URL: https://lockhunter.com/startdownload.htm
Submission Tags: falconsandbox
Submission: On February 21 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 67.222.5.154, located in Atlanta, United States and belongs to PRIVATESYSTEMS, US. The main domain is lockhunter.com.
TLS certificate: Issued by R3 on February 8th 2023. Valid for: 3 months.
This is the only time lockhunter.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

MIME: PE32 executable (GUI) Intel 80386, for MS Windows
Size: 3 MB (3373192 bytes, 100% done)
Downloaded from: https://lockhunter.com/assets/exe/lockhuntersetup_3-4-3.exe

Domain & IP information

IP Address AS Autonomous System
1 8 67.222.5.154 63410 (PRIVATESY...)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:402... 15169 (GOOGLE)
9 3
Apex Domain
Subdomains
Transfer
8 lockhunter.com
lockhunter.com
49 KB
2 google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 362
17 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 77
337 B
9 3
Domain Requested by
8 lockhunter.com 1 redirects lockhunter.com
2 ssl.google-analytics.com 1 redirects lockhunter.com
1 stats.g.doubleclick.net lockhunter.com
9 3

This site contains links to these domains. Also see Links.

Domain
blog.crystalrich.com
safelyremove.com
www.wikihow.com
Subject Issuer Validity Valid
lockhunter.com
R3
2023-02-08 -
2023-05-09
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh

This page contains 1 frames:

Frame: https://lockhunter.com/assets/exe/lockhuntersetup_3-4-3.exe
Frame ID: E56CB560FA0C6FC44DCB567C8BE44A89
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Thanks for downloading our software!

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

66 kB
Transfer

181 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6
  • https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=122790387&utmhn=lockhunter.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Thanks%20for%20downloading%20our%20software!&utmhid=936678604&utmr=-&utmp=%2Fstartdownload.htm&utmht=1676965608826&utmac=UA-6790336-5&utmcc=__utma%3D217916171.480023329.1676965609.1676965609.1676965609.1%3B%2B__utmz%3D217916171.1676965609.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1228417749&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-6790336-5&cid=480023329.1676965609&jid=1228417749&_v=5.7.2&z=122790387
Request Chain 7
  • https://lockhunter.com/startdownload.htm?imm&v=&t= HTTP 302
  • https://lockhunter.com/assets/exe/lockhuntersetup_3-4-3.exe

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request startdownload.htm
lockhunter.com/
6 KB
2 KB
Document
General
Full URL
https://lockhunter.com/startdownload.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.222.5.154 Atlanta, United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.safelyremove.com
Software
Apache /
Resource Hash
ed480035387de8d6d013c3e25ce6075424d8d7ea8bcbcb623eb364b9db616c2f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
2157
Content-Type
text/html; charset=UTF-8
Date
Tue, 21 Feb 2023 07:46:48 GMT
Keep-Alive
timeout=3, max=10000
Server
Apache
Vary
Accept-Encoding,User-Agent
main.css
lockhunter.com/assets/
23 KB
5 KB
Stylesheet
General
Full URL
https://lockhunter.com/assets/main.css
Requested by
Host: lockhunter.com
URL: https://lockhunter.com/startdownload.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.222.5.154 Atlanta, United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.safelyremove.com
Software
Apache /
Resource Hash
49ea2fd0de8fbd5b082afc8227e57990009744b9b3644906d07297afa2b8711d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lockhunter.com/startdownload.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 07:46:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 Feb 2022 08:59:54 GMT
Server
Apache
ETag
"1b20677-5ae1-5d8471b309680-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=9999
Content-Length
5190
main_lh.css
lockhunter.com/assets/
14 KB
4 KB
Stylesheet
General
Full URL
https://lockhunter.com/assets/main_lh.css
Requested by
Host: lockhunter.com
URL: https://lockhunter.com/startdownload.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.222.5.154 Atlanta, United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.safelyremove.com
Software
Apache /
Resource Hash
91322945b7a3e3afcef8a2daf636bdfbd75443ba004a74a7c9a82344bdc51e66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lockhunter.com/startdownload.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 07:46:48 GMT
Content-Encoding
gzip
Last-Modified
Sat, 05 Feb 2022 15:12:40 GMT
Server
Apache
ETag
"1bc06b8-3690-5d746cc5eca00-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=10000
Content-Length
3720
jquery.js
lockhunter.com/assets/
87 KB
31 KB
Script
General
Full URL
https://lockhunter.com/assets/jquery.js
Requested by
Host: lockhunter.com
URL: https://lockhunter.com/startdownload.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.222.5.154 Atlanta, United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.safelyremove.com
Software
Apache /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lockhunter.com/startdownload.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 07:46:48 GMT
Content-Encoding
gzip
Last-Modified
Thu, 21 Oct 2021 12:17:04 GMT
Server
Apache
ETag
"1b20678-15d9d-5cedbdf5b1000-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=9998
Content-Length
30902
logo2.png
lockhunter.com/assets/images/
3 KB
3 KB
Image
General
Full URL
https://lockhunter.com/assets/images/logo2.png
Requested by
Host: lockhunter.com
URL: https://lockhunter.com/startdownload.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.222.5.154 Atlanta, United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.safelyremove.com
Software
Apache /
Resource Hash
3c2b3af609d14d07c11883976bea374aeae207db2c39a791dc63682a44d0d273

