www.bleepingcomputer.com Open in urlscan Pro
104.20.59.209 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Submission: On September 07 via api (September 7th 2021, 2:44:46 am UTC) from SG

Summary HTTP 176 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 47 IPs in 6 countries across 30 domains to perform 176 HTTP transactions. The main IP is 104.20.59.209, located in and belongs to CLOUDFLARENET, US. The main domain is www.bleepingcomputer.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 16th 2020. Valid for: 2 years.

This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
46	104.20.59.209 104.20.59.209	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	104.26.13.6 104.26.13.6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3036::ac43:dbb1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.226.155.62 13.226.155.62	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:20:... 2606:4700:20::681a:8b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.226.155.6 13.226.155.6	16509 (AMAZON-02) (AMAZON-02)
1 4	151.101.14.137 151.101.14.137	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2	2600:9000:224... 2600:9000:2240:8400:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
1	185.208.56.78 185.208.56.78	205726 (VUSAM) (VUSAM)
5	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700::68... 2606:4700::6810:5e41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	216.58.212.134 216.58.212.134	15169 (GOOGLE) (GOOGLE)
1	2.18.234.190 2.18.234.190	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	35.201.71.192 35.201.71.192	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
8	18.116.179.127 18.116.179.127	16509 (AMAZON-02) (AMAZON-02)
1 2	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE)
3	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE)
2	35.190.91.160 35.190.91.160	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:827::200d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
1	2620:116:800d... 2620:116:800d:21:51e4:db4b:4436:b305	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	34.120.117.212 34.120.117.212	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223c:c600:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
10	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
4	52.17.148.138 52.17.148.138	16509 (AMAZON-02) (AMAZON-02)
1	142.250.185.134 142.250.185.134	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
3	2600:9000:224... 2600:9000:2240:2400:15:6f6c:b180:93a1	16509 (AMAZON-02) (AMAZON-02)
11	3.125.100.70 3.125.100.70	16509 (AMAZON-02) (AMAZON-02)
3	37.252.173.22 37.252.173.22	29990 (ASN-APPNEX) (ASN-APPNEX)
3	52.213.94.69 52.213.94.69	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1288:80:... 2a00:1288:80:800::7001	203220 (YAHOO-DEB) (YAHOO-DEB)
12	3.127.187.49 3.127.187.49	16509 (AMAZON-02) (AMAZON-02)
6	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
2	3.248.127.185 3.248.127.185	16509 (AMAZON-02) (AMAZON-02)
2	52.31.202.1 52.31.202.1	16509 (AMAZON-02) (AMAZON-02)
2	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
176	47

46 104.20.59.209 (None, )

ASN13335 (CLOUDFLARENET, US)

www.bleepingcomputer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.26.13.6 (United States)

ASN13335 (CLOUDFLARENET, US)

www.bleepstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:dbb1 (United States)

ASN13335 (CLOUDFLARENET, US)

id-ransomware.malwarehunterteam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.62 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-62.dus51.r.cloudfront.net

i1106.photobucket.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:8b (United States)

ASN13335 (CLOUDFLARENET, US)

a.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-6.dus51.r.cloudfront.net

ecdn.analysis.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.14.137 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2240:8400:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.208.56.78 (Netherlands)

ASN205726 (VUSAM, NL)
PTR: vip1-web.ams1.vusam.com

www.imgdumper.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5e41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.134 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.190 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-190.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.71.192 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 192.71.201.35.bc.googleusercontent.com

d.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.116.179.127 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-116-179-127.us-east-2.compute.amazonaws.com

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.59.101 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.67.47 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.91.160 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 160.91.190.35.bc.googleusercontent.com

p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:51e4:db4b:4436:b305 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.117.212 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 212.117.120.34.bc.googleusercontent.com

ls.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:c600:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.194.137 (United States)

ASN54113 (FASTLY, US)

img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.17.148.138 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-148-138.eu-west-1.compute.amazonaws.com

vid.springserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.134 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f6.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2240:2400:15:6f6c:b180:93a1 (United States)

ASN16509 (AMAZON-02, US)

vpaid.springserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 3.125.100.70 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-100-70.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.173.22 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.213.94.69 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-94-69.eu-west-1.compute.amazonaws.com

acds.prod.vidible.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:80:800::7001 (Frankfurt am Main, Germany)

ASN203220 (YAHOO-DEB, GB)

cdn-ssl.vidible.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 3.127.187.49 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com

trk.vidible.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.248.127.185 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-127-185.eu-west-1.compute.amazonaws.com

bc-ssb-dub.springserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.31.202.1 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-202-1.eu-west-1.compute.amazonaws.com

vid-io-dub.springserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	bleepingcomputer.com www.bleepingcomputer.com	210 KB
22	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	556 KB
18	vidible.tv acds.prod.vidible.tv cdn-ssl.vidible.tv trk.vidible.tv	330 KB
11	advertising.com ads.adaptv.advertising.com	5 KB
11	springserve.com vid.springserve.com vpaid.springserve.com bc-ssb-dub.springserve.com vid-io-dub.springserve.com	267 KB
10	skimresources.com 1 redirects s.skimresources.com r.skimresources.com t.skimresources.com p.skimresources.com ls.skimresources.com	18 KB
7	google.com apis.google.com accounts.google.com www.google.com	111 KB
6	moatads.com z.moatads.com px.moatads.com	132 KB
6	bleepstatic.com www.bleepstatic.com	23 KB
4	googleapis.com imasdk.googleapis.com	684 KB
4	doubleclick.net ad.doubleclick.net securepubads.g.doubleclick.net	142 KB
3	adnxs.com ib.adnxs.com	2 KB
3	googlesyndication.com pagead2.googlesyndication.com	38 KB
2	pubmatic.com hbopenbid.pubmatic.com Failed	188 B
2	facebook.com www.facebook.com	21 B
2	facebook.net connect.facebook.net	67 KB
2	consensu.org quantcast.mgr.consensu.org	70 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	pub.network a.pub.network d.pub.network	48 KB
1	2mdn.net s0.2mdn.net	17 KB
1	quantcount.com rules.quantcount.com	353 B
1	gstatic.com ssl.gstatic.com	4 KB
1	quantserve.com secure.quantserve.com	9 KB
1	outbrain.com widgets.outbrain.com	3 KB
1	cloudflareinsights.com static.cloudflareinsights.com	5 KB
1	imgdumper.nl www.imgdumper.nl	4 KB
1	analysis.fi ecdn.analysis.fi	2 KB
1	photobucket.com i1106.photobucket.com	1 KB
1	malwarehunterteam.com id-ransomware.malwarehunterteam.com	2 KB
1	googletagmanager.com www.googletagmanager.com	40 KB
176	30

	Domain	Requested by
46	www.bleepingcomputer.com	www.bleepingcomputer.com static.cloudflareinsights.com
12	trk.vidible.tv
11	ads.adaptv.advertising.com	vpaid.springserve.com cdn-ssl.vidible.tv
10	img.connatix.com
8	capi.connatix.com	cd.connatix.com
6	www.bleepstatic.com	www.bleepingcomputer.com
5	apis.google.com	www.bleepingcomputer.com apis.google.com accounts.google.com
4	vid.springserve.com	cd.connatix.com vpaid.springserve.com
4	imasdk.googleapis.com	cd.connatix.com imasdk.googleapis.com
3	px.moatads.com
3	z.moatads.com	cdn-ssl.vidible.tv
3	cdn-ssl.vidible.tv	acds.prod.vidible.tv
3	acds.prod.vidible.tv	www.bleepingcomputer.com
3	ib.adnxs.com	vpaid.springserve.com
3	vpaid.springserve.com	cd.connatix.com
3	pagead2.googlesyndication.com	srcdoc
3	securepubads.g.doubleclick.net	cd.connatix.com securepubads.g.doubleclick.net
3	t.skimresources.com	www.bleepingcomputer.com s.skimresources.com
2	vid-io-dub.springserve.com	vpaid.springserve.com
2	bc-ssb-dub.springserve.com	vpaid.springserve.com
2	hbopenbid.pubmatic.com	vpaid.springserve.com
2	ls.skimresources.com	s.skimresources.com
2	www.facebook.com	connect.facebook.net
2	p.skimresources.com	www.bleepingcomputer.com
2	r.skimresources.com	1 redirects www.bleepingcomputer.com
2	connect.facebook.net	www.bleepingcomputer.com connect.facebook.net
2	quantcast.mgr.consensu.org	www.bleepstatic.com quantcast.mgr.consensu.org
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	cds.connatix.com	www.bleepingcomputer.com cd.connatix.com
1	s0.2mdn.net	imasdk.googleapis.com
1	vid.connatix.com	cd.connatix.com
1	rules.quantcount.com	secure.quantserve.com
1	ssl.gstatic.com	accounts.google.com
1	secure.quantserve.com	quantcast.mgr.consensu.org
1	www.google.com	apis.google.com
1	accounts.google.com	apis.google.com
1	d.pub.network	a.pub.network
1	widgets.outbrain.com	www.bleepingcomputer.com
1	ad.doubleclick.net	www.bleepingcomputer.com
1	static.cloudflareinsights.com	www.bleepingcomputer.com
1	s.skimresources.com	www.bleepingcomputer.com
1	www.imgdumper.nl	www.bleepingcomputer.com
1	cd.connatix.com	1 redirects
1	ecdn.analysis.fi	www.bleepingcomputer.com
1	a.pub.network	www.bleepingcomputer.com
1	i1106.photobucket.com	www.bleepingcomputer.com
1	id-ransomware.malwarehunterteam.com	www.bleepingcomputer.com
1	www.googletagmanager.com	www.bleepingcomputer.com
176	48

This site contains links to these domains. Also see Links.

Domain
id-ransomware.malwarehunterteam.com
www.patreon.com
twitter.com
www.geekstogo.com
asus13.msn.com
www.msn.com
clients2.google.com
www.emsisoft.com
www.eset.com
download.eset.com
wiki.answers.com
www.techopedia.com
en.wikipedia.org
websearch.about.com
www.microsoft.com
www.virusbtn.com
toolslib.net
users.telenet.be
www.dozleng.com
www.osalt.com
www.invisionpower.com

Subject Issuer	Validity	Valid
bleepingcomputer.com Sectigo RSA Domain Validation Secure Server CA	`2020-05-16` - `2022-05-15`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-16` - `2022-06-15`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
photobucket.com Amazon	`2021-09-06` - `2022-10-05`	a year	crt.sh
analysis.fi Amazon	`2021-01-03` - `2022-02-01`	a year	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
quantcast.mgr.consensu.org Amazon	`2021-04-24` - `2022-05-23`	a year	crt.sh
imgdumper.nl R3	`2021-07-30` - `2021-10-28`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2020-09-10` - `2021-10-12`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2021-05-25` - `2022-06-01`	a year	crt.sh
*.pub.network Go Daddy Secure Certificate Authority - G2	`2021-03-17` - `2022-04-18`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-06-17` - `2021-09-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.springserve.com Amazon	`2021-07-07` - `2022-08-05`	a year	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-05-24` - `2021-11-17`	6 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
acds.prod.vidible.tv DigiCert SHA2 High Assurance Server CA	`2021-06-21` - `2021-12-15`	6 months	crt.sh
cdn-ycs.vidible.tv DigiCert SHA2 High Assurance Server CA	`2021-05-17` - `2021-11-10`	6 months	crt.sh
trk.vidible.tv DigiCert SHA2 High Assurance Server CA	`2021-07-11` - `2022-01-05`	6 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh

This page contains 18 frames:

Primary Page: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Frame ID: AE9A195E463ABB3A3F2A2A62639AA35A
Requests: 98 HTTP requests in this frame

Frame: https://cds.connatix.com/p/128743/connatix.playspace.dc.js
Frame ID: 3DB3F7B508CAE7155F8192AA5827B146
Requests: 15 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.9158554390290865
Frame ID: 29E7EEEF6BF3CEEDD725F6805CDA32CC
Requests: 1 HTTP requests in this frame

Frame: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__
Frame ID: 5C3E854BE30AB8695501E491007B4DA3
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df19f549775f8958%26domain%3Dwww.bleepingcomputer.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff1e344be1b70cc%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150
Frame ID: C77016599C9BCADA76B614DAEAB03E0D
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__
Frame ID: 68ABF10444C2C957B280661218CF1609
Requests: 3 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.478.2_en.html
Frame ID: 6E25C61989D906BC3281CC1715AEE08E
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.478.2_en.html
Frame ID: DFC5F2EB6FEBC4F852149087BE27FB66
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.478.2_en.html
Frame ID: A57A9CDBC27AC99396BE7924DB6F6414
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: FAA2332AC494FDF3AAD5D13D9DD20213
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 236D96F12ACCC7804A78B914FCE41702
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: FE7C13C92DE0369DD6E44215612C27E3
Requests: 1 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_44854a27.js
Frame ID: DC5611F5D8F7C0688875ED4E43C1ABB4
Requests: 10 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=c81dcb78-3b62-45a5-9af8-bd729949261f&pblob=
Frame ID: C8C7CB56FCE71EA14D14AFB4AB643321
Requests: 8 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_44854a27.js
Frame ID: 0ABD13E4452C2F2966C8473AA9AF3D97
Requests: 9 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=8d4a9939-9f04-4c1a-9ce9-c9bd2f756ce3&pblob=
Frame ID: 45DC5EA0A3523B188288EAB1FC2BC360
Requests: 8 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_44854a27.js
Frame ID: 9A1BAD1901FD96EA1672F394562564BF
Requests: 7 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=dbe73519-3b7c-4ee8-a7c1-3e50c7c7c691&pblob=
Frame ID: 342EE03CCA9D1686069A8E839B026D44
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

C:\Windows\system32\userinit.exe malware infection - Virus, Trojan, Spyware, and Malware Removal Help

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

176
Requests

98 %
HTTPS

41 %
IPv6

30
Domains

48
Subdomains

47
IPs

6
Countries

2808 kB
Transfer

9201 kB
Size

7
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://id-ransomware.malwarehunterteam.com/
Title: ID Ransomware

Search URL Search Domain Scan URL

URL: https://www.patreon.com/demonslay335
Title: here

Search URL Search Domain Scan URL

URL: https://twitter.com/PolarToffee
Title: Twitter

Search URL Search Domain Scan URL

URL: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
Title: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

