redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

20 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=redcanary.com&pId=6740065282079634641

Request Chain 97

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731962738581&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731962738581&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tm=gtmv2&e_ipv6=AQJdwTY_ypAa5gAAAZNBBhhRKegvSZ22mDlFk0YAFv7RV3B47SGVUJe_mN6UmqLBxTePYBA

134 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response redcanary.com/threat-detection-report/techniques/rundll32/	334 KB 60 KB	3916ms 447ms	Document text/html	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash a5e4c4c5a469b9ce2b8c6e3094f540882fcdd4a8a49fe58c62163c8713725fe3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers cache-control max-age=600, must-revalidate content-encoding br content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Mon, 18 Nov 2024 20:45:36 GMT feature-policy microphone 'none'; geolocation 'none' link <https://redcanary.com/?p=36138>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security "max-age=63072000; includeSubDomains; preload"; vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding x-cache HIT: 1 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options deny x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	22 KB 8 KB	140ms 53ms	Script application/javascript	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 Vo/d0f3ZefkwyML/PnJnjg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DD04E9B806368E x-ms-lease-status unlocked cf-cache-status HIT age 61245 x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:36 GMT content-type application/javascript last-modified Thu, 14 Nov 2024 20:20:01 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id ea6aeb6f-401e-00e5-1231-37817d000000 cf-ray 8e4ace2168c53a4a-FRA accept-ranges bytes access-control-allow-origin * content-length 7212 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.7.1/	85 KB 30 KB	123ms 39ms	Script text/javascript	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip age 232003 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Sun, 16 Nov 2025 04:18:53 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sat, 16 Nov 2024 04:18:53 GMT last-modified Tue, 12 Sep 2023 02:38:22 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 30462 x-xss-protection 0 server sffe
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	199 KB 67 KB	485ms 54ms	Script application/x-javascript	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=14400 content-encoding gzip cf-cache-status HIT etag "2d803a3-31b73-6265f6525d19f" age 4118 x-content-type-options nosniff cf-ray 8e4ace238f92e511-TXL expires Tue, 19 Nov 2024 00:45:37 GMT date Mon, 18 Nov 2024 20:45:37 GMT content-type application/x-javascript last-modified Fri, 08 Nov 2024 04:43:40 GMT vary Accept-Encoding server cloudflare
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	67 KB 25 KB	203ms 37ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash be3efb305c8998b5773f331a735243d5112df20d1e6a90d859ee3b65dc77bbc7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control max-age=86400 content-encoding gzip etag "961cde537134db1:0" age 84606 accept-ranges bytes x-cache HIT content-length 25392 date Mon, 18 Nov 2024 20:45:37 GMT content-type application/x-javascript last-modified Mon, 11 Nov 2024 19:38:48 GMT server ECS (frb/67D4) vary Accept-Encoding
GET H2	200	js Show response www.googletagmanager.com/gtag/	446 KB 137 KB	198ms 113ms	Script application/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash c22658672e7cd5d093f34ea4a8d66530c5082fae0efb25389e4c2f41947d091f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Mon, 18 Nov 2024 20:45:37 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 140248 x-xss-protection 0 server Google Tag Manager
GET H2	200	qualified.js Show response js.qualified.com/	1 MB 245 KB	169ms 60ms	Script text/javascript	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44baa21ce9a58ec4912289526b121545065853d4f939b6b62c048144a9af52da Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-request-id ddfc87e8-b5c2-4cc3-8cf9-0efc749aaba1 content-encoding gzip cf-cache-status HIT etag W/"47e9bf9aca26d34886c08b670b895489" age 40221 x-permitted-cross-domain-policies none x-content-type-options nosniff x-cache miss date Mon, 18 Nov 2024 20:45:37 GMT content-type text/javascript; charset=utf-8 vary Accept,Accept-Encoding x-runtime 0.047343 x-frame-options SAMEORIGIN strict-transport-security max-age=63072000; includeSubDomains cache-control max-age=60, public, stale-while-revalidate=60, stale-if-error=300, s-maxage=86400 x-envoy-upstream-service-time 73 referrer-policy strict-origin-when-cross-origin x-download-options noopen cf-ray 8e4ace24fca0630a-HAM x-xss-protection 1; mode=block server cloudflare
GET H3	200	jquery.matchHeight-min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/	3 KB 2 KB	96ms 51ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/jquery.matchHeight-min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5eb03ec3-d34" age 951603 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j3t%2BdABi506fd4qY29zNFn5A6uIpznKPRvU5F%2BdJhb%2BZEHb5g5GjEaOlWmIdnPe89QJktiOSMrlBVaRVji7W%2BwrzgwvBdYP2pNZm9lwPLi4ZhFxA8Pd4uKdPUvfA8I%2FQ%2FlgoklWe"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sat, 08 Nov 2025 20:45:36 GMT alt-svc h3=":443"; ma=86400 date Mon, 18 Nov 2024 20:45:36 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 04 May 2020 16:11:47 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4ace212d1ed3b0-FRA accept-ranges bytes access-control-allow-origin * content-length 1221 server cloudflare
GET H3	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/	130 KB 33 KB	51ms 50ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "60215473-20801" age 444599 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W0cLidAi8%2BI%2F1l2K3aC7pnhKBdqFAmhbAIloG%2Fx8UYgqpLO72h4nVInsC3tNZk1lzXY8pyQ4W5U8reL4%2BNTdviORiReuxAXVYyg5VArxHsrnMTe5BDZNiQHDkfxvmCkjtOue4v2t"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sat, 08 Nov 2025 20:45:36 GMT alt-svc h3=":443"; ma=86400 date Mon, 18 Nov 2024 20:45:36 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 08 Feb 2021 15:10:43 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4ace21ba058c4f-FRA accept-ranges bytes access-control-allow-origin * content-length 33250 server cloudflare
GET H/1.1	200 OK	teknkl-formsplus-1.0.5.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/250687/	41 KB 41 KB	663ms 228ms	Script application/x-js	52.218.188.16 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.218.188.16 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Cache-Control public ETag "bab0c2b3523f8244564b675fe34db610" x-amz-version-id OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO x-amz-request-id 8E9WTC2N78MRVBB9 Accept-Ranges bytes Content-Length 41617 Date Mon, 18 Nov 2024 20:45:38 GMT Last-Modified Thu, 26 Apr 2018 08:20:46 GMT Content-Type application/x-js Server AmazonS3 x-amz-id-2 mo1QR6WyR7+bcePh5TbKSB5GbjDlS0k/lS0oOKRE90nEw4UR9QlGSnJylJGx0evCzFzdk62NOME=
GET H2	200	autoptimize_7b38ca29273224c4ecb2a43fdd286ea7.js Show response redcanary.com/wp-content/cache/autoptimize/js/	262 KB 76 KB	157ms 155ms	Script application/javascript	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b38ca29273224c4ecb2a43fdd286ea7.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 18b368af8e8679b39c6fbbdde36542f3fc345bc9230a35cd1bd06595c1e73608 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"672bc673-4165d" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 06 Nov 2024 19:41:39 GMT
GET H2	200	40393661-0639-4e13-9774-ba9e2ae459fa.json Show response cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/	5 KB 2 KB	172ms 93ms	XHR application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/40393661-0639-4e13-9774-ba9e2ae459fa.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e7669e92e0d052b6940b1c108fe488fc344e33e92615ee396c98573ea7e94c8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 Of+LW11tRgwbWqX5gaZ5fw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DCF76BB61C7510 x-ms-lease-status unlocked x-ms-version 2009-09-19 x-content-type-options nosniff expires Tue, 19 Nov 2024 20:45:37 GMT date Mon, 18 Nov 2024 20:45:37 GMT content-type application/json last-modified Mon, 28 Oct 2024 16:15:16 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id a3f6edea-001e-00c0-2e54-2919ce000000 cf-ray 8e4ace224f355c4a-FRA accept-ranges bytes access-control-allow-origin * content-length 1782 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	59 B 304 B	170ms 79ms	XHR application/json	2606:4700:4400::ac40:9b77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 accept application/json Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip access-control-allow-methods GET, OPTIONS cf-ray 8e4ace2379d5d348-FRA access-control-allow-origin * date Mon, 18 Nov 2024 20:45:37 GMT content-type application/json vary Accept-Encoding server cloudflare access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202409.2.0/	461 KB 112 KB	53ms 52ms	Script application/javascript	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d9c9ad349c47e81a545ff3e3bdb0a8df5ebe959da9b52cadd9440d92f7ef359 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 uGd5VTJp/PFmoOURmUW/IQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCF719E1819D6B x-ms-lease-status unlocked cf-cache-status HIT age 58911 x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript last-modified Mon, 28 Oct 2024 06:29:30 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id ec98eb99-d01e-00e0-4b63-297502000000 cf-ray 8e4ace244bb13a4a-FRA accept-ranges bytes access-control-allow-origin * content-length 114311 x-ms-blob-type BlockBlob server cloudflare
