IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 7df3d7cf3358af3f470ac7229387ef94
c51a3f0e6de4eb802d5630941c3fd9e1d0efae4b
fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de
GET / HTTP/1.1
Host: cdn.growx.space
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 07 Dec 2023 11:01:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Cache-Control: public, max-age=0
Last-Modified: Mon, 30 Oct 2023 14:58:33 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BybXJahObUh1NWI8nXE%2B6l9E%2Fj2LqBHOmf7Iqo%2BbZ157wzFRMfGyXQRw78HWpRoY0BlFvMCMqf9yWsft3yGzelWuxtj0bQnJNxXzC4CN43r4moIu20lPhWAi9e5ctMpAswQ%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 831c456f391f568d-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
cdn.growx.space/download/Hydrotrium.exe
0 B URL User Request GET cdn.growx.space/download/Hydrotrium.exe
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS Severity Alert suricata high ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
suricata high ET POLICY PE EXE or DLL Windows file download HTTP
suricata low ET INFO EXE - Served Attached HTTP
GET /download/Hydrotrium.exe HTTP/1.1
Host: cdn.growx.space
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 07 Dec 2023 11:01:37 GMT
Content-Type: application/octet-stream
Content-Length: 3649024
Connection: keep-alive
X-Powered-By: Express
Content-Disposition: attachment; filename="Hydrotrium.exe"
Cache-Control: public, max-age=14400
Last-Modified: Mon, 04 Dec 2023 01:51:49 GMT
ETag: W/"37ae00-18c32864308"
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HlP86wqvxCYjQA8kzLsXFxwP1ZozfoOzIrHmNTnBsajnHwGnYcsY2qBiAx9W2Oy6P7LA4qP0288xNw9bX9oyagtGenSW8PmNVf3rO8zAny1JQGbkBQ5o5C%2F1JKB9yZqTibw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 831c45864a125684-OSL
alt-svc: h2=":443"; ma=60
cdn.growx.space/download/Hydrotrium.exe
0 B URL User Request GET cdn.growx.space/download/Hydrotrium.exe
IP
Certificate IssuerGoogle Trust Services LLC
Subjectgrowx.space
FingerprintA0:B5:7C:AD:DA:C7:FB:D3:19:CD:34:6E:89:38:DA:78:7B:8E:90:50
ValidityFri, 20 Oct 2023 05:14:17 GMT - Thu, 18 Jan 2024 05:14:16 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS Severity Alert suricata high ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
suricata high ET POLICY PE EXE or DLL Windows file download HTTP
suricata low ET INFO EXE - Served Attached HTTP
GET /download/Hydrotrium.exe HTTP/1.1
Host: cdn.growx.space
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
172.67.176.96
104.21.64.56