Search URL Search Domain Scan URL

URL: http://asus13.msn.com/?pc=ASJB
Title: http://asus13.msn.com/?pc=ASJB

Search URL Search Domain Scan URL

URL: http://www.msn.com/en-au/?ocid=iehp
Title: http://www.msn.com/en-au/?ocid=iehp

Search URL Search Domain Scan URL

URL: https://clients2.google.com/service/update2/crx
Title: https://clients2.google.com/service/update2/crx

Search URL Search Domain Scan URL

URL: http://www.emsisoft.com/en/software/eek/download/
Title: Emsisoft Emergency Kit

Search URL Search Domain Scan URL

URL: http://www.eset.com/us/online-scanner-popup/
Title: this link

Search URL Search Domain Scan URL

URL: http://download.eset.com/special/eos/esetsmartinstaller_enu.exe
Title: esetsmartinstaller_enu.exe

Search URL Search Domain Scan URL

URL: http://wiki.answers.com/Q/What_is_a_keygen
Title: keygens

Search URL Search Domain Scan URL

URL: http://www.techopedia.com/definition/60/hacking-tool
Title: hacking tools

Search URL Search Domain Scan URL

URL: http://en.wikipedia.org/wiki/Software_cracking
Title: cracking tools

Search URL Search Domain Scan URL

URL: http://en.wikipedia.org/wiki/Warez
Title: warez

Search URL Search Domain Scan URL

URL: http://websearch.about.com/od/torrentsearch/a/whatisatorrent.htm
Title: torrents

Search URL Search Domain Scan URL

URL: http://www.microsoft.com/protect/promotions/us/wga_idc_us.mspx
Title: pirated software

Search URL Search Domain Scan URL

URL: https://www.virusbtn.com/resources/glossary/honeypot.xml
Title: virus honeypot

Search URL Search Domain Scan URL

URL: http://en.wikipedia.org/wiki/Zombie_computer
Title: zombie

Search URL Search Domain Scan URL

URL: http://wiki.answers.com/Q/What_does_it_mean_to_reformat_a_computer
Title: reformatting

Search URL Search Domain Scan URL

URL: https://toolslib.net/downloads/viewdownload/2-delfix/
Title: Delfix by Xplode

Search URL Search Domain Scan URL

URL: http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
Title: Miekies' prevention suggestions

Search URL Search Domain Scan URL

URL: http://www.dozleng.com/updates/index.php?act=calendar
Title: Calendar of Updates

Search URL Search Domain Scan URL

URL: http://www.osalt.com/
Title: osalt

Search URL Search Domain Scan URL

URL: http://www.invisionpower.com/apps/board/
Title: Community Forum Software by IP.Board

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38

https://cd.connatix.com/connatix.playspace.js HTTP 302
https://cds.connatix.com/p/128743/connatix.playspace.dc.js

Request Chain 69

https://r.skimresources.com/api/ HTTP 307
https://r.skimresources.com/api/?xguid=01FEZ28Z6RJM7AW2N6MBENYCJ7&persistence=1&checksum=fedfbfbd506f8bf83450f0484e180719ff25113f030d3b458b734fc9a07724ad

176 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/ 523 KB
75 KB 1164ms
1125ms Document
text/html 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19aeea2ab3b43dad66b79346d9afa7260c7af56c60e113678c02327bdd58fa7b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.bleepingcomputer.com
:scheme: https
:path: /forums/t/577460/cwindowssystem32userinitexe-malware-infection/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:26 GMT
content-type: text/html;charset=ISO-8859-1
content-security-policy: upgrade-insecure-requests;
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate, max-age=0
expires: Mon, 06 Sep 2021 02:44:26 GMT
pragma: no-cache
vary: Accept-Encoding,User-Agent
set-cookie: session_id=8911b82853637c0eea585be5089919c6; path=/; domain=.bleepingcomputer.com; httponly;Secure modpids=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.bleepingcomputer.com;Secure
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 68ac985d290f729f-AMS
content-encoding: br

GET
H2 200 prettify.css
www.bleepingcomputer.com/forums/public/style_css/ 1 KB
601 B 30ms
30ms Stylesheet
text/css 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/style_css/prettify.css?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfd753d445592a633d4e3b8f74fe6e4ca85ab95a1f0b2fc00f11afeaaeed8194

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_css/prettify.css?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:26 GMT
content-encoding: br
cf-cache-status: HIT
age: 1844
cf-polished: origSize=2207
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"89f-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac986449bf729f-AMS
cf-bgj: minify

GET
H2 200 prototype.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/ 134 KB
36 KB 36ms
35ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/prototype.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2a0ed3ea5aebdf80781e96b0e677656f9db72ea592b679299953852fef84b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/3rd_party/prototype.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:26 GMT
content-encoding: br
cf-cache-status: HIT
age: 1844
cf-polished: origSize=180829
last-modified: Wed, 29 May 2013 16:10:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"2c25d-4dddd9fb82900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac986449c1729f-AMS
cf-bgj: minify

GET
H2 200 ipb.js Show response
www.bleepingcomputer.com/forums/public/js/ 81 KB
21 KB 33ms
32ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff&load=quickpm,hovercard,sharelinks,topic,like

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d813e6becda7ebe8b6bf1a54e7b83aa2a2551dc41bf4f07877834984a293958e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/ipb.js?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff&load=quickpm,hovercard,sharelinks,topic,like
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:26 GMT
content-encoding: br
cf-cache-status: HIT
age: 1844
cf-polished: origSize=128896
last-modified: Sun, 15 Nov 2020 20:33:38 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"1f780-5b42b2d2db890-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac986449c2729f-AMS
cf-bgj: minify

GET
H2 200 scriptaculous-cache.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/ 55 KB
14 KB 44ms
43ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/scriptaculous-cache.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a10fb2699752353ba3f55bdb022589d690843ebbbf9f3b80789f2a57010475e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/3rd_party/scriptaculous/scriptaculous-cache.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:26 GMT
content-encoding: br
cf-cache-status: HIT
age: 4838
cf-polished: origSize=79650
last-modified: Mon, 16 Nov 2020 16:14:01 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"13722-5b43baa8f0d38-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac986449c3729f-AMS
cf-bgj: minify

GET
H2 200 ipb.lang.js Show response
www.bleepingcomputer.com/forums/cache/lang_cache/1/ 28 KB
8 KB 28ms
28ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/cache/lang_cache/1/ipb.lang.js?nck=4b93cd7f1f76df9c2c1783aae5cc39b1

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebbdc09f56e8b9cba9117f0d84b4903fdc89508496a9b5d5b8d6bf59ff13ebbf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/cache/lang_cache/1/ipb.lang.js?nck=4b93cd7f1f76df9c2c1783aae5cc39b1
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:26 GMT
content-encoding: br
cf-cache-status: HIT
age: 1844
cf-polished: origSize=30126
last-modified: Sun, 15 Nov 2020 20:48:24 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"75ae-5b42b61fceb0a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac986449c4729f-AMS
cf-bgj: minify

GET
H2 200 qc-consent.js Show response
www.bleepstatic.com/js/qc-consent/ 2 KB
2 KB 73ms
32ms Script
text/javascript 104.26.13.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 28d4e8c1043164607dcdeb358e2a08c9565fe286ceeeabea79e67f8c680187e7

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5849
cf-polished: origSize=3904
last-modified: Mon, 05 Oct 2020 20:38:13 GMT
server: cloudflare
etag: W/"2345400546"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oX3QPXM8ca%2BjQmq%2BcN0pfHCoTYB7r5NUPCH8T35w4cvH1Pz9cu54rsBUJNuqTgNJ0eBKuU7JZr203Ehnqhgn5osZi1%2BcMg0gmQYzMc2gYPRCn%2BG7tZUx11urrSmkteP9HailxuI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
expires: Sun, 22 Aug 2021 05:44:18 GMT
cache-control: max-age=3024000
cf-ray: 68ac9864dc042056-AMS
cf-bgj: minify

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 101 KB
40 KB 21ms
20ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-91740-1

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4dc57a7292b337c56c89be595bb3b0f3077767327408937222e7fa85fd870e71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:26 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41147
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 Sep 2021 02:44:26 GMT

GET
H2 200 twitter.png
www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/ 575 B
805 B 30ms
29ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/twitter.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abe9d30276e3d66a71219ad2b0ed5a9663020a5c534557dd0f5c8ba71da4ebd4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/loginmethods/twitter.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1458332
cf-polished: status=not_needed
content-length: 575
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "23f-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:38:55 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9864f9f1729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 forum-logo.png
www.bleepstatic.com/logo/ 5 KB
5 KB 31ms
24ms Image
image/webp 104.26.13.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/logo/forum-logo.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e5a1148e6ba00dec0218671857bc04820e1a4628a6de00a659ece715a6ed2f6

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 714795
cf-polished: origFmt=png, origSize=9361
content-disposition: inline; filename="forum-logo.webp"
content-length: 4656
last-modified: Fri, 26 Nov 2010 18:53:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fHBbNA1ws58azwp200KvTeMHdFg8mGVMWq2qipIudACfQK6FGawQiNuMAY8%2FS7VRvGXe461rXGcq4XO55Nc4%2B9bNdEERHh1G1gRzklota3%2FOJfVJc3GAdscBDh9q27b1%2BM5l4KI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Tue, 28 Sep 2021 20:11:12 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 68ac9864fc2b2056-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 useropts_arrow.png
www.bleepingcomputer.com/forums/public/style_images/master/ 81 B
235 B 34ms
26ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/useropts_arrow.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7451690fed2a104bf6ff86e5ab0b3a7d8393d26a859a4bad6ba81b1d7aa339d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/useropts_arrow.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1455752
cf-polished: origSize=129, status=vary_header_present
content-length: 81
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "81-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 06:21:55 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9864f9f4729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 default_large.png
www.bleepingcomputer.com/forums/public/style_images/master/profile/ 2 KB
3 KB 35ms
28ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/profile/default_large.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f7ad438c88cd0653af6066d4c148e00824961112a865f9611e258b9f3cc0981

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/profile/default_large.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457711
cf-polished: origSize=2589, status=vary_header_present
content-length: 2456
last-modified: Wed, 09 Mar 2011 20:59:50 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "a1d-49e13027a9d80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:49:16 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9864f9f5729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 lock.png
www.bleepingcomputer.com/forums/public/style_images/master/ 729 B
856 B 48ms
41ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/lock.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a28119ca11bc23f972f8e463761547044174823430b09a0f1fbfed91acbeb35d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/lock.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1451713
cf-polished: status=not_needed
content-length: 729
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "2d9-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 07:29:14 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9864f9f6729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 icon_share.png
www.bleepingcomputer.com/forums/public/style_images/master/ 188 B
355 B 42ms
35ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1832b7da0292ab076dfe046f8b1c2d5fcfd1bfb5628b7e21a3754a20308aa57

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/icon_share.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457150
cf-polished: origSize=1201, status=vary_header_present
content-length: 188
last-modified: Fri, 12 Oct 2012 09:31:38 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "4b1-4cbd95ac45280"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:58:37 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9864f9f7729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 txt.gif
www.bleepingcomputer.com/forums/public/style_extra/mime_types/ 203 B
336 B 37ms
31ms Image
image/gif 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/mime_types/txt.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59e6b6895ab9c1fab302d73906ec3259ac826ffc4a3ae743412bf8a096a33054

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/mime_types/txt.gif
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1450991
cf-polished: status=not_needed
content-length: 203
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "cb-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/gif
expires: Mon, 20 Sep 2021 07:41:16 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9864f9f8729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 post_top.png
www.bleepstatic.com/skin_images/bc/ 226 B
606 B 29ms
22ms Image
image/webp 104.26.13.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/skin_images/bc/post_top.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: efc6361ebe5a559578c83bf197d5407b7f6bf44f74d35c4ee8eb22c810fb34a7

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 447385
cf-polished: origFmt=png, origSize=3076
content-disposition: inline; filename="post_top.webp"
content-length: 226
last-modified: Wed, 09 Jun 2010 03:08:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M6qajF49sMTMQbpzrXlo939T25NBKov30dNsOJLRMtzUP%2F7qpUFYt3Jha2Saaocg2OixFY6UhmExKBzTxXKyhlM0hGX0TVP70zvbCSSnDBxAjqYr%2FnDt9s1%2FrftOCqHTWKXoIRM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 01 Oct 2021 22:28:02 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 68ac98650c2c2056-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 bot.jpg
www.bleepstatic.com/images/site/forum/bots/ 934 B
1 KB 27ms
20ms Image
image/webp 104.26.13.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/forum/bots/bot.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63e2dfceaeeb7e8b933fa7fe96048fac66ad3fab6ab270b8e4a28ce02c1b73ab

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 444294
cf-polished: qual=85, origFmt=jpeg, origSize=1566
content-disposition: inline; filename="bot.webp"
content-length: 934
last-modified: Tue, 20 Oct 2009 04:08:57 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G1RyH6xy9Ztn7G%2FLKHoH6raraXbYmHIzPzNbFM3bqcF9ggkt6TcoVYVSIqZRYgOW6tQPj4uczeYXScobqWs1WbWE4KqCkVTHVztjB056bambHFigKDUb%2BPogwDOHLUVx44VGFQo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 01 Oct 2021 23:19:33 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 68ac98650c2e2056-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 photo-thumb-829812.png
www.bleepingcomputer.com/forums/uploads/profile/ 7 KB
8 KB 35ms
29ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/uploads/profile/photo-thumb-829812.png?_r=1455452354

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54d1b6192a24d00e55b3b717a7fda9150b094b0ba2eb3ce3617fdcadc06fca13

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/uploads/profile/photo-thumb-829812.png?_r=1455452354
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 432691
cf-polished: origSize=9913, status=vary_header_present
content-length: 7530
last-modified: Sun, 14 Feb 2016 12:19:14 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "26b9-52bb9e88c3480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Sat, 02 Oct 2021 02:32:56 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9864f9f9729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 welcome.gif
www.bleepingcomputer.com/forums/public/style_emoticons/default/ 3 KB
3 KB 40ms
34ms Image
image/gif 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_emoticons/default/welcome.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

704a2ad9d19d0ce31dfe0757fe3e2ebd07aac0316a42f9b68cc891681edb57a5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_emoticons/default/welcome.gif
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1448552
cf-polished: origSize=3314, status=vary_header_present
content-length: 3252
last-modified: Sun, 09 Oct 2005 23:10:40 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "cf2-402ba621bbc00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/gif
expires: Mon, 20 Sep 2021 08:21:55 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac986509fa729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 thumbup2.gif
www.bleepingcomputer.com/forums/public/style_emoticons/default/ 486 B
747 B 31ms
25ms Image
image/gif 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_emoticons/default/thumbup2.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50ec0dfe51bd77eee427ce38cc90ef3564afea1a2e1148dc788c2d89b7fa4fb9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_emoticons/default/thumbup2.gif
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1450731
cf-polished: status=not_needed
content-length: 486
last-modified: Sun, 07 May 2006 20:38:57 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "1e6-41338be33ba40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/gif
expires: Mon, 20 Sep 2021 07:45:36 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac986509fb729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 logo-25.png
id-ransomware.malwarehunterteam.com/assets/images/ 1 KB
2 KB 47ms
12ms Image
image/png 2606:4700:3036::ac43:dbb1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id-ransomware.malwarehunterteam.com/assets/images/logo-25.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dbb1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d11e31e4a1d2b7528c066ca3c849a95e53a53538440a5d72c18bf9f9ee84ce9e

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 76256
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1372
last-modified: Fri, 08 Apr 2016 23:33:13 GMT
server: cloudflare
etag: "57083fb9-55c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qbLcij%2FyOVQ60Ee%2Be5MZB23ZrHIVOyUc97oWg0I2yVEGZVuCbB2CYXtk74LgG227GAZ%2FU5WIp1oAr0snoHXDL8UEfyBpenzBUcTQDx8O0CGtYX7ZgyMiO%2FtsTI8pbJyPdbBlHJJ1Ds214xo2o9fVUB9f1tK7EXxm0T7EU%2Ba1JMmCsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=259200
accept-ranges: bytes
cf-ray: 68ac986529294333-FRA

GET
H2 200 smile.png
www.bleepingcomputer.com/forums/public/style_emoticons/default/ 1014 B
1 KB 36ms
31ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_emoticons/default/smile.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f39834f6bd6f36f1a3c67dfd46bc4703cc68d8b51ed762d59adba905c8ad68c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_emoticons/default/smile.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1455696
cf-polished: origSize=1042, status=vary_header_present
content-length: 1014
last-modified: Wed, 18 May 2011 11:51:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "412-4a38b840bf380"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 06:22:51 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac986509fc729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 ips.quickpm.js Show response
www.bleepingcomputer.com/forums/public/js/ 5 KB
2 KB 30ms
29ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.quickpm.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f34544ddb27241b3eccb8e06d7447230005e8718b463a30d9dd83d1e8bada1a1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/ips.quickpm.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 1845
cf-polished: origSize=7306
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"1c8a-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac9864b9da729f-AMS
cf-bgj: minify

GET
H2 200 ips.hovercard.js Show response
www.bleepingcomputer.com/forums/public/js/ 7 KB
2 KB 35ms
34ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.hovercard.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e3b8f6c06d2d74cc294ee6439e67b08890587be0081249a158469ace2eaeaaf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/ips.hovercard.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 1845
cf-polished: origSize=12576
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3120-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac9864b9dc729f-AMS
cf-bgj: minify

GET
H2 200 ips.sharelinks.js Show response
www.bleepingcomputer.com/forums/public/js/ 4 KB
1 KB 41ms
40ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.sharelinks.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f1e90548e911e24dedcb2ca0ffee6847a49a8648e9c615bcd0582bb7c7993fd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/ips.sharelinks.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 4838
cf-polished: origSize=5869
last-modified: Wed, 29 May 2013 16:10:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"16ed-4dddd9fb82900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac9864b9dd729f-AMS
cf-bgj: minify

GET
H2 200 ips.topic.js Show response
www.bleepingcomputer.com/forums/public/js/ 28 KB
7 KB 33ms
32ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.topic.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a51f645170637f10f3eba218020318af3fff3ad8e7087db87ef607896f19a940

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/ips.topic.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 4838
cf-polished: origSize=45653
last-modified: Tue, 29 Dec 2015 18:39:43 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"b255-5280dbeb879c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac9864b9de729f-AMS
cf-bgj: minify

GET
H2 200 ips.like.js Show response
www.bleepingcomputer.com/forums/public/js/ 4 KB
1 KB 30ms
29ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.like.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=18e5d60f30c17fd4f0e4e13ab81cc8ff&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf50c94253085740a5cce42e9c14f7b897cfc384303b38a5d9d7a0ab8ea5160f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/ips.like.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 4838
cf-polished: origSize=6287
last-modified: Wed, 29 May 2013 16:10:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"188f-4dddd9fb82900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac9864b9df729f-AMS
cf-bgj: minify

GET
H2 200 Windows_Logo_key.gif
i1106.photobucket.com/albums/h363/debojyotidas/ 1001 B
1 KB 69ms
19ms Image
image/gif 13.226.155.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i1106.photobucket.com/albums/h363/debojyotidas/Windows_Logo_key.gif
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.155.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-62.dus51.r.cloudfront.net
Software: photobucket /
Resource Hash: a72002fa5652e79e7ec42b33393ea9483c3341904c95a99b8a53773c5e60e14e

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 20:49:38 GMT
via: 1.1 414a05dee9c365a2a2079013f9d53671.cloudfront.net (CloudFront)
age: 366889
x-cache: Hit from cloudfront
content-disposition: inline; filename="Windows_Logo_key.gif"
content-length: 1001
x-request-id: Uq18KMYH__AFo-XUDy_PL
server: photobucket
vary: Accept
access-control-allow-methods: GET, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600, public
x-amz-cf-pop: DUS51-C1
access-control-allow-headers: *
x-amz-cf-id: 0RHRReq0bs8eGfAQP84DG8ptHFLs_Ka6nMas9ubbyYS8uH1EGsMlzw==
expires: Thu, 02 Sep 2021 21:49:38 GMT

GET
H2 200 esetonlinebtn.png
www.bleepstatic.com/fhost/uploads/0/ 4 KB
4 KB 28ms
23ms Image
image/webp 104.26.13.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/fhost/uploads/0/esetonlinebtn.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9267b2d58a99487c128272a30336d413058b6b903c425bc35a7173d0208c6cc8

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1012232
cf-polished: origFmt=png, origSize=4601
content-disposition: inline; filename="esetonlinebtn.webp"
content-length: 3666
last-modified: Sun, 17 Apr 2011 08:28:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DFMqe%2F4%2Fh4ujgvE6kQbb2mdK2TZCXrgxs8VyUqjH7kKv4Lh%2BI9rU0yFeNBkuhIkrew7z0a0fLqDw4OxUZ20M6d3lrRTYxqJpkRDNpdrCuF8sx7ZleNjRzDYtoOkADULb%2Fv39cTQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Sat, 25 Sep 2021 09:33:55 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 68ac98650c2f2056-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 esetsmartinstaller_enu.png
www.bleepstatic.com/fhost/uploads/0/ 10 KB
11 KB 30ms
26ms Image
image/webp 104.26.13.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/fhost/uploads/0/esetsmartinstaller_enu.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df886e0040b483c2c6a65c0ddad13a25429887d96c6eea1d1f8fed9fedad781e

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 438990
cf-polished: origFmt=png, origSize=12551
content-disposition: inline; filename="esetsmartinstaller_enu.webp"
content-length: 10570
last-modified: Sun, 17 Apr 2011 08:29:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2FhT1mj2%2BQ%2BFTxH2NOf39nDktCJaS2OMpiKVFDqNVQk6CM4%2Ffz2h30CpJKLsAcZ9LBeErzVHGPv3mpGSR%2FearR4o1YKdJlUTlToHJyi2zvz0XA2WNA6X7oFB0bYwI6aEB6bf1W4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Sat, 02 Oct 2021 00:47:57 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 68ac98650c302056-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 pubfig.min.js Show response
a.pub.network/bleepingcomputer-com/ 170 KB
47 KB 202ms
179ms Script
application/javascript 2606:4700:20::681a:8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd8f238e6dd7bff40308c1c74dbbfc49519ef519e92b0601b84ce924715a7c02

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-goog-hash: crc32c=VWfkMg==, md5=LOiAWPbHFkZU30jNUGdp8A==
date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid: ADPycdvxeHALQzl-IpSWN01P5tNsVxK_pWca9ZLAZkELHddnNPRBnRwTo0JW4JyKoLlkYW4h9y8VIuQUEoneoTmDGCVKTlOUeg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: application/javascript
last-modified: Fri, 03 Sep 2021 16:34:04 GMT
server: cloudflare
etag: W/"2ce88058f6c7164654df48cd506769f0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LLQmt4a%2FEQ4jjqgBb1ow0kajWd3IYaGMtJ3v%2Bs0WL0aBePA09JlQxB%2BKpxBDUzAPL2ldUFp5EC0AT2X1nROawVmZpBnEL79eQL%2Fxk84wPNmVcWZo5mjLiPxsCUGbYA0f0%2FK6wiFw1UaduEw%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1630686844197067
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=1800
x-goog-stored-content-length: 173635
cf-ray: 68ac986519d22488-FRA
expires: Fri, 03 Sep 2021 16:41:39 GMT

GET
H2 200 fab.js Show response
ecdn.analysis.fi/static/js/ 4 KB
2 KB 77ms
18ms Script
application/javascript 13.226.155.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ecdn.analysis.fi/static/js/fab.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.155.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-6.dus51.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 786dbb4402793fadd0112db771392a0509ffcb2806545e94a879af9c6d87415f

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:00:51 GMT
content-encoding: gzip
last-modified: Mon, 06 Sep 2021 21:03:59 GMT
server: nginx/1.18.0
age: 2616
etag: W/"6136823f-10af"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 3cqbW0tla7Jd7p7dyUjfOR8ssLbf_HWOorZq63A_IAiynCgrFLxVAA==
via: 1.1 f6bd96409cae11d77ed75457d756ef80.cloudfront.net (CloudFront)
expires: Tue, 07 Sep 2021 03:00:51 GMT

GET
H2 200 ipb_print.css
www.bleepingcomputer.com/forums/public/style_css/css_7/ 3 KB
1 KB 58ms
54ms Stylesheet
text/css 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/style_css/css_7/ipb_print.css

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbd8236978dd3f165bc49566f78c460e3937e552df38787439c1ef2797c4c709

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_css/css_7/ipb_print.css
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 5172
cf-polished: origSize=3158
last-modified: Mon, 16 Nov 2020 21:40:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"c56-5b4403b241acc-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac98651a06729f-AMS
cf-bgj: minify

GET
H2 200 user_navigation.png
www.bleepingcomputer.com/forums/public/style_images/master/ 189 B
436 B 40ms
36ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/user_navigation.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e6274abac1820c8bd99f826cf35a60aeaa56b962500486acc5665f98005031e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/user_navigation.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1458333
cf-polished: origSize=282, status=vary_header_present
content-length: 189
last-modified: Tue, 01 Mar 2011 13:54:08 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "11a-49d6c2153a000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:38:54 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98651a04729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 advanced_search.png
www.bleepingcomputer.com/forums/public/style_images/master/ 261 B
543 B 41ms
38ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/advanced_search.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14dcce7abfc690cecd57a737a8af6fd712c2b7fec668b772d9f014f6ded77ef8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/advanced_search.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1644523
cf-polished: origSize=293, status=vary_header_present
content-length: 261
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "125-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Sat, 18 Sep 2021 01:55:44 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98651a05729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 search_icon.png
www.bleepingcomputer.com/forums/public/style_images/master/ 202 B
343 B 42ms
41ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/search_icon.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

51f20d95dad9ea1473e4f877b5f7a7d8bcd589f1f989b8875ffddd83ae716a21

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/search_icon.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1515654
cf-polished: origSize=223, status=vary_header_present
content-length: 202
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "df-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Sun, 19 Sep 2021 13:43:33 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98651a07729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 icon_quicknav.png
www.bleepingcomputer.com/forums/public/style_images/master/ 489 B
651 B 36ms
36ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/icon_quicknav.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1731db9016f326daff11d0045c86fd068ec9e72cc4c6ec56a7c856a3a3d28c7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/icon_quicknav.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1645119
cf-polished: status=not_needed
content-length: 489
last-modified: Fri, 01 Jul 2011 10:17:42 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "1e9-4a6ff53f0bd80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Sat, 18 Sep 2021 01:45:48 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98651a09729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 topic_button_closed.png
www.bleepingcomputer.com/forums/public/style_images/master/ 168 B
310 B 29ms
26ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/topic_button_closed.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e58ef84b3994aa5d6238df46b20e480c270cdd6094a41166583f7491665152a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/topic_button_closed.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1451712
cf-polished: origSize=251, status=vary_header_present
content-length: 168
last-modified: Wed, 20 Apr 2011 17:38:04 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "fb-4a15d163d7700"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 07:29:14 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98652a0c729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 maintitle.png
www.bleepingcomputer.com/forums/public/style_images/master/ 192 B
305 B 36ms
33ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/maintitle.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85a2c5bd701224851deca6029998517a35d091922217a90241fd0c7f244e8f11

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/maintitle.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1458333
cf-polished: origSize=295, status=vary_header_present
content-length: 192
last-modified: Tue, 01 Mar 2011 13:54:08 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "127-49d6c2153a000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:38:54 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98652a0d729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2

200

connatix.playspace.dc.js Show response
cds.connatix.com/p/128743/ Frame 3DB3
Redirect Chain

https://cd.connatix.com/connatix.playspace.js
https://cds.connatix.com/p/128743/connatix.playspace.dc.js

1 MB
236 KB

24ms
22ms

Script
application/javascript

151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/128743/connatix.playspace.dc.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e0c74f6aab5901021af0606bff71c8766ac4595a1f4c4d1cb62307b026ff157f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
last-modified: Mon, 06 Sep 2021 12:35:48 GMT
age: 50839
etag: "2448ad1016bda6a8dbf0f19755728fb0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 241118

Redirect headers

location: https://cds.connatix.com/p/128743/connatix.playspace.dc.js
date: Tue, 07 Sep 2021 02:44:27 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
age: 0
accept-ranges: bytes
content-length: 0
retry-after: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 7050
date: Tue, 07 Sep 2021 00:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Tue, 07 Sep 2021 02:46:57 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/ 5 KB
2 KB 403ms
388ms Script
application/javascript 2600:9000:2240:8400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:8400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a5ad4fb0d40625889969083053d32ab1191e66c11bb4aebfde2643954c0f5673

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 07 Sep 2021 02:44:28 GMT
content-encoding: gzip
last-modified: Wed, 10 Feb 2021 21:51:23 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
etag: W/"2a272bfedaf02360b78846550b427698"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript
via: 1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront)
cache-control: max-age=900
cross-origin-resource-policy: cross-origin
x-amz-cf-id: Z5SSE1frr_nSGMOhkTzN3gwPIsoC8ZUEwBXSyxY9Ive6sosF9HFj9Q==

GET
H2 200 icon_warning.png
www.bleepingcomputer.com/forums/public/style_images/master/ 268 B
434 B 26ms
26ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/icon_warning.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5028e223096a25034d4d95863f89374a4b205e86354c5e4461e00272e7fab4d9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/icon_warning.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1456260
cf-polished: origSize=408, status=vary_header_present
content-length: 268
last-modified: Wed, 20 Apr 2011 21:00:34 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "198-4a15fea6fc080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 06:13:27 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98659a1c729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 thumbup.gif
www.bleepingcomputer.com/forums/public/style_emoticons/default/ 870 B
1 KB 28ms
27ms Image
image/gif 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_emoticons/default/thumbup.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf81ee519d1f6a17da950869290048f4215fc035c16a452265a1a1ee8e831b40

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_emoticons/default/thumbup.gif
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1642274
cf-polished: origSize=1704, status=vary_header_present
content-length: 870
last-modified: Sun, 09 Oct 2005 23:10:40 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6a8-402ba621bbc00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/gif
expires: Sat, 18 Sep 2021 02:33:13 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9865aa1e729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 51a5ce45263de-delfix.png
www.imgdumper.nl/uploads6/51a5ce45267c1/ 3 KB
4 KB 106ms
17ms Image
image/png 185.208.56.78
VUSAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.208.56.78 , Netherlands, ASN205726 (VUSAM, NL),
Reverse DNS: vip1-web.ams1.vusam.com
Software: Apache /
Resource Hash: 09c9f96143372ee7e9fee4a67f16feec1d7d251f7739e9c77f13365fd0938484

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
last-modified: Tue, 24 Nov 2015 16:34:44 GMT
server: Apache
etag: "d58-5254beb55bb20"
content-type: image/png
x-vusam: YTbSCz9Nhq3yX-15QHklFwABjwQ
accept-ranges: bytes
content-length: 3416
x-served-by: web1.ams1

GET
H2 200 twitter.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 575 B
750 B 39ms
33ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/twitter.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abe9d30276e3d66a71219ad2b0ed5a9663020a5c534557dd0f5c8ba71da4ebd4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/twitter.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1127241
cf-polished: status=not_needed
content-length: 575
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "23f-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Fri, 24 Sep 2021 01:37:06 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a28729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 plusone.js Show response
apis.google.com/js/ 54 KB
21 KB 189ms
184ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

92c171ba5806e8e3bd6d4cec2267a87aace951654b0ba5877a45633e593c5642

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-h/Gc88+m468vt6CSq2NKPQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "79fa035d59aae046b5eec1ee2a8a5b4b"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-h/Gc88+m468vt6CSq2NKPQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Tue, 07 Sep 2021 02:44:27 GMT

GET
H2 200 digg.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 357 B
527 B 33ms
27ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/digg.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f33585b10bb5487bd6c92f53018de62cb147ab48b829334b7f97437015aae557

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/digg.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1811694
cf-polished: origSize=431, status=vary_header_present
content-length: 357
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "1af-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Thu, 16 Sep 2021 03:29:33 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a2a729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 delicious.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 305 B
419 B 37ms
30ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/delicious.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b9f912b0e7a50c12745f52ec2848dce5b779369999c6d35e6c297c713ce53d3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/delicious.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457149
cf-polished: origSize=308, status=vary_header_present
content-length: 305
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "134-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:58:38 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a2c729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 reddit.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 611 B
725 B 35ms
29ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/reddit.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9019adc6ec44d2cd4f38c97b8319b0ae8da8f03b3bd646d4f86707f23f8935a0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/reddit.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457149
cf-polished: origSize=614, status=vary_header_present
content-length: 611
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "266-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:58:38 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a2d729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 stumble.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 458 B
692 B 39ms
34ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/stumble.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e2a136c594c939d55752e9abb70e6cc550b10bc3bc350c0d46d23d5947c20d1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/stumble.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457149
cf-polished: origSize=519, status=vary_header_present
content-length: 458
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "207-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:58:38 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a30729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 email.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 481 B
647 B 36ms
30ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/email.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

453d30f69cc2a6f3013254a0faed039d49cf9c5b004d5482fb5365e99702c149

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/email.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1644523
cf-polished: origSize=530, status=vary_header_present
content-length: 481
last-modified: Thu, 04 Feb 2010 11:47:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "212-47ec4e74b3c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Sat, 18 Sep 2021 01:55:44 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a33729f-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 print.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 268 B
451 B 31ms
25ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/print.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6aeb9f7542993c71c548ac254766824ef86c68f0d6fa13f293bd016b9cfc9dc6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/print.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457149
cf-polished: origSize=409, status=vary_header_present
content-length: 268
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "199-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:58:38 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a34729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 download.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 646 B
752 B 36ms
30ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/download.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

386f87a6e6fcb89c6b046f988d18def949d1cc1f6a9fa4177858aa11da7a5bda

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_extra/sharelinks/download.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457149
cf-polished: status=not_needed
content-length: 646
last-modified: Fri, 12 Feb 2010 14:33:56 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "286-47f6828485d00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:58:38 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a35729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 prettify.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/ 14 KB
7 KB 41ms
36ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/prettify.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b937537ed7f13e70dc6a69b6e9b308237cd369e11fa2a2b97a24d97d8487673e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/3rd_party/prettify/prettify.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 1845
cf-polished: origSize=14551
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"38d7-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac98661a2b729f-AMS
cf-bgj: minify

GET
H2 200 lang-sql.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/ 2 KB
1 KB 37ms
32ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/lang-sql.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

770cb6f8747e90dad261e049dfa5cf42e622dac61bcbc86ecb0a8c134228eb91

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/3rd_party/prettify/lang-sql.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 1845
cf-polished: origSize=1802
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"70a-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac98661a31729f-AMS
cf-bgj: minify

GET
H2 200 top.png
www.bleepingcomputer.com/forums/public/style_images/master/ 145 B
310 B 33ms
28ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/top.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db311c11353d5628e6e28d260bca9b8935b23440964d7c6bc4914edcda08472a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/top.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1458329
cf-polished: origSize=207, status=vary_header_present
content-length: 145
last-modified: Thu, 09 Jun 2011 17:25:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "cf-4a54abe32b600"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:38:58 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a36729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 feed.png
www.bleepingcomputer.com/forums/public/style_images/master/ 680 B
823 B 34ms
29ms Image
image/png 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/feed.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9320021507b35e189d2190eea673cbc21f7d368f6ecbfb5dc89d773a28cd015d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/feed.png
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1458329
cf-polished: status=not_needed
content-length: 680
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "2a8-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/png
expires: Mon, 20 Sep 2021 05:38:58 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac98661a37729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 lightbox.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/ 9 KB
3 KB 29ms
24ms Script
application/javascript 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/lightbox.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9faebe5bdb9528f36d1ec5713865681bf10c7c0d1fa1b8224fc57982f45ed788

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/js/3rd_party/lightbox.js
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
cf-cache-status: HIT
age: 4838
cf-polished: origSize=10227
last-modified: Sun, 15 Nov 2020 22:30:01 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"27f3-5b42ccd71fd03-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 68ac98661a32729f-AMS
cf-bgj: minify

GET
H2 200 3687X620620.skimlinks.js Show response
s.skimresources.com/js/ 41 KB
15 KB 66ms
19ms Script
application/octet-stream 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/3687X620620.skimlinks.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0f19e06c2db26fc72935e540fc02c48f134dbd95204fab03e8851d39d9563fd6

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
last-modified: Mon, 23 Aug 2021 09:41:15 GMT
server: AmazonS3
x-amz-request-id: S59QYYY2MYQJMAPY
etag: "50ea198f0702f1a2abd7af0b9fbac812"
x-hw: 1630982667.cds136.am5.hn,1630982667.cds075.am5.c
content-type: application/octet-stream
cache-control: max-age=3600
accept-ranges: bytes
content-length: 15457
x-amz-id-2: A3Tlto6LDSasqvz/s8uPYkrXg0Nlus03gus4ZNkDBOj75geCDjeSTr0iLVfmc0WQgrH/L/Hko6A=

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 13 KB
5 KB 51ms
31ms Script
text/javascript 2606:4700::6810:5e41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4efeeb957e361500bf19ba26282beae1a8e4083c5ccff10dccab2eaa09acd45

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
last-modified: Thu, 26 Aug 2021 22:03:28 GMT
server: cloudflare
etag: W/2021.8.2
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 68ac98662e7b5b7a-FRA

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
500 B 77ms
22ms Image
image/x-icon 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.134 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 17:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32146
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 07 Sep 2021 17:48:41 GMT

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ 3 KB
3 KB 76ms
24ms Image
image/svg+xml 2.18.234.190
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.190 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-190.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
last-modified: Thu, 24 Jun 2021 14:35:21 GMT
server: AkamaiNetStorage
etag: "9d26fa4e7238ed94f1d0d92afb453b3e:1624546014.914244"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2735
expires: Thu, 07 Oct 2021 02:44:27 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 15ms
15ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1752009260&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&ul=en-us&de=windows-1252&dt=C%3A%5CWindows%5Csystem32%5Cuserinit.exe%20malware%20infection%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1680893768&gjid=1644420316&cid=1587472098.1630982667&tid=UA-91740-1&_gid=544709254.1630982667&_r=1&gtm=2ou910&z=2124191059

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 02:44:27 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 init Show response
d.pub.network/ 6 KB
1 KB 155ms
115ms XHR
application/json 35.201.71.192
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/init?siteId=535
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 192.71.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 4020cab5a5ec3771392556793f6bdd0a66180a40574b41648bb2f375fa59f326

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type: application/json
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H2 200 connatix.playspace.css
cds.connatix.com/p/128743/ 95 KB
13 KB 22ms
22ms Stylesheet
text/css 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/128743/connatix.playspace.css
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 60748fdd53c96d1eca2671628730f0a745d86d8223bc86f1d77d9b691920d8f9

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
last-modified: Mon, 06 Sep 2021 12:35:48 GMT
age: 50839
etag: "2d5d1c3d89cc4965db765c1c8754e68e"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 13297

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f2af80df6898ffc30153f1e77ae8691fc1e55ac7d5bce64b9124ed2b91fdadc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: mAcUI8LOlpGmeIWvPwgLyw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: C4ebBZzoWMsINk0gVgtJySShMMinHCFeBHdZKSRFAXiaLJx1mLgg7xCWFzYGlvBa1Pbp9ozwLAEAjMOSqCcXgA==
x-fb-trip-id: 2050670934
x-fb-content-md5: c55b013a9fd038b189a81656722e0b02
x-frame-options: DENY
date: Tue, 07 Sep 2021 02:44:27 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "814375fde17f607dabf185ea7b427546"
timing-allow-origin: *
expires: Tue, 07 Sep 2021 02:49:10 GMT

GET
H3-29 200 all.js Show response
connect.facebook.net/en_US/ 222 KB
65 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=943f754948cb6c587e9406b034b623ce

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8bbf593c2b5fc72db726a4144fc70682afcbca754dcf5d4b6479ef6a7cfc9bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: yvU8WBUgSpo+Vaa/14nl3g==
cross-origin-resource-policy: cross-origin
expires: Wed, 07 Sep 2022 02:14:12 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 66847
x-fb-rlafr: 0
x-fb-debug: HZ+MGS0gNoqKK3kVVsbqcDgBKwpiRG09dzz+gSVy+6s0pgqLcepnkAp1+APe25Jx4lQGNkCcbRMQUBNyVYvpuw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: fdc6c39ac046293bba75183d3cf53c42
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 07 Sep 2021 02:44:27 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "8bc1b5e933402cb2285371a50ff406b3"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

POST
H/1.1 200
OK story Show response
capi.connatix.com/core/ Frame 3DB3 1 KB
1 KB 454ms
126ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/story?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 73d05df4efdb6570ecdcf792d681264fc471103f9c73640b57d2b930ad206a1e

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:27 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 858

GET
H3-29 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/ 149 KB
51 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2487b91b81877d82ce166be25f03c9c5b55dbbf6912385c5c72a1fac44d664f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:46:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3485
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52479
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 18:17:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:46:22 GMT

POST
H2

200

/ Show response
r.skimresources.com/api/
Redirect Chain

https://r.skimresources.com/api/
https://r.skimresources.com/api/?xguid=01FEZ28Z6RJM7AW2N6MBENYCJ7&persistence=1&checksum=fedfbfbd506f8bf83450f0484e180719ff25113f030d3b458b734fc9a07724ad

256 B
525 B

22ms
22ms

XHR
application/json

35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01FEZ28Z6RJM7AW2N6MBENYCJ7&persistence=1&checksum=fedfbfbd506f8bf83450f0484e180719ff25113f030d3b458b734fc9a07724ad

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

64d1271d34ff55ddb5cf77e5e5919717cb347467ed02e17d40256131571a7618

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
strict-transport-security: max-age=31536000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.bleepingcomputer.com
vary: Accept-Encoding
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

Redirect headers

date: Tue, 07 Sep 2021 02:44:27 GMT
via: 1.1 google
server: openresty/1.11.2.5
access-control-allow-origin: https://www.bleepingcomputer.com
strict-transport-security: max-age=31536000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
location: https://r.skimresources.com/api/?xguid=01FEZ28Z6RJM7AW2N6MBENYCJ7&persistence=1&checksum=fedfbfbd506f8bf83450f0484e180719ff25113f030d3b458b734fc9a07724ad
access-control-allow-credentials: true
content-type: text/html
alt-svc: clear
content-length: 193

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame 29E7 0
102 B 58ms
20ms Image
text/plain 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.9158554390290865
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
244 B 62ms
20ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=3.8523657750164406
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
102 B 62ms
20ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=3.8523657750164406
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