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	296ms 48ms	Script application/x-javascript	104.102.43.106 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-43-106.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Content-Encoding gzip ETag "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595" Connection keep-alive Accept-Ranges bytes Content-Length 741 P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Date Mon, 18 Nov 2024 20:45:37 GMT Content-Type application/x-javascript Last-Modified Wed, 13 Nov 2024 02:44:39 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	gtm.js Show response www.googletagmanager.com/	393 KB 125 KB	154ms 69ms	Script application/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b28125f79b35b17d6a82d549aaa73ceacebd1a586ae326a29262e536d5d05ba5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Mon, 18 Nov 2024 20:45:37 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 126779 x-xss-protection 0 server Google Tag Manager
GET H2	200	css fonts.googleapis.com/	8 KB 1 KB	132ms 47ms	Stylesheet text/css	2a00:1450:4001:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:37 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:37 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Mon, 18 Nov 2024 20:45:37 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	29 KB 9 KB	137ms 49ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=906194&u=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&vn=2.1&x=true Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 2c89d46b51095ad33c5502f2b8613dfde4641ccabaf361f6d7e4245c6fedb705 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=0, no-cache, must-revalidate timing-allow-origin * content-encoding gzip access-control-allow-credentials true via 1.1 google access-control-allow-origin https://redcanary.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding server gfra1
GET H2	200	autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css redcanary.com/wp-content/cache/autoptimize/css/	5 MB 250 KB	304ms 303ms	Stylesheet text/css	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6438b16f2375488bf0208a69b27fe17b3119b1772be376966663f9014b7e14e6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"672bc674-53ed07" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:37 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 06 Nov 2024 19:41:40 GMT
GET H2	200	5354.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	2 KB 2 KB	335ms 251ms	Script text/javascript	2606:4700::6812:1fb0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/threat-detection-report/techniques/rundll32/&e= Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1fb0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85f6ebd8a5af20a15d76998652408574ba61287a298136959dd359606d889888 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br x-permitted-cross-domain-policies none x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:37 GMT content-type text/javascript;charset=UTF-8 content-disposition inline vary Origin, Accept-Encoding x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-dns-prefetch-control off cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin referrer-policy no-referrer x-download-options noopen cf-ray 8e4ace24dc714daf-FRA access-control-allow-origin * x-xss-protection 0 origin-agent-cluster ?1 server cloudflare
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	6hTcuIQa0sxrrByu9wTD7s open.spotify.com/embed/track/ Frame E701	0 0	253ms 142ms	Document text/html	2a04:4e42:400::810 FASTLY
General Check archive.org Show headers Download Go to Full URL https://open.spotify.com/embed/track/6hTcuIQa0sxrrByu9wTD7s?utm_source=generator Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::810 , United States, ASN54113 (FASTLY, US), Reverse DNS Software envoy / Next.js Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ranges bytes cache-control private, no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-type text/html; charset=utf-8 critical-origin-trial Tpcd date Mon, 18 Nov 2024 20:45:37 GMT etag "k54xdywlh86cu" origin-trial AjTBCzHiqtNU3PxD6GL8VpVl68/SfxkZJuLQbbyvSNj6/o9VuhZ5EPb/2dTYqi+Mot0AD6XOHBeIatAwEt4lAQcAAABOeyJvcmlnaW4iOiJodHRwczovL29wZW4uc3BvdGlmeS5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTl9 server envoy strict-transport-security max-age=31536000 vary Accept-Encoding via HTTP/1.1 fringe, HTTP/2 edgeproxy, 1.1 google, 1.1 varnish, 1.1 varnish x-cache MISS, MISS x-cache-hits 0, 0 x-content-type-options nosniff x-envoy-upstream-service-time 49 x-middleware-set-cookie sp_t=cc29c50e2781a54575b8a8d1d43fe3db; Path=/; Expires=Tue, 18 Nov 2025 20:45:37 GMT; Max-Age=31536000; Domain=.spotify.com; Secure; SameSite=none,sp_landing=https%3A%2F%2Fredcanary.com%2F%3Fsp_cid%3Dcc29c50e2781a54575b8a8d1d43fe3db%26device%3Ddesktop; Path=/; Expires=Tue, 19 Nov 2024 20:45:37 GMT; Max-Age=86400; Domain=.spotify.com; Secure; HttpOnly; SameSite=none x-powered-by Next.js x-served-by cache-cph2320032-CPH, cache-cph2320032-CPH x-timer S1731962737.449924,VS0,VE105
GET H3	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 855 B	49ms 48ms	Stylesheet text/css	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "60215473-2fb" age 347762 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2Faw3k3p18spgIx%2BzuStRuONCocwnC5IQGEKRyV9Exoun2e0ExCRdeJnJ5LrkGSZdOspNp9IBM%2FxjUvzFPA02ElQIXbQ4nsipClHId2nCfPbmnHzBC8K2M7PnHfzys0N6Ve4rEUo"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sat, 08 Nov 2025 20:45:37 GMT alt-svc h3=":443"; ma=86400 date Mon, 18 Nov 2024 20:45:37 GMT content-type text/css; charset=utf-8 last-modified Mon, 08 Feb 2021 15:10:43 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4ace246d928c4f-FRA accept-ranges bytes access-control-allow-origin * content-length 271 server cloudflare
GET DATA	200 OK	truncated /	65 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	bullet-square.svg redcanary.com/wp-content/themes/redcanary/assets/img/	443 B 616 B	285ms 284ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"6123d0cf-1bb" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:37 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Mon, 23 Aug 2021 16:46:07 GMT
GET H2	200	CanarySans-Text-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	269ms 268ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 2920a21f3d5f1c34cc38823f2c4422d1a0d23cba63233e5e8c382852aa7ada7c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06305-5acc" accept-ranges bytes access-control-allow-origin * content-length 23244 date Mon, 18 Nov 2024 20:45:37 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:25 GMT server nginx vary Accept-Encoding
GET DATA	200 OK	truncated /	67 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6e0408f7fbaf5216b577287b7654be1388d933b9b41dbd95dc733d5b5020f67a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	en.json Show response cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/019243fc-61e4-7b56-a219-15caf79db780/	85 KB 16 KB	62ms 61ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/019243fc-61e4-7b56-a219-15caf79db780/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d63a700995ae394d95bff31531a3492a2392adcf2733dd5df74016b64a689394 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 9Xv1ejeZ+95nBH1dFm+7FA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DCF76BB8992A0A age 399 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Tue, 19 Nov 2024 20:45:37 GMT date Mon, 18 Nov 2024 20:45:37 GMT content-type application/json last-modified Mon, 28 Oct 2024 16:15:21 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 61b2b900-901e-00ce-5554-29f5c5000000 cf-ray 8e4ace24f9375c4a-FRA accept-ranges bytes access-control-allow-origin * content-length 16231 x-ms-blob-type BlockBlob server cloudflare
