Report - www.nirsoft.net/utils/userassistview.zip

Report Overview

Submitted URL
www.nirsoft.net/utils/userassistview.zip
IP
138.128.181.29
ASN
#33182 DIMENOC
Submitted
2024-04-18 17:04:04
Access
public
Website Title
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.nirsoft.net	147497	2004-08-26	2012-05-22	2024-04-18	494 B	35 kB	138.128.181.29
normandy.cdn.mozilla.net	3562	1998-01-31	2017-01-30	2024-04-18	329 B	1.2 kB	35.201.103.21
classify-client.services.mozilla.com	3824	1994-10-18	2019-01-09	2024-04-17	357 B	344 B	34.98.75.36

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.nirsoft.net/utils/userassistview.zip
IP
138.128.181.29
ASN
#33182 DIMENOC

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
35 kB (35140 bytes)
Hash
835e2d88a162c26298f525fb256214e9
5e430f65d44198a6a9dca59df094325737b14160
11b75025ac99ad31fa2c27b91ebbdb891fced36ff8b2567b0b76146af88d57d9

Archive (3)

Filename

Md5

File type

UserAssistView.exe

f36530f46a34516be38521ee9a134d28

PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections

UserAssistView.chm

e278956143854c01b1e833890710f6ef

MS Windows HtmlHelp Data

readme.txt

77f76db429a9d9d40010cbd34e1fe2b3

ASCII text, with CRLF line terminators

JavaScript (0)

HTTP Transactions (3)

	URL	IP	Size
	www.nirsoft.net/utils/userassistview.zip	138.128.181.29	35 kB
URL www.nirsoft.net/utils/userassistview.zip IP 138.128.181.29:0 ASN #33182 DIMENOC File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 35 kB (35140 bytes) Hash 835e2d88a162c26298f525fb256214e9 5e430f65d44198a6a9dca59df094325737b14160 11b75025ac99ad31fa2c27b91ebbdb891fced36ff8b2567b0b76146af88d57d9 HTTP Headers `GET /utils/userassistview.zip HTTP/1.1 Host: www.nirsoft.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 17:03:31 GMT Server: Apache Last-Modified: Thu, 30 Dec 2010 08:02:11 GMT ETag: "1255bd-8944-4989c1a55e6c0" Accept-Ranges: bytes Content-Length: 35140 Keep-Alive: timeout=4, max=50 Connection: Keep-Alive Content-Type: application/zip`

	normandy.cdn.mozilla.net/api/v1/	35.201.103.21	598 B
URL normandy.cdn.mozilla.net/api/v1/ IP 35.201.103.21:0 ASN #396982 GOOGLE-CLOUD-PLATFORM File type JSON text data Size 598 B (598 bytes) Hash 3076f9a5cb273105528b893ff7111e41 b8990c145fe71b9a2410eea41a60a712b43b82bf 69c578fb0c03a28141a975833f660f4571e7991dc28ae7f9cead37672ee2c9b3 HTTP Headers `GET /api/v1/ HTTP/1.1 Host: normandy.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site` HTTP/2 200 OK server: nginx content-length: 598 allow: GET, HEAD, OPTIONS content-security-policy: form-action 'self'; base-uri 'none'; default-src 'self' https://normandy.cdn.mozilla.net/; block-all-mixed-content; frame-src 'none'; object-src 'none'; worker-src 'none'; report-uri /__cspreport__ x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000 via: 1.1 google date: Wed, 17 Apr 2024 23:22:33 GMT cache-control: public, max-age=86400 content-type: application/json vary: Accept, Origin age: 63672 alt-svc: clear X-Firefox-Spdy: h2

	classify-client.services.mozilla.com/api/v1/classify_client/	34.98.75.36	64 B
URL classify-client.services.mozilla.com/api/v1/classify_client/ IP 34.98.75.36:0 ASN #396982 GOOGLE-CLOUD-PLATFORM File type JSON text data Size 64 B (64 bytes) Hash 075aa86d4232f0b125a3325f98a545c0 93b4e56345ce71021690d9145ee7f09a7add6e7f 7c12d05a32450419f04969830d13ac6807d01c2bb2c99f067dee2840f355e59f HTTP Headers `GET /api/v1/classify_client/ HTTP/1.1 Host: classify-client.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site` `HTTP/2 200 OK server: nginx date: Thu, 18 Apr 2024 17:03:45 GMT content-type: application/json content-length: 64 cache-control: max-age=0, no-cache, no-store, must-revalidate strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2`

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (3)

JavaScript (0)

HTTP Transactions (3)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers