ocsp.sca1b.amazontrust.com/
471 B URL ocsp.sca1b.amazontrust.com/
IP
Hash 461042e4ee1d3d5402785360e0c9fa7c
fffa2f277fed84d9a08d5337e88eab63224af193
a6913d82f7adb509e3ef169733883bdb4b14ba03b2157bae743f6c88e017c94b
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sat, 29 Apr 2023 08:59:45 GMT
Last-Modified: Sat, 29 Apr 2023 07:40:05 GMT
Server: ECAcc (nya/796A)
X-Cache: Miss from cloudfront
Via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: vMhigm9yCdgzvkaT1ZktfTOWzvDrtK5bCwD-1DoY5Mabk7eGLKCERQ==
Age: 4780
bbuseruploads.s3.amazonaws.com/396aabac-40f5-41cd-a2a6-1862668e4f3b/downloads/66534651-ee7f-4ac9-a53f-9f442814b85f/help-axcient-software.zip?response-content-disposition=attachment%3B%20filename%3D%22help-axcient-software.zip%22&AWSAccessKeyId=ASIA6KOSE3BNPDNXKHV5&Signature=7u6VTloIWmS51AploCuhCiyfDmA%3D&x-amz-security-token=FwoGZXIvYXdzEHoaDCpX5jrKWdyiQdOdtCK%2BAXBMdLXl2I4fb8Jv2f29K5Fl8DKTVRBjW4HjuPcQQ4ckX7gmsyF%2F9MNHgIO7Zze%2Fcz4hSDasggAgoe5BvDo58jzgO65pOvR1vO%2FzPJTLQtWGkqF%2F1utILOxmupXyVFWaIS7WjCv3MTtz2k614hVXcRKiTzGB4POCHZb%2F32JvIY8rDJNrU9t0xnnpC6705mk6dbL7RZVUM0K7EuzB3mSQ%2BQiEkyVmkWyA7dlxc5gv%2FeP3ZV2zIfGKpWGb%2FpeuotYom7WzogYyLYY3qmSYAGPmkYpo0orot35ObL2h92hZ1NJ3DuIa1Ii0ROM8%2F5BqG3nWOnPL4g%3D%3D&Expires=1682760099
26 kB URL bbuseruploads.s3.amazonaws.com/396aabac-40f5-41cd-a2a6-1862668e4f3b/downloads/66534651-ee7f-4ac9-a53f-9f442814b85f/help-axcient-software.zip?response-content-disposition=attachment%3B%20filename%3D%22help-axcient-software.zip%22&AWSAccessKeyId=ASIA6KOSE3BNPDNXKHV5&Signature=7u6VTloIWmS51AploCuhCiyfDmA%3D&x-amz-security-token=FwoGZXIvYXdzEHoaDCpX5jrKWdyiQdOdtCK%2BAXBMdLXl2I4fb8Jv2f29K5Fl8DKTVRBjW4HjuPcQQ4ckX7gmsyF%2F9MNHgIO7Zze%2Fcz4hSDasggAgoe5BvDo58jzgO65pOvR1vO%2FzPJTLQtWGkqF%2F1utILOxmupXyVFWaIS7WjCv3MTtz2k614hVXcRKiTzGB4POCHZb%2F32JvIY8rDJNrU9t0xnnpC6705mk6dbL7RZVUM0K7EuzB3mSQ%2BQiEkyVmkWyA7dlxc5gv%2FeP3ZV2zIfGKpWGb%2FpeuotYom7WzogYyLYY3qmSYAGPmkYpo0orot35ObL2h92hZ1NJ3DuIa1Ii0ROM8%2F5BqG3nWOnPL4g%3D%3D&Expires=1682760099
IP
Hash 22710777cf9b6986abd77b49f5adb8dc
902343941c388ff094f025924419436454edadd7
16f9d8f9612943a8b6ef51e8e824d9fe8bf8faa9f2e356864c727d9b328a1470
GET /396aabac-40f5-41cd-a2a6-1862668e4f3b/downloads/66534651-ee7f-4ac9-a53f-9f442814b85f/help-axcient-software.zip?response-content-disposition=attachment%3B%20filename%3D%22help-axcient-software.zip%22&AWSAccessKeyId=ASIA6KOSE3BNPDNXKHV5&Signature=7u6VTloIWmS51AploCuhCiyfDmA%3D&x-amz-security-token=FwoGZXIvYXdzEHoaDCpX5jrKWdyiQdOdtCK%2BAXBMdLXl2I4fb8Jv2f29K5Fl8DKTVRBjW4HjuPcQQ4ckX7gmsyF%2F9MNHgIO7Zze%2Fcz4hSDasggAgoe5BvDo58jzgO65pOvR1vO%2FzPJTLQtWGkqF%2F1utILOxmupXyVFWaIS7WjCv3MTtz2k614hVXcRKiTzGB4POCHZb%2F32JvIY8rDJNrU9t0xnnpC6705mk6dbL7RZVUM0K7EuzB3mSQ%2BQiEkyVmkWyA7dlxc5gv%2FeP3ZV2zIfGKpWGb%2FpeuotYom7WzogYyLYY3qmSYAGPmkYpo0orot35ObL2h92hZ1NJ3DuIa1Ii0ROM8%2F5BqG3nWOnPL4g%3D%3D&Expires=1682760099 HTTP/1.1