GET H3	200	worker-099913a84ceb27d206f0a53d1546a6f5br.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	264 KB 64 KB	83ms 42ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-099913a84ceb27d206f0a53d1546a6f5br.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash b474f45de8cb58c109ac4f0317e9844a524e857dda61dce742b8f535964572cd Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=Oo/Pfg==, md5=qMs2DlAj53V2APbzkbTVMw== etag "a8cb360e5023e7757600f6f391b4d533" age 41079 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 65225 date Mon, 18 Nov 2024 09:20:58 GMT last-modified Mon, 18 Nov 2024 08:09:27 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC5ixKoL-M3kLgviU3G2mgL4UGWdkTHMa6-0OMK030e2Jn6yhTLxoNG5raFYp-jbeHlEaibEHvcJeA cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731917367486486 content-length 65225 content-language en server UploadServer
GET H3	200	va_gq-01ab96ecc7852b4725bb68afe149c7dfbr.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	276 KB 71 KB	78ms 38ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-01ab96ecc7852b4725bb68afe149c7dfbr.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 4dc938ac1478b3c05be5e7ce8a59481f532743dbaf1641cca4445786f28c500b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=yxmZrQ==, md5=A06VLJiKmqk1uDWpPm/E+w== etag "034e952c988a9aa935b835a93e6fc4fb" age 41085 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 73122 date Mon, 18 Nov 2024 09:20:52 GMT last-modified Mon, 18 Nov 2024 08:09:54 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC4mYnsavRS8Nyyiwge6lxfiMu-cFqFi-jQB1nuh3nATQsT54QfICI3W2OReJg6rG6-U7843YgYJ9Q cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731917394426091 content-length 73122 content-language en server UploadServer
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 146 B	146ms 144ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=906194&d=redcanary.com&u=DB26F55ADFBDC1D80B1B7E5BF96AF8AD8&h=851d7d1eea09877635679f204aed260b&t=false Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv02c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=43200 x-content-type-options nosniff via 1.1 google access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Mon, 18 Nov 2024 20:45:36 GMT content-type image/gif server gnv02c
GET H3	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 fonts.gstatic.com/s/sourcesanspro/v22/	15 KB 15 KB	114ms 63ms	Font font/woff2	142.250.185.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f3.1e100.net Software sffe / Resource Hash 7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://fonts.googleapis.com/ Response headers age 309497 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Sat, 15 Nov 2025 06:47:20 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 15 Nov 2024 06:47:20 GMT last-modified Thu, 01 Jun 2023 22:52:56 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 14892 x-xss-protection 0 server sffe
GET H3	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v22/	14 KB 14 KB	112ms 62ms	Font font/woff2	142.250.185.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f3.1e100.net Software sffe / Resource Hash c3de27b2cbd6deda629c9b442700cf54c0dda74e494b1c75a57d822068a047f8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://fonts.googleapis.com/ Response headers age 451507 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Thu, 13 Nov 2025 15:20:30 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 13 Nov 2024 15:20:30 GMT last-modified Thu, 01 Jun 2023 22:52:58 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 14780 x-xss-protection 0 server sffe
GET H3	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v22/	14 KB 14 KB	115ms 65ms	Font font/woff2	142.250.185.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f3.1e100.net Software sffe / Resource Hash 0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://fonts.googleapis.com/ Response headers age 369757 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Fri, 14 Nov 2025 14:03:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 14 Nov 2024 14:03:00 GMT last-modified Thu, 01 Jun 2023 22:52:57 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 14712 x-xss-protection 0 server sffe
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/202409.2.0/assets/	13 KB 3 KB	53ms 52ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otFlat.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 CDHNBOyaHPNE3EDr/Gzy5w== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCF719DDD38B75 x-ms-lease-status unlocked cf-cache-status HIT age 45749 x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:37 GMT content-type application/json last-modified Mon, 28 Oct 2024 06:29:24 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 6ad5bc0e-201e-00ba-3054-297383000000 cf-ray 8e4ace2579885c4a-FRA accept-ranges bytes access-control-allow-origin * content-length 3003 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/	64 KB 14 KB	54ms 54ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4016f0eb8333275dd19d417256d10f1baeb5185536d43503f5e0f54e3253e71d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 J9cjcrf32jBnxJwfqNot4g== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCF719DF6146F7 x-ms-lease-status unlocked cf-cache-status HIT age 60706 x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:37 GMT content-type application/json last-modified Mon, 28 Oct 2024 06:29:27 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id fb4b6dae-d01e-00c9-3f54-290340000000 cf-ray 8e4ace2579895c4a-FRA accept-ranges bytes access-control-allow-origin * content-length 13789 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202409.2.0/assets/	24 KB 4 KB	61ms 60ms	Fetch text/css	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otCommonStyles.css Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e2afa04c9a3e080712c94d68b9c1d33587fddcbaeaba9dfcaf1d53d19f6a280a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 A9jekd5UoO8SyzJ6LiStug== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 45823 content-encoding gzip x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:37 GMT content-type text/css last-modified Mon, 28 Oct 2024 06:29:35 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id f24689cd-a01e-00e4-4f54-298080000000 cf-ray 8e4ace25798a5c4a-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET		2b3b6099-e518-4afe-a07c-4c4baba1a828 https://redcanary.com/ Frame	0 0
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	43ms 43ms	Script application/x-javascript	104.102.43.106 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-43-106.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Cache-Control max-age=8640000 Content-Encoding gzip ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Connection keep-alive Expires Wed, 26 Feb 2025 20:45:37 GMT Accept-Ranges bytes Content-Length 4741 P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Date Mon, 18 Nov 2024 20:45:37 GMT Content-Type application/x-javascript Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	130ms 130ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=906194&u=DB26F55ADFBDC1D80B1B7E5BF96AF8AD8&s=1731962737&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1731962737703%2C%22tO%22%3A-1%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1731962737710&v=d1d41ec36 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv02c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Mon, 18 Nov 2024 20:45:37 GMT content-type image/gif server gnv02c
GET H2	200	destination Show response www.googletagmanager.com/gtag/	287 KB 99 KB	59ms 58ms	Script application/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-759876114&l=dataLayer&cx=c&gtm=45He4be0v813277038za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e001bf8b3626ac9eae35ceb31906aca5a81855e6e32daa3c892c150498d6799d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],} expires Mon, 18 Nov 2024 20:45:37 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Mon, 18 Nov 2024 18:32:11 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 100726 x-xss-protection 0 server Google Tag Manager
POST H3	200	collect www.google.com/ccm/	0 0	206ms 52ms	Ping text/plain	172.217.18.4 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=2145749529.1731962738&auid=529658313.1731962738&npa=1&gtm=45He4be0v813277038za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&tft=1731962737894&tfd=5080&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.18.4 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra02s19-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	42 KB 13 KB	205ms 40ms	Script application/javascript	2a04:4e42:600::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 1f120dbe60c10831180babf37afc0edb7c01e9f4e7b135cfedc58b3523c887fb Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=60 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip etag "5e9ac3a42b557bf8ca38cf2e8baba70b" report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish, 1.1 varnish accept-ranges bytes content-length 12126 date Mon, 18 Nov 2024 20:45:38 GMT last-modified Tue, 15 Oct 2024 19:34:59 GMT content-type application/javascript vary Accept-Encoding,Origin server snooserv x-amz-server-side-encryption AES256
