOKEN=293359718; expires=Sat, 07 Oct 2023 01:12:18 -0000; domain=avanquest.com; path=/
Date: Thu, 07 Sep 2023 01:12:17 GMT
Transfer-Encoding: chunked
|
| ocsp.r2m01.amazontrust.com/ |  143.204.48.16 | | 471 B |
URL ocsp.r2m01.amazontrust.com/ IP143.204.48.16:0
Hash941a2f8370c7a788a07c6124f9585e6c 265c07a7220951935fe2bf045f40e440c982d015 600c94f2bf0ee262032d147051d34fbe56dcc80b28c37cf15c0cce6ecb8d060b
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Thu, 07 Sep 2023 01:12:18 GMT
Server: ECAcc (amb/6BDA)
X-Cache: Miss from cloudfront
Via: 1.1 a6d89f7e2d55548b941f1ff5d5b3c8d4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Q6EM5vHWP-5QZtFKx-CTbcKppjwUH1n5aDs1_IX8DU6dQm4bOeWkjg==
|
| cdn.onesafe-software.com/OneSafe_PC_Cleaner/OneSafe_PC_Cleaner.exe | 54.230.111.98 | 200 OK | 7.3 MB |
URL User Request GET HTTP/1.1cdn.onesafe-software.com/OneSafe_PC_Cleaner/OneSafe_PC_Cleaner.exe IP54.230.111.98:443
CertificateIssuerAmazon Subject*.avanquest.com FingerprintEF:20:6D:3C:B2:26:3D:C3:C4:3F:F6:B5:9D:7C:DF:13:FB:43:93:E2 ValidityFri, 24 Feb 2023 00:00:00 GMT - Tue, 21 Nov 2023 23:59:59 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows\012- data Size7.3 MB (7264336 bytes) Hashbd915294c30f9307f8ab8c5976ab1e3b 35e815e1fdc4a25a5373a9ae22408797fb7ed7fb 9952770ccfc35146b9c66c8b713a5c62bfd414233962c8677566f7165f1d1ad0
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | suspicious | |
GET /OneSafe_PC_Cleaner/OneSafe_PC_Cleaner.exe HTTP/1.1
Host: cdn.onesafe-software.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-msdownload
Content-Length: 7264336
Connection: keep-alive
Date: Thu, 07 Sep 2023 01:12:20 GMT
Last-Modified: Wed, 11 Jan 2023 10:17:08 GMT
ETag: "bd915294c30f9307f8ab8c5976ab1e3b"
x-amz-server-side-encryption: AES256
x-amz-meta-version-id: rx7fI9BEn34CPaEJii4IRL0ctTMDsL3V
x-amz-version-id: VUZwo6NrI84dG_qpwfZzqOlkYsEBe0WY
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Miss from cloudfront
Via: 1.1 4bbc14b5834fc74ccd249b954b43a08c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 7t9vKQwsGpj0sZ37-42ZTagL_VLmxiywHO3LewnerC9pNi_lCwMj-Q==
|