Host: bbuseruploads.s3.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Range: bytes=68833348-
If-Match: "d08b41b3e34eac9d99b4376c0e592eb1-9"
If-Unmodified-Since: Tue, 07 Mar 2023 01:42:24 GMT
HTTP/1.1 206 Partial Content
x-amz-id-2: YAnBVicq41zU0ZopOaLZjh8qNTidllP+eMWSsPTXUpcJCJJElqqukW9Vs1uMrag986CjJqsKOis=
x-amz-request-id: FZ63RNCHC8QX6MQ6
Date: Sat, 29 Apr 2023 08:59:46 GMT
Last-Modified: Tue, 07 Mar 2023 01:42:24 GMT
ETag: "d08b41b3e34eac9d99b4376c0e592eb1-9"
x-amz-server-side-encryption: AES256
x-amz-version-id: Dt_58PgmouL4kQOnv2PSUVXOKMLVHQBk
Content-Disposition: attachment; filename="help-axcient-software.zip"
Accept-Ranges: bytes
Content-Range: bytes 68833348-68859804/68859805
Content-Type: application/x-zip-compressed
Server: AmazonS3
Content-Length: 26457
athadnw.com/download/File_pass1234.7z
200 OK 707 B URL User Request GET HTTP/2 athadnw.com/download/File_pass1234.7z
IP
ASN #15685 CASABLANCA INT a.s.
Certificate IssuerLet's Encrypt
Subjectathadnw.com
Fingerprint1D:29:1B:71:D9:84:53:6E:5E:31:5D:24:EE:38:FB:A7:04:22:41:75
ValidityFri, 28 Apr 2023 21:43:27 GMT - Thu, 27 Jul 2023 21:43:26 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 1304294c0823ca486542ba408ed761e3
b2a70fb2d810ca13985882e6981f33998823e83e
3bbe72f3baa8ec61de17a1d767fca58704769684b7abe9161d0c4eaf4c8f0982
Analyzer Verdict Alert fortinet Malware
mnemonic_dns Sinkholed
quad9 Sinkholed
GET /download/File_pass1234.7z HTTP/1.1
Host: athadnw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
content-length: 707
date: Sat, 29 Apr 2023 08:59:45 GMT
server: LiteSpeed
location: https://athadnw.com/download/File_pass1234.7z
athadnw.com/download/File_pass1234.7z
200 OK 7.1 MB URL User Request GET HTTP/2 athadnw.com/download/File_pass1234.7z
IP
ASN #15685 CASABLANCA INT a.s.
Certificate IssuerLet's Encrypt
Subjectathadnw.com
Fingerprint1D:29:1B:71:D9:84:53:6E:5E:31:5D:24:EE:38:FB:A7:04:22:41:75
ValidityFri, 28 Apr 2023 21:43:27 GMT - Thu, 27 Jul 2023 21:43:26 GMT
File type 7-zip archive data, version 0.4\012- data
Size 7.1 MB (7068643 bytes)
Hash 5c5902b44908683949143a334bece8d5
156d5e7bd45acece79365636d6d39d4b54c8ede7
7d6d7739663e461778f7cfda801f3169fc9e57f92e3d6b5db138a877f8f2ce5d
Analyzer Verdict Alert fortinet Malware
mnemonic_dns Sinkholed
quad9 Sinkholed
VirusTotal 10/59
GET /download/File_pass1234.7z HTTP/1.1
Host: athadnw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-7z-compressed
last-modified: Mon, 24 Apr 2023 16:44:25 GMT
accept-ranges: bytes
content-length: 7068643
date: Sat, 29 Apr 2023 08:59:45 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
81.0.218.211
54.230.245.100
0.0.0.0