GET H2	200	bat.js Show response bat.bing.com/	50 KB 15 KB	230ms 63ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding gzip etag "028e0691d20db1:0" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 2C82555C27C14CB7983C7AC790A61128 Ref B: FRA31EDGE0809 Ref C: 2024-11-18T20:45:38Z accept-ranges bytes x-cache CONFIG_NOCACHE content-length 14570 date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript last-modified Wed, 16 Oct 2024 22:47:44 GMT vary Accept-Encoding
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	249ms 57ms	Script application/javascript	2a02:26f0:3500:10::210:a98 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a98 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=26868 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Mon, 18 Nov 2024 20:45:38 GMT last-modified Thu, 22 Aug 2024 10:43:55 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	uwt.js Show response static.ads-twitter.com/	57 KB 16 KB	201ms 40ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "4328e910de583ad53b3a7a76455af005+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15926 date Mon, 18 Nov 2024 20:45:38 GMT x-tw-cdn FT last-modified Tue, 29 Oct 2024 00:10:26 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kiad7000084-IAD, cache-fra-etou8220141-FRA x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	239 KB 61 KB	87ms 45ms	Script application/x-javascript	157.240.253.1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra5.fbcdn.net Software / Resource Hash 43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-u9UfDLPD' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 18 Nov 2024 20:45:37 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-u9UfDLPD' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=37, rtx=0, c=23, mss=1232, tbw=4409, tp=9, tpl=0, uplat=1, ullat=-1 pragma public x-fb-debug f9HxnkU/9uB7vF8moY0khbkLniUsWr91NPMIVo6pZu0u+FNTOrOM8EYUwPEqYohI+1t+3dMGE2mrZ7L3nPoRqA== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 62152 x-xss-protection 0 origin-agent-cluster ?1
POST H2	200	assign tracking.g2crowd.com/attribution_tracking/conversions/	0 0	165ms 163ms	Ping text/html	2606:4700::6812:1fb0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/assign Requested by Host: tracking.g2crowd.com URL: https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/threat-detection-report/techniques/rundll32/&e= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1fb0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryE3kgSHGcPQLyhS73 Referer https://redcanary.com/ Response headers
GET H2	200	/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=redcanary.com&pId=6740065282079634641	4 B 280 B	368ms 235ms	Image application/json	2600:9000:206f:6800:5:7a81:86c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://attr.ml-api.io/?domain=redcanary.com&pId=6740065282079634641 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Server 2600:9000:206f:6800:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers via 1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront) apigw-requestid BdcZ_juPIAMEPVw= alt-svc h3=":443"; ma=86400 x-cache Miss from cloudfront content-length 4 x-amz-cf-id Iwv_NQI7apl1u9pK1ZH0OntcatYjDBDd49_FOAm9_-FwPaP3OP6cgQ== date Mon, 18 Nov 2024 20:45:38 GMT content-type application/json x-amz-cf-pop FRA56-C1 Redirect headers cache-control no-store, no-cache, private location https://attr.ml-api.io/?domain=redcanary.com&pId=6740065282079634641 pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 80.255.7.123; 80.255.7.123; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin * an-x-request-uuid 795983d5-1b35-4f0d-9a8e-ae987250f912 content-length 0 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Mon, 18 Nov 2024 20:45:38 GMT x-xss-protection 0 content-type text/html; charset=utf-8 server nginx/1.23.4
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 318 B	4389ms 182ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1731962737913&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1731962737909-16660&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Transfer-Encoding chunked X-Request-Id e9a875a9-909f-4b72-8c7f-8e34d6072247 Content-Encoding gzip Connection keep-alive Access-Control-Allow-Origin * Date Mon, 18 Nov 2024 20:45:42 GMT Content-Type text/plain; charset=UTF-8 Server nginx/1.20.1
POST H2	204	collect region1.analytics.google.com/g/	0 0	158ms 50ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835za200&_p=1731962737298&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067554~102067808~102077855~102081485&cid=798396040.1731962738&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1731962737&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&dt=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=5249 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:38 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 552 B	160ms 48ms	Ping text/plain	2a00:1450:400c:c00::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=798396040.1731962738&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067554~102067808~102077855~102081485 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:38 GMT content-type text/plain server Golfe2
POST H2	204	collect region1.analytics.google.com/g/	0 0	143ms 52ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-S6W6WXK4G8&gtm=45je4be0v874113835za200&_p=1731962737298&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067554~102067808~102077855~102081485&cid=798396040.1731962738&ecid=240545690&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&ec_mode=a&_eu=EA&_s=1&sid=1731962737&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&dt=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&en=page_view&_fv=1&_ss=1&_ee=1&tfd=5267 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:38 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 48 B	144ms 48ms	Ping text/plain	2a00:1450:400c:c00::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S6W6WXK4G8&cid=798396040.1731962738&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067554~102067808~102077855~102081485 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:38 GMT content-type text/plain server Golfe2
POST H2	204	collect region1.analytics.google.com/g/	0 0	116ms 52ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-S6W6WXK4G8&gtm=45je4be0v874113835z8813277038za200&_p=1731962737298&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067554~102067808~102077855~102081485&cid=798396040.1731962738&ecid=240545690&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&ec_mode=a&_eu=EAAC&_s=2&sid=1731962737&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&dt=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&en=page_view&_et=23&tfd=5293 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:38 GMT content-type text/plain server Golfe2
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	149ms 84ms	Image image/gif	142.250.185.67 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3K4MTNQJN&cid=798396040.1731962738&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067554~102067808~102077855~102081485&tag_exp=101925629~102067554~102067808~102077855~102081485&z=1832901271 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.67 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Mon, 18 Nov 2024 20:45:38 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	140ms 75ms	Image image/gif	142.250.185.67 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S6W6WXK4G8&cid=798396040.1731962738&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067554~102067808~102077855~102081485&tag_exp=101925629~102067554~102067808~102077855~102081485&z=1594356088 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.67 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Mon, 18 Nov 2024 20:45:38 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4al0/ Frame 59D8	0 0	138ms 47ms	Document text/html	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fredcanary.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 459334 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Wed, 13 Nov 2024 13:10:04 GMT expires Thu, 13 Nov 2025 13:10:04 GMT last-modified Mon, 21 Oct 2024 16:58:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H2	200	CanarySans-Display-400.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	277ms 276ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-400.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c8794253f4669bc181f3401651637f6a14f68ea3ffd1bd18a8e46abaac6308ac Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fc-5b10" accept-ranges bytes access-control-allow-origin * content-length 23312 date Mon, 18 Nov 2024 20:45:38 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:16 GMT server nginx vary Accept-Encoding
GET H2	200	tdr-sidenav-grain.png redcanary.com/wp-content/themes/redcanary/assets/img/	230 KB 231 KB	158ms 158ms	Image image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-sidenav-grain.png Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 3cf023f65b0756bbd15808ea4464febb7dde19426a49c5ea03555010b9a01813 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f0a8a3-3998b" accept-ranges bytes access-control-allow-origin * content-length 235915 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/png last-modified Tue, 12 Mar 2024 19:10:27 GMT server nginx vary Accept-Encoding