GET
H2 200 loading.gif
www.bleepingcomputer.com/forums/public/style_images/master/lightbox/ 2 KB
2 KB 29ms
28ms Image
image/gif 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/loading.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61da0a4638505960ec52709b7df80d92683c56e13042079daf5f082fc9548d5e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/lightbox/loading.gif
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6; _ga=GA1.2.1587472098.1630982667; _gid=GA1.2.544709254.1630982667; _gat_gtag_UA_91740_1=1; fsbotchecked=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1127241
cf-polished: origSize=2767, status=vary_header_present
content-length: 1588
last-modified: Thu, 18 Dec 2008 14:27:04 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "acf-45e52fc88de00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/gif
expires: Fri, 24 Sep 2021 01:37:06 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9867aa6b729f-AMS
cf-bgj: imgq:100,h2pri

GET
H2 200 closelabel.gif
www.bleepingcomputer.com/forums/public/style_images/master/lightbox/ 471 B
650 B 26ms
26ms Image
image/gif 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/closelabel.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e89beb7d66ef7d5e58dfcefd22a51e1a8ae452a49bc20d020418cf2b6c666d0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:path: /forums/public/style_images/master/lightbox/closelabel.gif
pragma: no-cache
cookie: session_id=8911b82853637c0eea585be5089919c6; _ga=GA1.2.1587472098.1630982667; _gid=GA1.2.544709254.1630982667; _gat_gtag_UA_91740_1=1; fsbotchecked=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
cf-cache-status: HIT
age: 1457144
cf-polished: origSize=483, status=vary_header_present
content-length: 471
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "1e3-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
content-type: image/gif
expires: Mon, 20 Sep 2021 05:58:43 GMT
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 68ac9867aa6c729f-AMS
cf-bgj: imgq:100,h2pri

GET
H3-29 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/ 96 KB
33 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a6f0fdd079cd2bb0fa098f60d11b5823666a6b78e1c79bdb3302e4dd1325dba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 01:40:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3844
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34107
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 18:17:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 01:40:23 GMT

GET
H3-29 404 fastbutton Show response
apis.google.com/u/0/se/0/_/+1/ Frame 5C3E 2 KB
2 KB 6ms
5ms Document
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__
Requested by: Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: ac15d1868a55adcea61641c78efbb86feda3a65882f21bfe9fedd7348fb54be8

Request headers

:method: GET
:authority: apis.google.com
:scheme: https
:path: /u/0/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=223=dbh55RrZg_7wnBdFlEVEeY1KYs9FaYIk-SwrTUlEdK79RyGaWAjJUqeCk1gyc72bAJHUvu6hE_sf6WccKENvkMvmOs57C86PHhYwk6Bct3lnZDGn6E3j2vsgHHMq5Nzbyv9VKmfM0-TAhWVrFQaRrc0XmiHsmsNcAaHp6bN9kXE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

content-type: text/html; charset=UTF-8
referrer-policy: no-referrer
content-length: 1585
date: Tue, 07 Sep 2021 02:44:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 26ms
25ms Fetch
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=942111685863795&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=943f754948cb6c587e9406b034b623ce

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: S3HK6HkbBRIsQzsbgwBz5GUpVFlbu5cYWAPrhlmvAgjfKtPiTBDlbZcrsRkrxsNbyWU6VUSROoJILYsMvuQ6/g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 07 Sep 2021 02:44:27 GMT
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 like.php Show response
www.facebook.com/plugins/ Frame C770 0
21 B 26ms
26ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df19f549775f8958%26domain%3Dwww.bleepingcomputer.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff1e344be1b70cc%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=943f754948cb6c587e9406b034b623ce

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df19f549775f8958%26domain%3Dwww.bleepingcomputer.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff1e344be1b70cc%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: gqHzVuxnSdtLIpnQeL+Ir4LAAlNlFaqVFg56MWcHgIbj9qxHgSNfpwvw8bYFrrxTCOydkjdnAokWPUC7bld9kg==
content-length: 0
date: Tue, 07 Sep 2021 02:44:27 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 postmessageRelay Show response
accounts.google.com/o/oauth2/ Frame 68AB 566 B
570 B 16ms
16ms Document
text/html 2a00:1450:4001:827::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/cb=gapi.loaded_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2f465f3d54e5441bfe4abf98795685d4a60f59f5f8936c69a138e58881e6e398

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MeeIDDTf3z3WJiBAoC5XAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=223=dbh55RrZg_7wnBdFlEVEeY1KYs9FaYIk-SwrTUlEdK79RyGaWAjJUqeCk1gyc72bAJHUvu6hE_sf6WccKENvkMvmOs57C86PHhYwk6Bct3lnZDGn6E3j2vsgHHMq5Nzbyv9VKmfM0-TAhWVrFQaRrc0XmiHsmsNcAaHp6bN9kXE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 07 Sep 2021 02:44:27 GMT
content-security-policy: script-src 'report-sample' 'nonce-MeeIDDTf3z3WJiBAoC5XAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 googlelogo_color_150x54dp.png
www.google.com/images/branding/googlelogo/1x/ Frame 5C3E 3 KB
3 KB 14ms
13ms Image
image/png 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png

Requested by

Host: apis.google.com
URL: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
server: sffe
content-type: image/png
cache-control: private, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3170
x-xss-protection: 0
expires: Tue, 07 Sep 2021 02:44:27 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 25ms
8ms Script
application/javascript 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
etag: "lp772EpWKwf8Kq7YKMhbuw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Tue, 14 Sep 2021 02:44:27 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/23/ 266 KB
67 KB 8ms
8ms Script
text/javascript 2600:9000:2240:8400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js?referer=www.bleepingcomputer.com
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:8400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7baadf42bdd7151de787de3b98f1c65f55cc2b3d34d4fbe90a0e490756dd3a1b

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: br
x-amz-cf-pop: FRA60-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Fri, 18 Dec 2020 15:09:37 GMT
server: AmazonS3
etag: W/"1d55b13d85c9837da884d1e8594cc025"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront)
cache-control: max-age=172800
x-amz-meta-qc-ineu: True
x-amz-cf-id: ioOD-vuXEV7BHyxXY3yEwpExX48ASUgfwX-E7fD3NcmlnFAQ7xRiwA==

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
346 B 24ms
22ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 02:44:27 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

POST
H2 200 link Show response
t.skimresources.com/api/v2/ 22 B
114 B 26ms
25ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 02:44:27 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
warning: 299 - "Deprecated API"
alt-svc: clear
content-length: 22

GET
H2 200 1291055585-postmessagerelay.js Show response
ssl.gstatic.com/accounts/o/ Frame 68AB 10 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/1291055585-postmessagerelay.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bceb42c38849f45f8eccea1ad752b5ccea22eba051598d3890607f03941e301e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 19:50:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24855
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4306
x-xss-protection: 0
last-modified: Thu, 02 Sep 2021 16:34:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 19:50:12 GMT

GET
H3-29 403 rpc:shindig_random.js
apis.google.com/js/ Frame 68AB 0
0 236ms
235ms Script
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apis.google.com/js/rpc:shindig_random.js?onload=init
Requested by: Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.UYHeVG_mX5s.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA%2Fm%3D__features__
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

POST
H2 200 api Show response
ls.skimresources.com/ 2 B
352 B 53ms
22ms XHR
application/json 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ls.skimresources.com/api

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

212.117.120.34.bc.googleusercontent.com

Software

Python/3.8 aiohttp/3.6.3 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 02:44:27 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.8 aiohttp/3.6.3
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 2

OPTIONS
H2 206 api
ls.skimresources.com/ Frame 0
0 62ms
21ms Preflight
text/plain 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ls.skimresources.com/api
Protocol: H2
Server: 34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 212.117.120.34.bc.googleusercontent.com
Software: Python/3.8 aiohttp/3.6.3 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-credentials: true
access-control-max-age: 1728000
content-type: text/plain charset=UTF-8
content-length: 0
date: Tue, 07 Sep 2021 02:44:27 GMT
server: Python/3.8 aiohttp/3.6.3
via: 1.1 google
alt-svc: clear

GET
H2 200 rules-p-sktb670LZWvFX.js Show response
rules.quantcount.com/ 2 B
353 B 31ms
7ms Script
application/javascript 2600:9000:223c:c600:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-sktb670LZWvFX.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:c600:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:17:23 GMT
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
server: AmazonS3
age: 1624
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-P2
content-length: 2
x-amz-cf-id: lVZfZ40IV1dMe28JanM6tXqtYlt9BTrwK2uemD2niMqdzsrPdDMccg==

POST
H2 200 rum Show response
www.bleepingcomputer.com/cdn-cgi/ 0
229 B 33ms
32ms XHR
text/plain 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://www.bleepingcomputer.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: session_id=8911b82853637c0eea585be5089919c6; _ga=GA1.2.1587472098.1630982667; _gid=GA1.2.544709254.1630982667; _gat_gtag_UA_91740_1=1; fsbotchecked=true
content-length: 25163
:path: /cdn-cgi/rum?
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: www.bleepingcomputer.com
referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/json

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 68ac986a0aae729f-AMS
vary: Origin

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame 3DB3 0
305 B 110ms
109ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:27 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 71 KB
25 KB 89ms
37ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

5491c42f405dfd058fbfe927c745cd1ee50e1181109213236ee2707fa39ddcd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "980 / 769 of 1000 / last-modified: 1630707028"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25026
x-xss-protection: 0
expires: Tue, 07 Sep 2021 02:44:27 GMT

GET
H2 200 d98ec666-f4c9-4d2c-bdbc-230cd9812d21.bin Show response
vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ Frame 3DB3 2 KB
1 KB 71ms
22ms XHR
application/octet-stream 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/d98ec666-f4c9-4d2c-bdbc-230cd9812d21.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: dac3d8106bc18a8979ba62abdd19a101db31fd35edb01de85dfb7fb59c614db5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
last-modified: Tue, 07 Sep 2021 00:41:16 GMT
age: 6732
etag: "9aebc755aa65213ad3d9f2c12b29efad"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 820

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 3DB3 346 KB
119 KB 36ms
15ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a876f6cbd09c5f245491f6877db2a6bb7faa356893ae8a5f8881b2ad6c64212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121776
x-xss-protection: 0
expires: Tue, 07 Sep 2021 02:44:27 GMT

GET
H2 200 1.png
img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/ 10 KB
10 KB 58ms
16ms Image
image/png 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/1.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:27 GMT
age: 1361392
etag: "o7hSHwAUmCBIixIgiGzuW02nJNU8oGEvPnjWp++AQj4"
access-control-max-age: 86400
fastly-io-info: ifsz=11996 idim=794x206 ifmt=png ofsz=9784 odim=794x206 ofmt=png
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/png
content-length: 9784

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame 3DB3 0
305 B 110ms
110ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:28 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 514171 Show response
vid.springserve.com/vast/ Frame 3DB3 2 KB
2 KB 108ms
35ms XHR
application/xml 52.17.148.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.148.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-148-138.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a65e5020ce315d2f7816cad4b2059deeb814bbbce176f8f398a84c4123dec57e

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:28 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-encoding: gzip
content-type: application/xml;charset=UTF-8

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame 3DB3 0
305 B 216ms
110ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:28 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame 3DB3 0
305 B 326ms
109ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:28 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 a6d4ed46-207d-435b-911e-5d78cd477a03.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 36 KB
36 KB 17ms
16ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/a6d4ed46-207d-435b-911e-5d78cd477a03.jpg?crop=700:466,smart&width=700&height=466&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3a650c0ffb1c523bcc0971339fce1041e1c869a41b7ef19111660bab971474f4

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
age: 7253
etag: "fJExxrPMKJ4H5q2LPx75dz9UPYyywaAexSIssZSHjbM"
access-control-max-age: 86400
fastly-io-info: ifsz=286066 idim=1600x900 ifmt=jpeg ofsz=36357 odim=700x466 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 36357

GET
H2 200 a6d4ed46-207d-435b-911e-5d78cd477a03.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 31 KB
32 KB 22ms
21ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/a6d4ed46-207d-435b-911e-5d78cd477a03.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 31b8526e4ac283f51ecf9672eecfbe5289bf01725928c709bed02552aadd9ba4

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
age: 7254
etag: "Kehll3N8Kw7plOZkWHE92r+yf8IdaIuFv8T5/MinTOg"
access-control-max-age: 86400
fastly-io-info: ifsz=286066 idim=1600x900 ifmt=jpeg ofsz=32178 odim=700x394 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 32178

GET
H2 200 1c676518-fc2e-4d1a-9560-688d970abfe3.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 37 KB
37 KB 20ms
20ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/1c676518-fc2e-4d1a-9560-688d970abfe3.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8b9f51f2037ca9ed1ea10090900f4aca13effed80704a7974fabe690de030a62

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
age: 7254
etag: "Oazw3aIVShEHHI1FF4gd08OV58RU1+OSqafW/6M+UhY"
access-control-max-age: 86400
fastly-io-info: ifsz=236452 idim=1600x800 ifmt=jpeg ofsz=37531 odim=700x394 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 37531

GET
H2 200 4b15f677-33ad-4bd2-af5b-0871ab7b789b.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 35 KB
36 KB 31ms
31ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/4b15f677-33ad-4bd2-af5b-0871ab7b789b.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8aecac344ea130923fe6511a82e9243abbfee44798b89d3d83fc418f2118dee9

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
age: 7254
etag: "a7uec9+fkAeSSEUfQR64gjcg+FkjsSW/N93Fng5AwYE"
access-control-max-age: 86400
fastly-io-info: ifsz=217044 idim=1600x800 ifmt=jpeg ofsz=36292 odim=700x394 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 36292

GET
H2 200 99301c04-3adc-4a15-837b-3042f0b09383.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 18 KB
18 KB 33ms
33ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/99301c04-3adc-4a15-837b-3042f0b09383.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 04228922aa3c9bed556396d0a7a8f6bc276d43e559224a2fa239f91a6b1b3f27

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
age: 7254
etag: "Ncql94ckeA/8adbf4CfdnA8eUrK9ZP35pkLW5DzE+0w"
access-control-max-age: 86400
fastly-io-info: ifsz=101841 idim=1600x900 ifmt=jpeg ofsz=18592 odim=700x394 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 18592

GET
H2 200 4d02bca0-10be-4986-8490-2e69e5ae9af2.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 32 KB
32 KB 33ms
33ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/4d02bca0-10be-4986-8490-2e69e5ae9af2.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 72f891878adaafb271ac1f5c2a1a93bb37476e736c5159a95a12008a4a412040