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lockhunter.com/startdownload.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 07:46:48 GMT
Last-Modified
Mon, 09 Dec 2019 18:08:18 GMT
Server
Apache
ETag
"1bc06bc-be3-5994947b10880"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=9999
Content-Length
3043
sr-icon-large.png
lockhunter.com/assets/images/
3 KB
4 KB
Image
General
Full URL
https://lockhunter.com/assets/images/sr-icon-large.png
Requested by
Host: lockhunter.com
URL: https://lockhunter.com/startdownload.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.222.5.154 Atlanta, United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.safelyremove.com
Software
Apache /
Resource Hash
967edb61e481e640dbe574272fe60c7e5fdd29cebb7129fc2ffc9821b02c4fba

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lockhunter.com/startdownload.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 07:46:48 GMT
Last-Modified
Thu, 18 Aug 2016 09:02:00 GMT
Server
Apache
ETag
"1bc06cb-d35-53a54d5ab7200"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=9998
Content-Length
3381
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: lockhunter.com
URL: https://lockhunter.com/startdownload.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lockhunter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 21 Feb 2023 06:30:17 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
4591
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17168
expires
Tue, 21 Feb 2023 08:30:17 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=122790387&utmhn=lockhunter.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Thanks...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-6790336-5&cid=480023329.1676965609&jid=1228417749&_v=5.7.2&z=122790387
35 B
337 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-6790336-5&cid=480023329.1676965609&jid=1228417749&_v=5.7.2&z=122790387
Requested by
Host: lockhunter.com
URL: https://lockhunter.com/startdownload.htm
Protocol
H2
Server
2a00:1450:4025:402::9b Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lockhunter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 21 Feb 2023 07:46:49 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 21 Feb 2023 07:46:48 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/html; charset=UTF-8
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-6790336-5&cid=480023329.1676965609&jid=1228417749&_v=5.7.2&z=122790387
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
368
expires
Fri, 01 Jan 1990 00:00:00 GMT
lockhuntersetup_3-4-3.exe
lockhunter.com/assets/exe/
Redirect Chain
  • https://lockhunter.com/startdownload.htm?imm&v=&t=
  • https://lockhunter.com/assets/exe/lockhuntersetup_3-4-3.exe
0
0
Document
General
Full URL
https://lockhunter.com/assets/exe/lockhuntersetup_3-4-3.exe
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
67.222.5.154 Atlanta, United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
host.safelyremove.com
Software
Apache /
Resource Hash

Request headers

Referer
https://lockhunter.com/startdownload.htm
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
3373192
Content-Type
application/x-msdownload
Date
Tue, 21 Feb 2023 07:46:52 GMT
ETag
"1bc186b-337888-5dc0f67c4d4c8"
Keep-Alive
timeout=3, max=9999
Last-Modified
Thu, 07 Apr 2022 12:13:27 GMT
Server
Apache
Vary
User-Agent

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Tue, 21 Feb 2023 07:46:52 GMT
Keep-Alive
timeout=3, max=10000
Location
https://lockhunter.com/assets/exe/lockhuntersetup_3-4-3.exe
Server
Apache
Vary
User-Agent

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange object| view number| totalTime number| tmr function| countdowndownload object| _gaq object| _gat object| gaGlobal function| $ function| jQuery

5 Cookies

Domain/Path Name / Value
.lockhunter.com/ Name: __utma
Value: 217916171.480023329.1676965609.1676965609.1676965609.1
.lockhunter.com/ Name: __utmc
Value: 217916171
.lockhunter.com/ Name: __utmz
Value: 217916171.1676965609.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.lockhunter.com/ Name: __utmt
Value: 1
.lockhunter.com/ Name: __utmb
Value: 217916171.1.10.1676965609