GET H2	200	tdr-search-icon.svg redcanary.com/wp-content/themes/redcanary/assets/img/	773 B 726 B	306ms 306ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-search-icon.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"64187eac-305" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Mon, 20 Mar 2023 15:41:32 GMT
GET H2	200	tdr-hero-canaries.png redcanary.com/wp-content/themes/redcanary/assets/img/	10 KB 10 KB	307ms 306ms	Image image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-canaries.png Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "64187eab-27ad" accept-ranges bytes access-control-allow-origin * content-length 10157 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/png last-modified Mon, 20 Mar 2023 15:41:31 GMT server nginx vary Accept-Encoding
GET H2	200	topic-hero.jpg redcanary.com/wp-content/themes/redcanary/assets/img/	244 KB 245 KB	307ms 307ms	Image image/jpeg	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/topic-hero.jpg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "5c76b1f3-3d141" accept-ranges bytes access-control-allow-origin * content-length 250177 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/jpeg last-modified Wed, 27 Feb 2019 15:51:15 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Display-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	568ms 567ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash df064dd6edad0cdc26f0a3abc83b8d5d5b173a41d6b88d8d242823055da2124d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fe-5b1c" accept-ranges bytes access-control-allow-origin * content-length 23324 date Mon, 18 Nov 2024 20:45:38 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:18 GMT server nginx vary Accept-Encoding
GET H2	200	graphic-soundwave.svg redcanary.com/wp-content/themes/redcanary/assets/img/	3 KB 798 B	312ms 312ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/graphic-soundwave.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"64187ea9-abb" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Mon, 20 Mar 2023 15:41:29 GMT
GET H2	200	icon-spotify.svg redcanary.com/wp-content/themes/redcanary/assets/img/	2 KB 1 KB	152ms 152ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/icon-spotify.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"64187eaa-653" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Mon, 20 Mar 2023 15:41:30 GMT
GET H2	200	CanarySans-Display-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	569ms 568ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 52ce30c1ca4a370f850fadf51868d1792a6e6a81f9488f67b993cc7d2921d187 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fb-5acc" accept-ranges bytes access-control-allow-origin * content-length 23244 date Mon, 18 Nov 2024 20:45:38 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:15 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Text-400.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	570ms 568ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-400.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 9a5b8f66f586ce4d9566503535595800d6d4c8b6e1651ab8b2fbf8f02819ef42 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06303-5a48" accept-ranges bytes access-control-allow-origin * content-length 23112 date Mon, 18 Nov 2024 20:45:38 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:23 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Text-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	22 KB 23 KB	570ms 569ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6a2fae6141cd3c337ae20368ec6c6d16bcd1774b42c9cf6ef2b79f4ce7a67710 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06302-5998" accept-ranges bytes access-control-allow-origin * content-length 22936 date Mon, 18 Nov 2024 20:45:38 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:22 GMT server nginx vary Accept-Encoding
GET H2	200	TDR-Header03-1200w.jpeg redcanary.com/wp-content/themes/redcanary/assets/img/	495 KB 496 KB	304ms 304ms	Image image/jpeg	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/TDR-Header03-1200w.jpeg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 5cd3baa58afc9b772d9cb881478a4511bba11be108264372e299aa7500a41f57 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f0a698-7bacb" accept-ranges bytes access-control-allow-origin * content-length 506571 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/jpeg last-modified Tue, 12 Mar 2024 19:01:44 GMT server nginx vary Accept-Encoding
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 435 B	302ms 302ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"61394254-a1" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 08 Sep 2021 23:08:04 GMT
GET H2	200	ipv cdn.bizible.com/	43 B 328 B	39ms 38ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=6e957d0393f045689e56e80a95dcbcf3&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&_biz_t=1731962737499&_biz_i=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&_biz_n=0&a=redcanary.com&rnd=77957&cdn_o=a&_biz_z=1731962738372 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67BA) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control no-cache, no-store pragma no-cache age 257413 expires -1 accept-ranges bytes x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 43 date Mon, 18 Nov 2024 20:45:38 GMT content-type Image/GIF last-modified Fri, 15 Nov 2024 21:15:25 GMT server ECS (frb/67BA)
GET H2	200	u cdn.bizibly.com/	43 B 205 B	47ms 38ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=6e957d0393f045689e56e80a95dcbcf3&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&_biz_t=1731962738373&_biz_i=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&a=redcanary.com&rnd=298039&cdn_o=a&_biz_z=1731962738373 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control no-cache, no-store pragma no-cache age 157194 expires -1 accept-ranges bytes x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 43 date Mon, 18 Nov 2024 20:45:38 GMT content-type Image/GIF last-modified Sun, 17 Nov 2024 01:05:44 GMT server ECS (frb/67C2)
GET H3	200	nc-61dc49ec658dadeff970ff1e789f1da4br.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	18 KB 5 KB	39ms 39ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-61dc49ec658dadeff970ff1e789f1da4br.js Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 8b1e99a837f85ce645c80aae729f6009d78c6ae46386b4b0fcf149d167f3ef26 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=OuqLZw==, md5=9sJwJdJwW7FryJfWU4IxfA== etag "f6c27025d2705bb16bc897d65382317c" age 41086 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 5596 date Mon, 18 Nov 2024 09:20:52 GMT last-modified Mon, 18 Nov 2024 08:10:39 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC4VB2oRyQ7gstRDLAOn-zdKt84RUdNkX_O2sJwuG8QPnQwOiOBkpIATMabE7jNHCANBU56mO6kFjw cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731917439347272 content-length 5596 content-language en server UploadServer
GET H2	200	ot_close.svg cdn.cookielaw.org/logos/static/	651 B 625 B	57ms 57ms	Image image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/ot_close.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 pcXWFGpuVeSg/jVnYCseRg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 47896 content-encoding gzip x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml last-modified Thu, 14 Nov 2024 20:20:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 264b949d-801e-00bc-094a-3784fb000000 cf-ray 8e4ace2b1b893a4a-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	CanarySans-Display-600.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	483ms 483ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-600.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 3af06755c87e9490cafd32e49064834e94096021de3b7b53458e3384dcf7bf47 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fe-5bf4" accept-ranges bytes access-control-allow-origin * content-length 23540 date Mon, 18 Nov 2024 20:45:38 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:18 GMT server nginx vary Accept-Encoding