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
age: 7254
etag: "SyT2uBktqvAYvFloRc/+d1AV/8FTiqc19OTAA2ksJ4w"
access-control-max-age: 86400
fastly-io-info: ifsz=182823 idim=1600x900 ifmt=jpeg ofsz=33031 odim=700x394 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 33031

GET
H3-29 200 pubads_impl_2021090201.js Show response
securepubads.g.doubleclick.net/gpt/ 332 KB
116 KB 39ms
37ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090201.js?31062472

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

8be49f44baab6e5003972c8bc33123dd34257840a77a1d20b7365ae8b60a896c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 Sep 2021 08:37:45 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119104
x-xss-protection: 0
expires: Tue, 07 Sep 2021 02:44:28 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 128 B
128 B 61ms
31ms XHR
application/json 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bleepingcomputer.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

5259445f9adc786a154b71a542eb2b859a15c55bf38419e23ba260ecb5cf5c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 07 Sep 2021 02:44:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103
x-xss-protection: 0
expires: Tue, 07 Sep 2021 02:44:28 GMT

GET
H3-29 200 bridge3.478.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 6E25 574 KB
188 KB 21ms
6ms Document
text/html 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.478.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ba74b0b7223564fe5de95a05498160da36162274673a6c4583a757d233c41b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.478.2_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 192508
date: Fri, 03 Sep 2021 19:55:47 GMT
expires: Sat, 03 Sep 2022 19:55:47 GMT
last-modified: Fri, 03 Sep 2021 19:50:18 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 283721
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 3DB3 44 KB
17 KB 31ms
30ms Script
text/javascript 142.250.185.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f6.1e100.net

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
expires: Tue, 07 Sep 2021 02:44:28 GMT

GET
H3-29 200 bridge3.478.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame DFC5 574 KB
188 KB 6ms
6ms Document
text/html 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.478.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ba74b0b7223564fe5de95a05498160da36162274673a6c4583a757d233c41b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.478.2_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 192508
date: Fri, 03 Sep 2021 19:55:47 GMT
expires: Sat, 03 Sep 2022 19:55:47 GMT
last-modified: Fri, 03 Sep 2021 19:50:18 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 283721
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 bridge3.478.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame A57A 574 KB
188 KB 6ms
6ms Document
text/html 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.478.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ba74b0b7223564fe5de95a05498160da36162274673a6c4583a757d233c41b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.478.2_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 192508
date: Fri, 03 Sep 2021 19:55:47 GMT
expires: Sat, 03 Sep 2022 19:55:47 GMT
last-modified: Fri, 03 Sep 2021 19:50:18 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 283721
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame FAA2 36 KB
13 KB 28ms
5ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 07 Sep 2021 03:41:24 GMT

GET
H2 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 236D 36 KB
12 KB 29ms
9ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 07 Sep 2021 03:41:24 GMT

GET
H2 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame FE7C 36 KB
12 KB 30ms
11ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 07 Sep 2021 03:41:24 GMT

GET
H2 200 vpaid_44854a27.js Show response
vpaid.springserve.com/production/ Frame DC56 487 KB
87 KB 31ms
7ms Script
application/javascript 2600:9000:2240:2400:15:6f6c:b180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:2400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 11e41d859e2bb2f97068bbbffff15522b7852828e938a464164ffbad62cfa389

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 15:01:09 GMT
content-encoding: br
last-modified: Wed, 25 Aug 2021 15:00:31 GMT
server: AmazonS3
age: 1079000
etag: W/"d48d9d8b9aa42be3c59a03030903498a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 06a27d66e25d02ebcfb014b9d194016b.cloudfront.net (CloudFront)
cache-control: max-age=2678400
x-amz-cf-pop: FRA60-P1
x-amz-cf-id: KWAOFalRbMwWJVp62rejOxy9QZg8Bua3ESvhEPKlRjHcDLTI4RqhHQ==

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame DC56 0
225 B 311ms
234ms XHR
application/json 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-100-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame DC56 0
225 B 312ms
235ms XHR
application/json 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-100-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame DC56 160 B
844 B 65ms
22ms XHR
application/json 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

758339428b72b6389dedb869502ed75424bbeb09fc09578bea044112bd8093fa

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 07 Sep 2021 02:44:28 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 10a48219-7df7-4f0c-bbf8-9b74df25fe16
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 160
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST translator
hbopenbid.pubmatic.com/ Frame DC56 0
0

GET
H/1.1 200
OK VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g= Show response
ads.adaptv.advertising.com/a/h/ Frame DC56 2 KB
1 KB 24ms
24ms XHR
text/xml 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1630982668088&gdpr=1&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-125-100-70.eu-central-1.compute.amazonaws.com

Software

adaptv/1.0 /

Resource Hash

34e7b4331fd65afce4e2f321359d3e5ca0effe3e706f71227cbf351961ed67aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
server: adaptv/1.0
content-type: text/xml
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 955
expires: 0

GET
H2 200 o2shim Show response
acds.prod.vidible.tv/ Frame C8C7 15 KB
7 KB 108ms
30ms Script
application/javascript 52.213.94.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=c81dcb78-3b62-45a5-9af8-bd729949261f&pblob=
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.94.69 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-94-69.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 58213c748dfdfc0148f2466969e3a96243974aa6fe7da0c974b2ef44086659fa

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:29 GMT
content-encoding: gzip
access-control-max-age: 3600
access-control-allow-methods: POST, GET, HEAD, PUT, PATCH, DELETE
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-headers
content-length: 6635

GET
H2 200 0.js Show response
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/ Frame C8C7 318 KB
103 KB 26ms
6ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js

Requested by

Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=c81dcb78-3b62-45a5-9af8-bd729949261f&pblob=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e21ce3b8effc95ceeffb672439c7266023a9f4505d17292a9da44efeafd0e6ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 01 Sep 2021 06:43:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 504085
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-length: 104700
x-amz-id-2: 4lCUgDBZN82qQtVxRMYj7umB5v9DLXR72Ojs/wVa1fNH/obXN2rlI75VlgvG0iRpM9TY+ozBPLs=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 01 Sep 2021 05:30:30 GMT
server: ATS
etag: "d84d25280de45abd32c31cb97a2b8ef5-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-request-id: GT2XPJMFVQZWN0J5
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=1209600
x-amz-version-id: null
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 impression.gif
trk.vidible.tv/trk/ Frame C8C7 43 B
246 B 77ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.72&ifr=true&cb=0.21736607113542306&pt=o2unit&sid=2a7a68eb-f9e1-4713-9693-11da61369c78&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:29 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:29 GMT

GET
H2 200 moatapi.js Show response
z.moatads.com/aolvidibleapi29384728347/ Frame DC56 133 KB
44 KB 70ms
22ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by: Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:29 GMT
content-encoding: gzip
last-modified: Tue, 25 Feb 2020 18:37:38 GMT
server: AmazonS3
x-amz-request-id: 844FF664DE0AB17A
etag: "d678022569896f7b7293494e3a69c8c7"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=45664
accept-ranges: bytes
content-length: 44266
x-amz-id-2: KrpVRZD3M0T4g9xUncS5g3siU6Z/qnTuCp2KYOKEtN/tCl8UaA8yn/9PP1OCFx0nXyimfljs5VQ=

GET
H/1.1 200
OK VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame C8C7 249 B
0 477ms
432ms XHR
text/xml 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1630982668088&gdpr=1&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=394&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=700

Requested by

Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-125-100-70.eu-central-1.compute.amazonaws.com

Software

adaptv/1.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: text/javascript, application/json, text/html, application/xml, text/xml, */*
Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
server: adaptv/1.0
content-type: text/xml
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 192
expires: 0

GET
H2 200 display.gif
trk.vidible.tv/trk/ Frame C8C7 43 B
245 B 23ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=2a7a68eb-f9e1-4713-9693-11da61369c78&vvuid=889c4fce-23c0-4258-98a2-0d1227ff1234&orgId=28949&plcid=1279691&vrid=c81dcb78-3b62-45a5-9af8-bd729949261f&ab=0&dt=71&h=394&spaceid=793604934&w=700&cb=0.1787226406769964
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:29 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:29 GMT

GET
H2 200 ad-request.gif
trk.vidible.tv/trk/ Frame C8C7 43 B
245 B 24ms
23ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=2a7a68eb-f9e1-4713-9693-11da61369c78&vvuid=889c4fce-23c0-4258-98a2-0d1227ff1234&orgId=28949&plcid=1279691&vrid=c81dcb78-3b62-45a5-9af8-bd729949261f&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.38655146738718993
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:29 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:29 GMT

GET
H2 200 ad-engine-request.gif
trk.vidible.tv/trk/ Frame C8C7 43 B
245 B 24ms
23ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=2a7a68eb-f9e1-4713-9693-11da61369c78&vvuid=889c4fce-23c0-4258-98a2-0d1227ff1234&orgId=28949&plcid=1279691&vrid=c81dcb78-3b62-45a5-9af8-bd729949261f&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=700&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=394&cb=0.8920318686466115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:29 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:29 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 25ms
23ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1630982669669&de=74721311656&d=203%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 02:44:29 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 07 Sep 2021 02:44:29 GMT

GET ad-engine-response.gif
trk.vidible.tv/trk/ Frame C8C7 0
0

GET
H2 200 bc2 Show response
bc-ssb-dub.springserve.com/ Frame DC56 5 KB
1 KB 135ms
65ms XHR
application/json 3.248.127.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bc-ssb-dub.springserve.com/bc2?r=573c8a77-4550-4f1b-a28d-9d78478d9e6d-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=700
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.127.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-127-185.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2eed3708d3a8341d71f3803697daae254a81642d3608f0337c3f6d4055408231

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:30 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json

GET
H2 200 627448 Show response
vid.springserve.com/vast/ Frame DC56 22 B
454 B 33ms
33ms XHR
application/xml 52.17.148.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.springserve.com/vast/627448?w=640&h=480&cb=8894496535417&url=bleepingcomputer.com&ip=159.48.55.4&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F92.0.4515.159+Safari%2F537.36&dnt=&gdpr_consent=&gdpr=1&us_privacy=&schain=&_bchc=1
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.148.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-148-138.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 263b5c14ea0c8dba145eaa30a0e60b7f9e0d3cb3c8f2356f59832ff329fa6d38

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:30 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-length: 22
content-type: application/xml;charset=UTF-8

POST
H2 200 i Show response
vid-io-dub.springserve.com/vd/ Frame DC56 0
123 B 106ms
33ms XHR
text/plain 52.31.202.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid-io-dub.springserve.com/vd/i?suuid=573c8a77&ps_id=514171&batch=1
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.202.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-202-1.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:30 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame 3DB3 0
305 B 332ms
112ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:33 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 529c7140-60b6-4c77-8046-3bc6c88db29b.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 29 KB
29 KB 17ms
16ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/529c7140-60b6-4c77-8046-3bc6c88db29b.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1571598a402216883c338a690388b870c86744e985f90a8279a172a997d3b32a

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
age: 7257
etag: "Rr8UrHFXaZryY3qqfX5lxPbTmoxag+gK4yRbE9Yl/cQ"
access-control-max-age: 86400
fastly-io-info: ifsz=196877 idim=1600x978 ifmt=jpeg ofsz=29986 odim=700x394 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 29986

GET
H2 200 514171 Show response
vid.springserve.com/vast/ Frame 3DB3 2 KB
2 KB 35ms
35ms XHR
application/xml 52.17.148.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.148.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-148-138.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 452c33e4d53d6f0b5f6167b15f5d86782785e30a1848fea3b37adb16b0b97e27

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:34 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-encoding: gzip
content-type: application/xml;charset=UTF-8

GET
H2 200 vpaid_44854a27.js Show response
vpaid.springserve.com/production/ Frame 0ABD 487 KB
87 KB 7ms
6ms Script
application/javascript 2600:9000:2240:2400:15:6f6c:b180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:2400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 11e41d859e2bb2f97068bbbffff15522b7852828e938a464164ffbad62cfa389

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 15:01:09 GMT
content-encoding: br
last-modified: Wed, 25 Aug 2021 15:00:31 GMT
server: AmazonS3
age: 1079006
etag: W/"d48d9d8b9aa42be3c59a03030903498a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 06a27d66e25d02ebcfb014b9d194016b.cloudfront.net (CloudFront)
cache-control: max-age=2678400
x-amz-cf-pop: FRA60-P1
x-amz-cf-id: PR1LZry2JkXQUCdxlhTG1I3QWAQxF1Q9ylz9JQ_ueenCwe3MwKRvPQ==

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 0ABD 0
225 B 278ms
233ms XHR
application/json 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-100-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 0ABD 0
225 B 277ms
232ms XHR
application/json 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-100-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 0ABD 159 B
843 B 66ms
22ms XHR
application/json 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

9630a16d266d90940b051cbb3a5039d7b4152a083e5ee35bb118dc8b029038e5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 07 Sep 2021 02:44:34 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: ce2531eb-987a-4a55-9ee0-c784932b1d85
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 159
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 0ABD 0
122 B 82ms
52ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:34 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 4b15f677-33ad-4bd2-af5b-0871ab7b789b.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 38 KB
38 KB 17ms
16ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/4b15f677-33ad-4bd2-af5b-0871ab7b789b.jpg?crop=700:466,smart&width=700&height=466&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1db91f0d4dd14f85e44c90b3ff46d5f7d518414519acea69a0bc7a8d5c129b35

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
age: 7260
etag: "k5Bp9t8tmg7YaEo9gqbLMOIX5EtEKAOpGc1HuLgk/rk"
access-control-max-age: 86400
fastly-io-info: ifsz=217044 idim=1600x800 ifmt=jpeg ofsz=38560 odim=700x466 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 38560

GET
H/1.1 200
OK VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g= Show response
ads.adaptv.advertising.com/a/h/ Frame 0ABD 2 KB
1 KB 29ms
29ms XHR
text/xml 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1630982674210&gdpr=1&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-125-100-70.eu-central-1.compute.amazonaws.com

Software

adaptv/1.0 /

Resource Hash

b3ba1b75cc77411fb13950c0b2b99893caa79c0f17b9050318ba79dc2cb8e19e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
server: adaptv/1.0
content-type: text/xml
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 955
expires: 0

GET
H2 200 o2shim Show response
acds.prod.vidible.tv/ Frame 45DC 15 KB
7 KB 30ms
30ms Script
application/javascript 52.213.94.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=8d4a9939-9f04-4c1a-9ce9-c9bd2f756ce3&pblob=
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.94.69 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-94-69.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 1de73e99e7b085eb184f9a85596e90557fa311820a65aadf9a92a53e1b5fadc1

