| tmpfiles.org/dl/5613771/andromeda-663a015927e16-xcliebnt.exe.txt |  172.67.195.247 | 200 OK | 48 kB |
URL User Request GET HTTP/2tmpfiles.org/dl/5613771/andromeda-663a015927e16-xcliebnt.exe.txt IP172.67.195.247:443
CertificateIssuerLet's Encrypt Subjecttmpfiles.org FingerprintE0:4F:08:69:83:B8:6E:53:52:25:B2:01:05:CA:CA:AA:17:BE:FE:42 ValiditySat, 30 Mar 2024 08:25:37 GMT - Fri, 28 Jun 2024 08:25:36 GMT
File typeASCII text, with very long lines (48472), with no line terminators Hashdd471d80ec7c4562b95d275713900204 2fbe2e4ac01757743f41b68d11aaba224b529d05 1c6c9ccc1db81be65cd022d941fac48a71185c96e31a24a470ed0d5232ed89a9
| Analyzer | Verdict | Alert |
|---|
| urlquery | suspicious | Suspicious - Base64 encoded file | | Quad9 DNS | malicious | Sinkholed |
GET /dl/5613771/andromeda-663a015927e16-xcliebnt.exe.txt HTTP/1.1
Host: tmpfiles.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 07 May 2024 10:39:01 GMT
content-type: text/plain; charset=UTF-8
content-disposition: inline; filename=andromeda-663a015927e16-xcliebnt.exe.txt
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6IktWSEcwRm1MT1F3SHFSL2tpcE5paVE9PSIsInZhbHVlIjoiSzF1OTZsYmxpUlpKeGNIYzB2cmRkWXV6WGd5WDE4VCtGYWc2MHczQU0rZlZJcUljUFp0Q1c3UTRHNmJiTjl1T1NCZU5kNjlBejZOcVo2bXppUDVEZUFVdmNMQjZkZ2Fyb2xEcWVCYVZoOE8rcE5rL0NFRWNkalpadTNZWUcybnAiLCJtYWMiOiI5N2I3OGE0ZjQ3NWVhY2NmYTk2MTNhNjBhZjdlNTIzMTMxZDM2YTU2ZmE3MzdjNWNiYWYzOGNmYTc4NDJhNDNhIn0%3D; expires=Tue, 07-May-2024 12:39:01 GMT; Max-Age=7200; path=/; samesite=lax
tmpfiles_session=eyJpdiI6IllXUFVVTmdFZ0VXcFRRM3ZYaVFhTVE9PSIsInZhbHVlIjoiS1dGUnBwcDd0TkM5UkxYYXV3aWVTM3ZXTGNwU2VWTUN2U05nL2c3ZnZEbW1NUnBGNEFXYmMrNGNSTXQ4VmppZ3ZzUVEzT0N4OWZLVUErODJQTE5XMVdNdnhYaHhCaVNzU3BKeVJXc2g1T0RxWWh3UUdPWElhd2FUaWxJTER1T3ciLCJtYWMiOiJhMThjZmYxYjdjYzc0ZDA0NjViN2FmMTJkMzU0OGI4MGI5MjNhZTZlY2VkZTczZDk2MWY1M2RlOWI3ZWU4ZDJmIn0%3D; expires=Tue, 07-May-2024 12:39:01 GMT; Max-Age=7200; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cu90o2usXU%2FxPRsZonDvqvOea3IXoQ5H0F0SFNCokdDYXyX3zWt1aDdZYjXXEEs%2FJDfd3M6NL6ZzkCUiamQg%2BvqOBVYBLic4soQ%2Fvoq86crB7myK1PewfChGbNNMAKg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8800956f3fc50b59-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
IP172.67.195.247:443
Requested byhttps://tmpfiles.org/dl/5613771/andromeda-663a015927e16-xcliebnt.exe.txt CertificateIssuerLet's Encrypt Subjecttmpfiles.org FingerprintE0:4F:08:69:83:B8:6E:53:52:25:B2:01:05:CA:CA:AA:17:BE:FE:42 ValiditySat, 30 Mar 2024 08:25:37 GMT - Fri, 28 Jun 2024 08:25:36 GMT
File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel Hash641276e2d4d0995c8262223f1fdda3d2 4f3f8f324f842e21d6921fffef2be2370cba9c49 5c039a5032f66daf0ad7ccaf04589686dfcc0b580113c1c6a9cff06ed4ce676d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: tmpfiles.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tmpfiles.org/dl/5613771/andromeda-663a015927e16-xcliebnt.exe.txt
Cookie: XSRF-TOKEN=eyJpdiI6IktWSEcwRm1MT1F3SHFSL2tpcE5paVE9PSIsInZhbHVlIjoiSzF1OTZsYmxpUlpKeGNIYzB2cmRkWXV6WGd5WDE4VCtGYWc2MHczQU0rZlZJcUljUFp0Q1c3UTRHNmJiTjl1T1NCZU5kNjlBejZOcVo2bXppUDVEZUFVdmNMQjZkZ2Fyb2xEcWVCYVZoOE8rcE5rL0NFRWNkalpadTNZWUcybnAiLCJtYWMiOiI5N2I3OGE0ZjQ3NWVhY2NmYTk2MTNhNjBhZjdlNTIzMTMxZDM2YTU2ZmE3MzdjNWNiYWYzOGNmYTc4NDJhNDNhIn0%3D; tmpfiles_session=eyJpdiI6IllXUFVVTmdFZ0VXcFRRM3ZYaVFhTVE9PSIsInZhbHVlIjoiS1dGUnBwcDd0TkM5UkxYYXV3aWVTM3ZXTGNwU2VWTUN2U05nL2c3ZnZEbW1NUnBGNEFXYmMrNGNSTXQ4VmppZ3ZzUVEzT0N4OWZLVUErODJQTE5XMVdNdnhYaHhCaVNzU3BKeVJXc2g1T0RxWWh3UUdPWElhd2FUaWxJTER1T3ciLCJtYWMiOiJhMThjZmYxYjdjYzc0ZDA0NjViN2FmMTJkMzU0OGI4MGI5MjNhZTZlY2VkZTczZDk2MWY1M2RlOWI3ZWU4ZDJmIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 10:39:01 GMT
content-type: image/x-icon
last-modified: Fri, 10 Feb 2017 21:01:32 GMT
etag: W/"589e2a2c-47e"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MdizJJb2QpfoTmN1YOH6sSduxMotn4nLwRMklMaPReDWLJLPSIvXhWFTp6oEnv0JasPmBGrtrAm92pgLOmBx9BcGgX2LVdf7Ey9luUIV11x9U2fazHq6i4pPIZ0TAVM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 88009571cb4fb509-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|