GET H2	200	ot_guard_logo.svg Show response cdn.cookielaw.org/logos/static/	497 B 518 B	74ms 73ms	Fetch image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 tXyZydHjxQshFMbbBT1/8A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 60704 content-encoding gzip x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml last-modified Thu, 14 Nov 2024 20:20:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id d60f72d6-101e-00f6-6a20-37b49c000000 cf-ray 8e4ace2b5e675c4a-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	ot_company_logo.png cdn.cookielaw.org/logos/static/	4 KB 4 KB	58ms 58ms	Image image/png	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/ot_company_logo.png Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 E8+sk/ECzKgTUVtDLikiIA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DD04E9B945DA9C age 59774 cf-cache-status HIT x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:38 GMT content-type image/png last-modified Thu, 14 Nov 2024 20:20:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 590207a8-101e-003a-1f91-37d029000000 cf-ray 8e4ace2b6bfe3a4a-FRA accept-ranges bytes access-control-allow-origin * content-length 4036 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	62ms 62ms	Image image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 Y+c301RBZNK39PvKQWrIBw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 51203 content-encoding gzip x-content-type-options nosniff date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml last-modified Thu, 14 Nov 2024 20:20:04 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 73a8f2e6-f01e-003b-5eea-36d1d4000000 cf-ray 8e4ace2b6c013a4a-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H3	200	1042590016249604 Show response connect.facebook.net/signals/config/	69 KB 14 KB	184ms 184ms	Script application/x-javascript	157.240.253.1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.177&r=stable&domain=redcanary.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra5.fbcdn.net Software / Resource Hash 8997c9dfaa3dc538dac8929c403a166a5366fc508954435e7b6ec0940153ead7 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-AIBEdt1t' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 18 Nov 2024 20:45:38 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-AIBEdt1t' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=39, rtx=0, c=77, mss=1232, tbw=70935, tp=67, tpl=0, uplat=143, ullat=0 pragma public x-fb-debug THlT8TJ9PLR4ZcelvALmd225MOULNVUkTKTjhGOLtc8511qNrjVQsiv6Br9RNLIZT0f9Ft52XwRc8pDRi5nIDg== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	adsct t.co/1/i/	43 B 627 B	255ms 169ms	Image image/gif	162.159.140.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&dv=Europe%2FBerlin%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2612%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=e3e5b4a2-f9b4-4d62-923c-7d171b4f4b54&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=fc2cc8f9-263f-4bc3-8cee-8b343f97dc48&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tw_iframe_status=0&txn_id=o015g&type=javascript&version=2.3.31 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=0 x-transaction-id 12b6b094a941db3f cache-control no-cache, no-store, max-age=0 x-connection-hash 07d54784aee0a3ce4bc872e9f05fff5a21a20c7d00f10f169b0122de233e8429 cf-cache-status DYNAMIC cf-ray 8e4ace2c7ffee519-TXL x-response-time 102 content-length 43 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 726 B	359ms 222ms	Image image/gif	104.244.42.67 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&dv=Europe%2FBerlin%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2612%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=e3e5b4a2-f9b4-4d62-923c-7d171b4f4b54&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=fc2cc8f9-263f-4bc3-8cee-8b343f97dc48&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tw_iframe_status=0&txn_id=o015g&type=javascript&version=2.3.31 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.67 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=631138519 x-transaction-id 35fec1a293d265d8 cache-control no-cache, no-store, max-age=0 x-connection-hash b63eae525e2472fa3b68bacff5eab4dd51ace7d23f474c78eb92b976795539d0 x-response-time 177 content-length 43 date Mon, 18 Nov 2024 20:45:38 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
GET H2	200	f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Show response j.6sc.co/j/	5 KB 2 KB	3582ms 3447ms	Script application/javascript	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 805ce4322a9be88ec58266cf40c95f62920aadea2a0d00f6ddeda8f82df66b09 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip etag "e32c5c81f0cda4121d7ac50a6fa46548" x-amz-version-id ZP_GnDytUL9NRU7xM5CP6PgfirMXR58J expires Mon, 18 Nov 2024 21:15:39 GMT x-amz-cf-id q1EDtwjrWwqpsnA700lel7yJDPZhjqbyoT1cgyKmOQ_VkIPBG5t2Fg== date Mon, 18 Nov 2024 20:45:39 GMT last-modified Thu, 15 Feb 2024 19:15:51 GMT vary Accept-Encoding content-type application/javascript x-amz-meta-content-type application/json cache-control private, max-age=1800 accept-ranges bytes content-length 1566 x-amz-cf-pop FRA60-P8 server AmazonS3 x-amz-server-side-encryption AES256
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 326 B	158ms 158ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=6e957d0393f045689e56e80a95dcbcf3&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.11.11&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash 30144230ebdfcfde7545e676de90f71366900c1e047a27e1ab95a3916a049852 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control private, must-revalidate, max-age=21600 content-encoding gzip etag D4CFFB6F p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 219 date Mon, 18 Nov 2024 20:45:38 GMT content-type text/javascript; charset=utf-8 vary Accept-Encoding server ECS (frb/6711)
GET H2	200	config Show response pixel-config.reddit.com/pixels/t2_5kac730w/	3 B 124 B	126ms 48ms	XHR application/json	2a04:4e42:200::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://pixel-config.reddit.com/pixels/t2_5kac730w/config Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=14400 content-encoding gzip via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 27 date Mon, 18 Nov 2024 20:45:38 GMT content-type application/json
GET H2	200	t2_5kac730w_telemetry Show response www.redditstatic.com/ads/conversions-config/v1/pixel/config/	86 B 700 B	126ms 49ms	XHR application/json	2a04:4e42:600::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_5kac730w_telemetry Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=300 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 98 date Mon, 18 Nov 2024 20:45:38 GMT content-type application/json vary Accept-Encoding,Origin server snooserv
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	143ms 43ms	Image image/gif	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1731962738535&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=57dd7d32-d24c-4d22-994e-6e58b5a745b9&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_49267bce&dpm=&dpcc=&dprc= Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} retry-after 0 cross-origin-resource-policy cross-origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes content-length 42 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/gif server Varnish
GET H2	200	birdInFlight-flipped-975x975-1.jpg redcanary.com/wp-content/uploads/2022/03/	18 KB 18 KB	389ms 388ms	Image image/jpeg	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2022/03/birdInFlight-flipped-975x975-1.jpg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "6226638a-460b" accept-ranges bytes access-control-allow-origin * content-length 17931 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/jpeg last-modified Mon, 07 Mar 2022 19:56:58 GMT server nginx vary Accept-Encoding
GET H2	200	TDR-Header-02-Subtle-1.jpg redcanary.com/wp-content/uploads/2024/03/	474 KB 475 KB	389ms 388ms	Image image/jpeg	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2024/03/TDR-Header-02-Subtle-1.jpg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6cf86376868d29f0157d614e705b93d5073217ae21a9c51508de2c27c6c95a6e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65ef2f62-76850" accept-ranges bytes access-control-allow-origin * content-length 485456 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/jpeg last-modified Mon, 11 Mar 2024 16:20:50 GMT server nginx vary Accept-Encoding
GET H2	200	Red-Canary-Logo-2024-reverse.png redcanary.com/wp-content/uploads/2024/05/	15 KB 15 KB	389ms 389ms	Image image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2024/05/Red-Canary-Logo-2024-reverse.png Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7c2ae2ca74ef67fcea69d64e507fa28c8c1b005b72ef4d1a0c433fbc0681ec15 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "66576f8a-3bcb" accept-ranges bytes access-control-allow-origin * content-length 15307 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/png last-modified Wed, 29 May 2024 18:10:18 GMT server nginx vary Accept-Encoding
GET H2	200	Icon_Alert-Center_Investigation.svg redcanary.com/wp-content/uploads/2020/09/	4 KB 1 KB	388ms 387ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2020/09/Icon_Alert-Center_Investigation.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"5f6cd37b-e55" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Thu, 24 Sep 2020 17:12:27 GMT