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
content-encoding: gzip
access-control-max-age: 3600
access-control-allow-methods: POST, GET, HEAD, PUT, PATCH, DELETE
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-headers
content-length: 6636

GET
H2 200 0.js Show response
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/ Frame 45DC 318 KB
102 KB 6ms
6ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e21ce3b8effc95ceeffb672439c7266023a9f4505d17292a9da44efeafd0e6ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 01 Sep 2021 06:43:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 504090
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-length: 104700
x-amz-id-2: 4lCUgDBZN82qQtVxRMYj7umB5v9DLXR72Ojs/wVa1fNH/obXN2rlI75VlgvG0iRpM9TY+ozBPLs=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 01 Sep 2021 05:30:30 GMT
server: ATS
etag: "d84d25280de45abd32c31cb97a2b8ef5-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-request-id: GT2XPJMFVQZWN0J5
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=1209600
x-amz-version-id: null
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 impression.gif
trk.vidible.tv/trk/ Frame 45DC 43 B
245 B 23ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.72&ifr=true&cb=0.2685264510338825&pt=o2unit&sid=717fcebf-2a6e-44fe-8e0e-99b298b49424&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:34 GMT

GET
H2 200 moatapi.js Show response
z.moatads.com/aolvidibleapi29384728347/ Frame 0ABD 133 KB
44 KB 26ms
25ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by: Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
content-encoding: gzip
last-modified: Tue, 25 Feb 2020 18:37:38 GMT
server: AmazonS3
x-amz-request-id: 844FF664DE0AB17A
etag: "d678022569896f7b7293494e3a69c8c7"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=45659
accept-ranges: bytes
content-length: 44266
x-amz-id-2: KrpVRZD3M0T4g9xUncS5g3siU6Z/qnTuCp2KYOKEtN/tCl8UaA8yn/9PP1OCFx0nXyimfljs5VQ=

GET
H/1.1 200
OK VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 45DC 249 B
0 233ms
232ms XHR
text/xml 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1630982674210&gdpr=1&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=394&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=700

Requested by

Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-125-100-70.eu-central-1.compute.amazonaws.com

Software

adaptv/1.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: text/javascript, application/json, text/html, application/xml, text/xml, */*
Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
server: adaptv/1.0
content-type: text/xml
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 192
expires: 0

GET
H2 200 display.gif
trk.vidible.tv/trk/ Frame 45DC 43 B
245 B 24ms
23ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=717fcebf-2a6e-44fe-8e0e-99b298b49424&vvuid=98d364bf-5c84-44ca-8876-b3be0c33681c&orgId=28949&plcid=1279691&vrid=8d4a9939-9f04-4c1a-9ce9-c9bd2f756ce3&ab=0&dt=39&h=394&spaceid=793604934&w=700&cb=0.5591717171314534
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:34 GMT

GET
H2 200 ad-request.gif
trk.vidible.tv/trk/ Frame 45DC 43 B
245 B 24ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=717fcebf-2a6e-44fe-8e0e-99b298b49424&vvuid=98d364bf-5c84-44ca-8876-b3be0c33681c&orgId=28949&plcid=1279691&vrid=8d4a9939-9f04-4c1a-9ce9-c9bd2f756ce3&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.7223178856588459
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:34 GMT

GET
H2 200 ad-engine-request.gif
trk.vidible.tv/trk/ Frame 45DC 43 B
245 B 23ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=717fcebf-2a6e-44fe-8e0e-99b298b49424&vvuid=98d364bf-5c84-44ca-8876-b3be0c33681c&orgId=28949&plcid=1279691&vrid=8d4a9939-9f04-4c1a-9ce9-c9bd2f756ce3&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=700&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=394&cb=0.7170979382346112
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:34 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:34 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 23ms
22ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1630982674762&de=705590710410&d=211%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 02:44:34 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 07 Sep 2021 02:44:34 GMT

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame 3DB3 0
305 B 328ms
109ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:35 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET ad-engine-response.gif
trk.vidible.tv/trk/ Frame 45DC 0
0

GET
H2 200 bc2 Show response
bc-ssb-dub.springserve.com/ Frame 0ABD 20 B
213 B 62ms
62ms XHR
application/json 3.248.127.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bc-ssb-dub.springserve.com/bc2?r=76bc1a81-5699-4167-a73c-1c3443153891-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=700
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.127.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-127-185.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:34 GMT
access-control-allow-credentials: true
server: nginx
content-length: 20
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json

POST
H2 200 i Show response
vid-io-dub.springserve.com/vd/ Frame 0ABD 0
122 B 33ms
33ms XHR
text/plain 52.31.202.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid-io-dub.springserve.com/vd/i?suuid=76bc1a81&ps_id=514171&batch=1
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.202.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-202-1.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:34 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame 3DB3 0
305 B 110ms
109ms XHR
multipart/form-data 18.116.179.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=128743
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.116.179.127 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-116-179-127.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 07 Sep 2021 02:44:37 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 514171 Show response
vid.springserve.com/vast/ Frame 3DB3 2 KB
2 KB 35ms
34ms XHR
application/xml 52.17.148.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.148.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-148-138.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 668429630f1c4a1dd28edb6ee76eb043d622fe50cb7885acb1fbe7a84d7d9e24

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:40 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-encoding: gzip
content-type: application/xml;charset=UTF-8

GET
H2 200 vpaid_44854a27.js Show response
vpaid.springserve.com/production/ Frame 9A1B 487 KB
87 KB 7ms
6ms Script
application/javascript 2600:9000:2240:2400:15:6f6c:b180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:2400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 11e41d859e2bb2f97068bbbffff15522b7852828e938a464164ffbad62cfa389

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 15:01:09 GMT
content-encoding: br
last-modified: Wed, 25 Aug 2021 15:00:31 GMT
server: AmazonS3
age: 1079012
etag: W/"d48d9d8b9aa42be3c59a03030903498a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 06a27d66e25d02ebcfb014b9d194016b.cloudfront.net (CloudFront)
cache-control: max-age=2678400
x-amz-cf-pop: FRA60-P1
x-amz-cf-id: -jDEI1uP1l9C6GS6n0EUxQxEGS_Tm-IcoR14tYXtRZV25HLKfuVf3Q==

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 9A1B 0
225 B 276ms
232ms XHR
application/json 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-100-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 9A1B 0
225 B 275ms
232ms XHR
application/json 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-100-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 9A1B 160 B
844 B 67ms
23ms XHR
application/json 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

8ce7ee9111c77532738873c32136e921068c99ca16f5d2d9c726d406e72f691b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 07 Sep 2021 02:44:40 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 613b4f33-9bd5-48d8-88b4-ff3ea1918658
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 160
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 9A1B 0
66 B 69ms
69ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Tue, 07 Sep 2021 02:44:39 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g= Show response
ads.adaptv.advertising.com/a/h/ Frame 9A1B 2 KB
1 KB 23ms
23ms XHR
text/xml 3.125.100.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1630982680209&gdpr=1&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_44854a27.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.125.100.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-125-100-70.eu-central-1.compute.amazonaws.com

Software

adaptv/1.0 /

Resource Hash

40341943e534f677d72a86c6764abddef8ba95ef57bafdb46a01f36bd6cf82ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
server: adaptv/1.0
content-type: text/xml
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 952
expires: 0

GET
H2 200 o2shim Show response
acds.prod.vidible.tv/ Frame 342E 15 KB
7 KB 30ms
30ms Script
application/javascript 52.213.94.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=dbe73519-3b7c-4ee8-a7c1-3e50c7c7c691&pblob=
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.94.69 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-94-69.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 31fc3e354462d8651f2fab25bb1753605cfebaa7eaf760c98f8deb401964f1c9

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:40 GMT
content-encoding: gzip
access-control-max-age: 3600
access-control-allow-methods: POST, GET, HEAD, PUT, PATCH, DELETE
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-headers
content-length: 6631

GET
H2 200 0.js Show response
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/ Frame 342E 318 KB
102 KB 6ms
6ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e21ce3b8effc95ceeffb672439c7266023a9f4505d17292a9da44efeafd0e6ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 01 Sep 2021 06:43:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 504096
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-length: 104700
x-amz-id-2: 4lCUgDBZN82qQtVxRMYj7umB5v9DLXR72Ojs/wVa1fNH/obXN2rlI75VlgvG0iRpM9TY+ozBPLs=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 01 Sep 2021 05:30:30 GMT
server: ATS
etag: "d84d25280de45abd32c31cb97a2b8ef5-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-request-id: GT2XPJMFVQZWN0J5
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=1209600
x-amz-version-id: null
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 impression.gif
trk.vidible.tv/trk/ Frame 342E 43 B
245 B 22ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.72&ifr=true&cb=0.7392066888592761&pt=o2unit&sid=96558713-eea0-4cb6-90e0-e104c1f3b7f3&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:40 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:40 GMT

GET
H2 200 moatapi.js Show response
z.moatads.com/aolvidibleapi29384728347/ Frame 9A1B 133 KB
44 KB 25ms
24ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by: Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.72/0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:40 GMT
content-encoding: gzip
last-modified: Tue, 25 Feb 2020 18:37:38 GMT
server: AmazonS3
x-amz-request-id: 844FF664DE0AB17A
etag: "d678022569896f7b7293494e3a69c8c7"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=45653
accept-ranges: bytes
content-length: 44266
x-amz-id-2: KrpVRZD3M0T4g9xUncS5g3siU6Z/qnTuCp2KYOKEtN/tCl8UaA8yn/9PP1OCFx0nXyimfljs5VQ=

GET VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 342E 0
0

GET
H2 200 display.gif
trk.vidible.tv/trk/ Frame 342E 43 B
245 B 24ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=96558713-eea0-4cb6-90e0-e104c1f3b7f3&vvuid=36468f2d-7442-4d1c-88aa-624e18bcee0b&orgId=28949&plcid=1279691&vrid=dbe73519-3b7c-4ee8-a7c1-3e50c7c7c691&ab=0&dt=38&h=394&spaceid=793604934&w=700&cb=0.721067464773171
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:40 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:40 GMT

GET
H2 200 ad-request.gif
trk.vidible.tv/trk/ Frame 342E 43 B
245 B 24ms
23ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=96558713-eea0-4cb6-90e0-e104c1f3b7f3&vvuid=36468f2d-7442-4d1c-88aa-624e18bcee0b&orgId=28949&plcid=1279691&vrid=dbe73519-3b7c-4ee8-a7c1-3e50c7c7c691&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.19705377287240222
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:40 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:40 GMT

GET
H2 200 ad-engine-request.gif
trk.vidible.tv/trk/ Frame 342E 43 B
245 B 23ms
22ms Image
image/gif 3.127.187.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=96558713-eea0-4cb6-90e0-e104c1f3b7f3&vvuid=36468f2d-7442-4d1c-88aa-624e18bcee0b&orgId=28949&plcid=1279691&vrid=dbe73519-3b7c-4ee8-a7c1-3e50c7c7c691&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=700&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=394&cb=0.5610015417777585
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.187.49 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-187-49.eu-central-1.compute.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:40 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.21.0
content-type: image/gif
content-length: 43
expires: Tue, 07 Sep 2021 02:44:40 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 23ms
22ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1630982680749&de=459025138208&d=19%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Sep 2021 02:44:40 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 07 Sep 2021 02:44:40 GMT

GET
H2 200 4d02bca0-10be-4986-8490-2e69e5ae9af2.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 35 KB
35 KB 22ms
22ms Image
image/jpeg 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/4d02bca0-10be-4986-8490-2e69e5ae9af2.jpg?crop=700:466,smart&width=700&height=466&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 9ae6e67e687bec935f997005e7f789a95ee7b644069290e54250db1215f0700c

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 02:44:40 GMT
age: 7267
etag: "YxHJzBkcLz0/mNEYm3FvQp8dsns1A7Zus7kYEjyrbWI"
access-control-max-age: 86400
fastly-io-info: ifsz=182823 idim=1600x900 ifmt=jpeg ofsz=35648 odim=700x466 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 35648

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: hbopenbid.pubmatic.com
URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client

Domain: trk.vidible.tv
URL: https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=2a7a68eb-f9e1-4713-9693-11da61369c78&vvuid=889c4fce-23c0-4258-98a2-0d1227ff1234&orgId=28949&plcid=1279691&vrid=c81dcb78-3b62-45a5-9af8-bd729949261f&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=700&aert=487&ar=no&fo=0&ft=0&h=394&cb=0.6195639484554325

Domain: trk.vidible.tv
URL: https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.72&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&s=true&sid=717fcebf-2a6e-44fe-8e0e-99b298b49424&vvuid=98d364bf-5c84-44ca-8876-b3be0c33681c&orgId=28949&plcid=1279691&vrid=8d4a9939-9f04-4c1a-9ce9-c9bd2f756ce3&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=700&aert=240&ar=no&fo=0&ft=0&h=394&cb=0.6891650851311002

Domain: ads.adaptv.advertising.com
URL: https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1630982680209&gdpr=1&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F577460%2Fcwindowssystem32userinitexe-malware-infection%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=394&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=700

Verdicts & Comments Add Verdict or Comment

167 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-20 01:26:33	Name: NID Value: 223=dbh55RrZg_7wnBdFlEVEeY1KYs9FaYIk-SwrTUlEdK79RyGaWAjJUqeCk1gyc72bAJHUvu6hE_sf6WccKENvkMvmOs57C86PHhYwk6Bct3lnZDGn6E3j2vsgHHMq5Nzbyv9VKmfM0-TAhWVrFQaRrc0XmiHsmsNcAaHp6bN9kXE
www.bleepingcomputer.com/	1969-12-31 23:59:59	Name: fsbotchecked Value: true
.bleepingcomputer.com/	1970-01-19 21:04:29	Name: _gid Value: GA1.2.544709254.1630982667
.bleepingcomputer.com/forums/t/577460/cwindowssystem32userinitexe-malware-infection	1969-12-31 23:59:59	Name: _dlt Value: 1
.bleepingcomputer.com/	1969-12-31 23:59:59	Name: session_id Value: 8911b82853637c0eea585be5089919c6
.bleepingcomputer.com/	1970-01-19 21:03:02	Name: _gat_gtag_UA_91740_1 Value: 1
.bleepingcomputer.com/	1970-01-20 14:34:14	Name: _ga Value: GA1.2.1587472098.1630982667