GET H2	200	u cdn.bizible.com/	43 B 86 B	38ms 37ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1731962737909-16660&_biz_u=6e957d0393f045689e56e80a95dcbcf3&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&_biz_t=1731962738373&_biz_i=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&_biz_n=1&a=redcanary.com&rnd=371719&cdn_o=a&_biz_z=1731962738556 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control no-cache, no-store pragma no-cache age 157194 expires -1 accept-ranges bytes x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 43 date Mon, 18 Nov 2024 20:45:38 GMT content-type Image/GIF last-modified Sun, 17 Nov 2024 01:05:44 GMT server ECS (frb/67C2)
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 699 B	284ms 170ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://redcanary.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 5D42C8810DAE47B481A72E9D30A6FA3E Ref B: DUS30EDGE0911 Ref C: 2024-11-18T20:45:38Z x-li-fabric prod-ltx1 access-control-allow-credentials true x-li-uuid AAYnNf/OrIWIy1WCSMyZmg== x-li-proto http/2 access-control-allow-origin https://redcanary.com x-cache CONFIG_NOCACHE date Mon, 18 Nov 2024 20:45:37 GMT vary Origin
GET H3	200	track-26c93666cadd42d35a525458cedd33edbr.js Show response dev.visualwebsiteoptimizer.com/cdn/7.0/	17 KB 5 KB	117ms 117ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/7.0/track-26c93666cadd42d35a525458cedd33edbr.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 18ee167e628f3d1637fc06e5fa234d5eb464088a3f233a679859ec23c21e179a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=96Q88g==, md5=yd7Se2BKGY2G8QE6t1jSTA== etag "c9ded27b604a198d86f1013ab758d24c" age 39195 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 4842 date Mon, 18 Nov 2024 09:52:23 GMT last-modified Mon, 18 Nov 2024 08:38:09 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC6ginkSgjVf5Ok-AlXjA0Tdcfnr0X9EExdXco5UBXur4o0467VE0Q2yah2rHGI0oeASex4hZBWNKA cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731919089501557 content-length 4842 content-language en server UploadServer
GET H3	200	opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Show response dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/	157 KB 40 KB	40ms 39ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 32f40b8bc8e2ca8b2a2822d6378716b9b130575afe39b51e764bcaa5d357575a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=Md5CSQ==, md5=BY3q3XFcoJRgei/SQSwWMA== etag "058deadd715ca094607a2fd2412c1630" age 15970 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 40448 date Mon, 18 Nov 2024 16:19:28 GMT last-modified Mon, 18 Nov 2024 15:33:22 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC71rWFLaUBtnhVtU0bRW2-Fi9WBwxf0VwzHPeM35OkK2jSTeEiwpXoXuyVZXOvp8zNbbdU cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731944002067936 content-length 40448 content-language en server UploadServer
GET H2	200	56383426.js Show response bat.bing.com/p/action/	363 B 413 B	65ms 64ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a1fec7acc9e28feaa2280cd08d30cab4cac8e9557fb8fb35ab6ffcd1e28fade8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding br accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: FFBE4386719D4D0AA46928464552EFE8 Ref B: FRA31EDGE0809 Ref C: 2024-11-18T20:45:38Z x-cache CONFIG_NOCACHE date Mon, 18 Nov 2024 20:45:37 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 816 B	315ms 206ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1540753&time=1731962738581&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tm=gtmv2 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept * Referer https://redcanary.com/ Response headers x-li-pop afd-prod-ltx1-x content-encoding gzip x-fs-uuid 00062735ffcf169f024479257b8d670d x-msedge-ref Ref A: 4125C58B27CC4A68AEFFF828CE230B9F Ref B: DUS30EDGE0418 Ref C: 2024-11-18T20:45:38Z x-li-fabric prod-ltx1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYnNf/PFp8CRHkle41nDQ== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Mon, 18 Nov 2024 20:45:38 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731962738581&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tm=gtmv2 https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731962738581&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tm=gtmv2&e_ipv6=AQJdwTY_ypAa5gAAA...	0 267 B	3476ms 184ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731962738581&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tm=gtmv2&e_ipv6=AQJdwTY_ypAa5gAAAZNBBhhRKegvSZ22mDlFk0YAFv7RV3B47SGVUJe_mN6UmqLBxTePYBA Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers linkedin-action 1 x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 0935F2DAE27E4595AE095C4AF89A393F Ref B: DUS30EDGE0806 Ref C: 2024-11-18T20:45:42Z x-li-fabric prod-ltx1 x-li-uuid AAYnNgAFHYNAJbsuhuCXWA== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 18 Nov 2024 20:45:41 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-ltx1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731962738581&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&tm=gtmv2&e_ipv6=AQJdwTY_ypAa5gAAAZNBBhhRKegvSZ22mDlFk0YAFv7RV3B47SGVUJe_mN6UmqLBxTePYBA x-msedge-ref Ref A: 06664F61EA894435BA9508C56ED4E6D1 Ref B: DUS30EDGE0911 Ref C: 2024-11-18T20:45:38Z x-li-fabric prod-ltx1 x-li-uuid AAYnNf/OyPPxf08TUelcMg== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 18 Nov 2024 20:45:38 GMT
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 581 B	345ms 345ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"5c76b1e9-15e" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 27 Feb 2019 15:51:05 GMT
GET H2	200	spotify-logo-black-8-01.svg redcanary.com/wp-content/uploads/2021/03/	898 B 819 B	337ms 336ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/03/spotify-logo-black-8-01.svg Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"6061f0b5-382" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:38 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Mon, 29 Mar 2021 15:22:29 GMT
GET H2	204	0 bat.bing.com/action/	0 286 B	64ms 64ms	Image text/plain	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=48a8843a-6b06-4ed1-af8c-549088b0804e&bo=1&sid=11882fb0a5ee11efacae8515e50ad577&vid=1188ea60a5ee11efb835ff3179d38793&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&r=&lt=5633&evt=pageLoad&sv=1&cdb=AQET&rn=766694 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, must-revalidate pragma no-cache accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: E246DC21C9B44848913C5995F10CC0D7 Ref B: FRA31EDGE0809 Ref C: 2024-11-18T20:45:38Z expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * x-cache CONFIG_NOCACHE date Mon, 18 Nov 2024 20:45:37 GMT
POST H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	128ms 128ms	Ping image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=906194&u=DB26F55ADFBDC1D80B1B7E5BF96AF8AD8&s=1731962737&p=1&update=1&cq=1&ttl=90&vn=undefined&vns=undefined&vno=undefined&eTime=1731962738709&v=d1d41ec36&_cu=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&random=0.7010690825212669 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv02c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Mon, 18 Nov 2024 20:45:38 GMT content-type image/gif server gnv02c
GET H3	200	worker-70faafffa0475802f5ee03ca5ff74179br.js Show response dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/	46 KB 13 KB	46ms 46ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/worker-70faafffa0475802f5ee03ca5ff74179br.js Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 09b67475f266dbf552159ca9f6b44d9dc3ea04842b2bd6e8b09d74f6b21897d0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=t9nekA==, md5=OTBW++nqbotSERjfhuer5A== etag "393056fbe9ea6e8b521118df86e7abe4" age 2358338 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 13401 date Tue, 22 Oct 2024 13:40:00 GMT last-modified Fri, 18 Oct 2024 10:52:37 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AHmUCY3RtATMwoUsyxBlzleOs81soJ2f8blMqssGcgpeGYZoR1GB3mF1VjqH1T8Cb3nprwXvdpW4bInMDA cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1724145080238127 content-length 13401 content-language en server UploadServer
GET H3	200	/ www.facebook.com/tr/	0 16 B	3369ms 3125ms	Image text/plain	157.240.253.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&rl=&if=false&ts=1731962738753&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12318&fbp=fb.1.1731962738751.6450495499347090&ler=empty&cdl=API_unavailable&it=1731962738516&coo=false&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra5.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality MODERATE; q=0.3, rtt=425, rtx=0, c=23, mss=1232, tbw=4933, tp=18, tpl=0, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Mon, 18 Nov 2024 20:45:42 GMT content-type text/plain server proxygen-bolt priority u=3,i