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js?referer=www.bleepingcomputer.com(Line 1) Message: TypeError: Cannot read property 'getItem' of null
console-api	warning	(Line 8) Message: ---CnxCustomApiError---
console-api	warning	(Line 9) Message: Cannot read property 'setAttribute' of undefined

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.pub.network
accounts.google.com
acds.prod.vidible.tv
ad.doubleclick.net
ads.adaptv.advertising.com
apis.google.com
bc-ssb-dub.springserve.com
capi.connatix.com
cd.connatix.com
cdn-ssl.vidible.tv
cds.connatix.com
connect.facebook.net
d.pub.network
ecdn.analysis.fi
hbopenbid.pubmatic.com
i1106.photobucket.com
ib.adnxs.com
id-ransomware.malwarehunterteam.com
imasdk.googleapis.com
img.connatix.com
ls.skimresources.com
p.skimresources.com
pagead2.googlesyndication.com
px.moatads.com
quantcast.mgr.consensu.org
r.skimresources.com
rules.quantcount.com
s.skimresources.com
s0.2mdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
ssl.gstatic.com
static.cloudflareinsights.com
t.skimresources.com
trk.vidible.tv
vid-io-dub.springserve.com
vid.connatix.com
vid.springserve.com
vpaid.springserve.com
widgets.outbrain.com
www.bleepingcomputer.com
www.bleepstatic.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.imgdumper.nl
z.moatads.com
ads.adaptv.advertising.com
hbopenbid.pubmatic.com
trk.vidible.tv
104.20.59.209
104.26.13.6
13.226.155.6
13.226.155.62
142.250.185.134
142.250.186.162
151.101.14.137
151.101.194.137
151.139.128.11
18.116.179.127
185.208.56.78
185.64.189.112
2.18.234.190
2.18.235.40
216.58.212.134
2600:9000:223c:c600:6:44e3:f8c0:93a1
2600:9000:2240:2400:15:6f6c:b180:93a1
2600:9000:2240:8400:9:46dc:4700:93a1
2606:4700:20::681a:8b
2606:4700:3036::ac43:dbb1
2606:4700::6810:5e41
2620:116:800d:21:51e4:db4b:4436:b305
2a00:1288:80:800::7001
2a00:1450:4001:801::2002
2a00:1450:4001:803::2003
2a00:1450:4001:809::200e
2a00:1450:4001:80f::2004
2a00:1450:4001:80f::2008
2a00:1450:4001:827::200d
2a00:1450:4001:829::200e
2a00:1450:4001:82a::200a
2a00:1450:4001:82a::200e
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.125.100.70
3.127.187.49
3.248.127.185
34.120.117.212
35.190.59.101
35.190.91.160
35.201.67.47
35.201.71.192
37.252.173.22
52.17.148.138
52.213.94.69
52.31.202.1
04228922aa3c9bed556396d0a7a8f6bc276d43e559224a2fa239f91a6b1b3f27
09c9f96143372ee7e9fee4a67f16feec1d7d251f7739e9c77f13365fd0938484
0e2a136c594c939d55752e9abb70e6cc550b10bc3bc350c0d46d23d5947c20d1
0f19e06c2db26fc72935e540fc02c48f134dbd95204fab03e8851d39d9563fd6
0f1e90548e911e24dedcb2ca0ffee6847a49a8648e9c615bcd0582bb7c7993fd
0f39834f6bd6f36f1a3c67dfd46bc4703cc68d8b51ed762d59adba905c8ad68c
11e41d859e2bb2f97068bbbffff15522b7852828e938a464164ffbad62cfa389
14dcce7abfc690cecd57a737a8af6fd712c2b7fec668b772d9f014f6ded77ef8
1571598a402216883c338a690388b870c86744e985f90a8279a172a997d3b32a
19aeea2ab3b43dad66b79346d9afa7260c7af56c60e113678c02327bdd58fa7b
1db91f0d4dd14f85e44c90b3ff46d5f7d518414519acea69a0bc7a8d5c129b35
1de73e99e7b085eb184f9a85596e90557fa311820a65aadf9a92a53e1b5fadc1
263b5c14ea0c8dba145eaa30a0e60b7f9e0d3cb3c8f2356f59832ff329fa6d38
28d4e8c1043164607dcdeb358e2a08c9565fe286ceeeabea79e67f8c680187e7
2a10fb2699752353ba3f55bdb022589d690843ebbbf9f3b80789f2a57010475e
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2eed3708d3a8341d71f3803697daae254a81642d3608f0337c3f6d4055408231
2f465f3d54e5441bfe4abf98795685d4a60f59f5f8936c69a138e58881e6e398
31b8526e4ac283f51ecf9672eecfbe5289bf01725928c709bed02552aadd9ba4
31fc3e354462d8651f2fab25bb1753605cfebaa7eaf760c98f8deb401964f1c9
34e7b4331fd65afce4e2f321359d3e5ca0effe3e706f71227cbf351961ed67aa
386f87a6e6fcb89c6b046f988d18def949d1cc1f6a9fa4177858aa11da7a5bda
3a650c0ffb1c523bcc0971339fce1041e1c869a41b7ef19111660bab971474f4
3e3b8f6c06d2d74cc294ee6439e67b08890587be0081249a158469ace2eaeaaf
3e6274abac1820c8bd99f826cf35a60aeaa56b962500486acc5665f98005031e
3e89beb7d66ef7d5e58dfcefd22a51e1a8ae452a49bc20d020418cf2b6c666d0
4020cab5a5ec3771392556793f6bdd0a66180a40574b41648bb2f375fa59f326
40341943e534f677d72a86c6764abddef8ba95ef57bafdb46a01f36bd6cf82ac
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
452c33e4d53d6f0b5f6167b15f5d86782785e30a1848fea3b37adb16b0b97e27
453d30f69cc2a6f3013254a0faed039d49cf9c5b004d5482fb5365e99702c149
4b9f912b0e7a50c12745f52ec2848dce5b779369999c6d35e6c297c713ce53d3
4dc57a7292b337c56c89be595bb3b0f3077767327408937222e7fa85fd870e71
5028e223096a25034d4d95863f89374a4b205e86354c5e4461e00272e7fab4d9
50ec0dfe51bd77eee427ce38cc90ef3564afea1a2e1148dc788c2d89b7fa4fb9
51f20d95dad9ea1473e4f877b5f7a7d8bcd589f1f989b8875ffddd83ae716a21
5259445f9adc786a154b71a542eb2b859a15c55bf38419e23ba260ecb5cf5c87
5491c42f405dfd058fbfe927c745cd1ee50e1181109213236ee2707fa39ddcd5
54d1b6192a24d00e55b3b717a7fda9150b094b0ba2eb3ce3617fdcadc06fca13
58213c748dfdfc0148f2466969e3a96243974aa6fe7da0c974b2ef44086659fa
59e6b6895ab9c1fab302d73906ec3259ac826ffc4a3ae743412bf8a096a33054
60748fdd53c96d1eca2671628730f0a745d86d8223bc86f1d77d9b691920d8f9
61da0a4638505960ec52709b7df80d92683c56e13042079daf5f082fc9548d5e
63e2dfceaeeb7e8b933fa7fe96048fac66ad3fab6ab270b8e4a28ce02c1b73ab
64d1271d34ff55ddb5cf77e5e5919717cb347467ed02e17d40256131571a7618
668429630f1c4a1dd28edb6ee76eb043d622fe50cb7885acb1fbe7a84d7d9e24
6a6f0fdd079cd2bb0fa098f60d11b5823666a6b78e1c79bdb3302e4dd1325dba
6aeb9f7542993c71c548ac254766824ef86c68f0d6fa13f293bd016b9cfc9dc6
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ba74b0b7223564fe5de95a05498160da36162274673a6c4583a757d233c41b1
704a2ad9d19d0ce31dfe0757fe3e2ebd07aac0316a42f9b68cc891681edb57a5
72f891878adaafb271ac1f5c2a1a93bb37476e736c5159a95a12008a4a412040
73d05df4efdb6570ecdcf792d681264fc471103f9c73640b57d2b930ad206a1e
758339428b72b6389dedb869502ed75424bbeb09fc09578bea044112bd8093fa
770cb6f8747e90dad261e049dfa5cf42e622dac61bcbc86ecb0a8c134228eb91
786dbb4402793fadd0112db771392a0509ffcb2806545e94a879af9c6d87415f
7baadf42bdd7151de787de3b98f1c65f55cc2b3d34d4fbe90a0e490756dd3a1b
7e58ef84b3994aa5d6238df46b20e480c270cdd6094a41166583f7491665152a
85a2c5bd701224851deca6029998517a35d091922217a90241fd0c7f244e8f11
8aecac344ea130923fe6511a82e9243abbfee44798b89d3d83fc418f2118dee9
8b9f51f2037ca9ed1ea10090900f4aca13effed80704a7974fabe690de030a62
8bbf593c2b5fc72db726a4144fc70682afcbca754dcf5d4b6479ef6a7cfc9bba
8be49f44baab6e5003972c8bc33123dd34257840a77a1d20b7365ae8b60a896c
8ce7ee9111c77532738873c32136e921068c99ca16f5d2d9c726d406e72f691b
8f7ad438c88cd0653af6066d4c148e00824961112a865f9611e258b9f3cc0981
9019adc6ec44d2cd4f38c97b8319b0ae8da8f03b3bd646d4f86707f23f8935a0
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046
9267b2d58a99487c128272a30336d413058b6b903c425bc35a7173d0208c6cc8
92c171ba5806e8e3bd6d4cec2267a87aace951654b0ba5877a45633e593c5642
9320021507b35e189d2190eea673cbc21f7d368f6ecbfb5dc89d773a28cd015d
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb
95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810
9630a16d266d90940b051cbb3a5039d7b4152a083e5ee35bb118dc8b029038e5
9a876f6cbd09c5f245491f6877db2a6bb7faa356893ae8a5f8881b2ad6c64212
9ae6e67e687bec935f997005e7f789a95ee7b644069290e54250db1215f0700c
9e5a1148e6ba00dec0218671857bc04820e1a4628a6de00a659ece715a6ed2f6
9faebe5bdb9528f36d1ec5713865681bf10c7c0d1fa1b8224fc57982f45ed788
a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e
a28119ca11bc23f972f8e463761547044174823430b09a0f1fbfed91acbeb35d
a51f645170637f10f3eba218020318af3fff3ad8e7087db87ef607896f19a940
a5ad4fb0d40625889969083053d32ab1191e66c11bb4aebfde2643954c0f5673
a65e5020ce315d2f7816cad4b2059deeb814bbbce176f8f398a84c4123dec57e
a72002fa5652e79e7ec42b33393ea9483c3341904c95a99b8a53773c5e60e14e
abe9d30276e3d66a71219ad2b0ed5a9663020a5c534557dd0f5c8ba71da4ebd4
ac15d1868a55adcea61641c78efbb86feda3a65882f21bfe9fedd7348fb54be8
b2487b91b81877d82ce166be25f03c9c5b55dbbf6912385c5c72a1fac44d664f
b3ba1b75cc77411fb13950c0b2b99893caa79c0f17b9050318ba79dc2cb8e19e
b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad
b937537ed7f13e70dc6a69b6e9b308237cd369e11fa2a2b97a24d97d8487673e
bceb42c38849f45f8eccea1ad752b5ccea22eba051598d3890607f03941e301e
bd8f238e6dd7bff40308c1c74dbbfc49519ef519e92b0601b84ce924715a7c02
bf50c94253085740a5cce42e9c14f7b897cfc384303b38a5d9d7a0ab8ea5160f
bf81ee519d1f6a17da950869290048f4215fc035c16a452265a1a1ee8e831b40
bfd753d445592a633d4e3b8f74fe6e4ca85ab95a1f0b2fc00f11afeaaeed8194
c2a0ed3ea5aebdf80781e96b0e677656f9db72ea592b679299953852fef84b02
c4efeeb957e361500bf19ba26282beae1a8e4083c5ccff10dccab2eaa09acd45
c7451690fed2a104bf6ff86e5ab0b3a7d8393d26a859a4bad6ba81b1d7aa339d
cbd8236978dd3f165bc49566f78c460e3937e552df38787439c1ef2797c4c709
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d11e31e4a1d2b7528c066ca3c849a95e53a53538440a5d72c18bf9f9ee84ce9e
d1731db9016f326daff11d0045c86fd068ec9e72cc4c6ec56a7c856a3a3d28c7
d1832b7da0292ab076dfe046f8b1c2d5fcfd1bfb5628b7e21a3754a20308aa57
d813e6becda7ebe8b6bf1a54e7b83aa2a2551dc41bf4f07877834984a293958e
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dac3d8106bc18a8979ba62abdd19a101db31fd35edb01de85dfb7fb59c614db5
db311c11353d5628e6e28d260bca9b8935b23440964d7c6bc4914edcda08472a
dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
df886e0040b483c2c6a65c0ddad13a25429887d96c6eea1d1f8fed9fedad781e
e0c74f6aab5901021af0606bff71c8766ac4595a1f4c4d1cb62307b026ff157f
e21ce3b8effc95ceeffb672439c7266023a9f4505d17292a9da44efeafd0e6ac
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebbdc09f56e8b9cba9117f0d84b4903fdc89508496a9b5d5b8d6bf59ff13ebbf
efc6361ebe5a559578c83bf197d5407b7f6bf44f74d35c4ee8eb22c810fb34a7
f2af80df6898ffc30153f1e77ae8691fc1e55ac7d5bce64b9124ed2b91fdadc2
f33585b10bb5487bd6c92f53018de62cb147ab48b829334b7f97437015aae557
f34544ddb27241b3eccb8e06d7447230005e8718b463a30d9dd83d1e8bada1a1
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

www.bleepingcomputer.com Open in urlscan Pro 104.20.59.209 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

176 Requests

98 %HTTPS

41 %IPv6

30 Domains

48 Subdomains

47 IPs

6 Countries

2808 kBTransfer

9201 kBSize

7 Cookies

24 Outgoing links

Redirected requests

176 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bleepingcomputer.com Open in urlscan Pro
104.20.59.209 Public Scan

Screenshot
Live screenshot

Full Image

176
Requests

98 %
HTTPS

41 %
IPv6

30
Domains

48
Subdomains

47
IPs

6
Countries

2808 kB
Transfer

9201 kB
Size

7
Cookies

176 HTTP transactions
0 data transactions