GET H3	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 197 B	3548ms 3304ms	Image image/png	157.240.253.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&rl=&if=false&ts=1731962738753&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12318&fbp=fb.1.1731962738751.6450495499347090&ler=empty&cdl=API_unavailable&it=1731962738516&coo=false&rqm=FGET Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra5.facebook.com Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7438723334803677740"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 18 Nov 2024 20:45:42 GMT content-type image/png vary Accept-Encoding x-fb-debug UH1S9zTKmzRfY2pUWwQT4R3PWQcDsPl9lTYgWxO/O6FyK7Ak9luD/ba6gRnHAc9BHKv7+2/6djDytXnwpIotMQ== priority u=3,i x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7438723334803677740", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; cache-control private, no-store, no-cache, must-revalidate x-fb-connection-quality MODERATE; q=0.3, rtt=1146, rtx=0, c=24, mss=1232, tbw=5580, tp=27, tpl=0, uplat=164, ullat=0 cross-origin-opener-policy same-origin-allow-popups pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET		a1888501-a648-4e5a-99e2-ef193903acab https://redcanary.com/ Frame	0 0
POST H2	200	analyze Show response r6.visualwebsiteoptimizer.com/	0 143 B	3578ms 384ms	XHR application/javascript	34.48.154.7 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://r6.visualwebsiteoptimizer.com/analyze?_a=906194&_u=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 34.48.154.7 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 7.154.48.34.bc.googleusercontent.com Software r6 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryCotJfaUN7kYEfFZU Referer https://redcanary.com/ Response headers access-control-allow-origin * content-encoding gzip date Mon, 18 Nov 2024 20:45:42 GMT content-type application/javascript; charset=UTF-8 server r6
GET H3	200	css fonts.googleapis.com/	8 KB 794 B	185ms 89ms	Stylesheet text/css	172.217.16.202 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.16.202 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f202.1e100.net Software ESF / Resource Hash 07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:42 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:42 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Mon, 18 Nov 2024 20:42:49 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H3	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 0	2ms 2ms	Stylesheet text/css	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "60215473-2fb" age 347762 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2Faw3k3p18spgIx%2BzuStRuONCocwnC5IQGEKRyV9Exoun2e0ExCRdeJnJ5LrkGSZdOspNp9IBM%2FxjUvzFPA02ElQIXbQ4nsipClHId2nCfPbmnHzBC8K2M7PnHfzys0N6Ve4rEUo"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sat, 08 Nov 2025 20:45:37 GMT alt-svc h3=":443"; ma=86400 date Mon, 18 Nov 2024 20:45:37 GMT content-type text/css; charset=utf-8 last-modified Mon, 08 Feb 2021 15:10:43 GMT vary Accept-Encoding cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4ace246d928c4f-FRA accept-ranges bytes access-control-allow-origin * content-length 271 server cloudflare
GET H2	200	messenger app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame EC42	0 0	542ms 385ms	Document text/html	104.18.17.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=03905c65-89c1-45de-82af-507716213ba7 Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers cache-control max-age=0, private, must-revalidate cf-cache-status DYNAMIC cf-ray 8e4ace439e7de505-TXL content-encoding gzip content-security-policy content-type text/html; charset=utf-8 date Mon, 18 Nov 2024 20:45:42 GMT link <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush referrer-policy strict-origin-when-cross-origin server cloudflare server-timing cfCacheStatus;desc="DYNAMIC" strict-transport-security max-age=63072000; includeSubDomains vary Accept-Encoding x-cache miss x-content-type-options nosniff x-download-options noopen x-envoy-upstream-service-time 25 x-permitted-cross-domain-policies none x-request-id 903d4adc-963d-4c88-97c8-a251594b0e3f x-runtime 0.023371 x-xss-protection 1; mode=block
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 19 KB	57ms 43ms	Script application/javascript	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "66fb91ae-111d7" x-content-type-options nosniff expires Mon, 18 Nov 2024 23:45:42 GMT accept-ranges bytes content-length 18830 date Mon, 18 Nov 2024 20:45:42 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Tue, 01 Oct 2024 06:07:42 GMT
GET H2	200	getuidj Show response secure.adnxs.com/	29 B 1 KB	52ms 47ms	XHR application/json	37.252.171.53 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.23.4 / Resource Hash c7d5d6b394a8465cfdafbb0333fd741e34af1853c261a10313ed9f246b7312b0 Security Headers Name Value X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-store, no-cache, private pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 80.255.7.123; 80.255.7.123; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin https://redcanary.com an-x-request-uuid 75c8d414-2213-494a-9713-e7c649861a37 content-length 29 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Mon, 18 Nov 2024 20:45:42 GMT x-xss-protection 0 content-type application/json; charset=utf-8 server nginx/1.23.4
GET H2	200	/ Show response c.6sc.co/	7 B 191 B	68ms 53ms	XHR text/html	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers access-control-max-age 86400 access-control-allow-credentials true access-control-allow-methods GET,POST access-control-allow-origin https://redcanary.com content-length 7 date Mon, 18 Nov 2024 20:45:42 GMT content-type text/html access-control-allow-headers *
GET H2	200	/ Show response ipv6.6sc.co/	19 B 307 B	151ms 40ms	XHR text/html	2a02:26f0:7100::5f64:87f1 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::5f64:87f1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash d28a5cc21ad3d18a8dafb1c4d1bfadbc7b43241393ed4a7d90f065f5950dbaaf Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2a01:4a0:1338:93::3 expires Mon, 18 Nov 2024 20:45:42 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1731962742408_1600423917_183783679_21_882_37_44_219";dur=1 access-control-allow-origin https://redcanary.com content-length 19 date Mon, 18 Nov 2024 20:45:42 GMT content-type text/html vary Origin
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	143ms 127ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:42 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:42 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	149ms 134ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22e8bebcdaa132f727ae8d16d9967447769318945e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22f3744a5e-342b-429c-9d2c-2c1b7b45310a%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:42 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:42 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	details Show response eps.6sc.co/v3/company/	740 B 650 B	133ms 64ms	XHR application/json	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash a16a8eb1006deca6a9a6ccedf5176d374b3ea8d35ff08cf29321623d0c943f69 Request headers Authorization Token e8bebcdaa132f727ae8d16d9967447769318945e X-6s-CustomID WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a Referer https://redcanary.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://redcanary.com content-length 393 date Mon, 18 Nov 2024 20:45:42 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	details eps.6sc.co/v3/company/ Frame	0 0	121ms 39ms	Preflight	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://redcanary.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Mon, 18 Nov 2024 20:45:42 GMT timing-allow-origin https://6sense.com x-6si-region
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	135ms 134ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A93%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2a01%3A4a0%3A1338%3A93%3A%3A3&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:42 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:42 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	193ms 20ms	Script text/javascript	2001:4860:4802:32::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip age 4535 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],} x-content-type-options nosniff expires Mon, 18 Nov 2024 21:30:07 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 19:30:07 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 20994 server Golfe2
OPTIONS H2	200	v v.eps.6sc.co/ Frame	0 0	358ms 126ms	Preflight application/json	13.32.27.5 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.27.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-27-5.fra56.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 0 content-type application/json date Mon, 18 Nov 2024 20:45:43 GMT via 1.1 22b9ddafebf39d72780d68dad970d218.cloudfront.net (CloudFront) x-amz-apigw-id BdcaqHV_oAMEAkA= x-amz-cf-id rFIdlj9qW7t0r9-bIide5aEex9TvQb93Rm4NYkxWLzniEnMYb4QY7A== x-amz-cf-pop FRA56-C2 x-amzn-requestid 7240e04a-7bd0-4f56-bd9f-beb8dc486b0d x-cache Miss from cloudfront
POST H2	200	v Show response v.eps.6sc.co/	12 B 520 B	391ms 358ms	XHR application/json	13.32.27.5 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.27.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-27-5.fra56.r.cloudfront.net Software / Resource Hash 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-type application/json Referer https://redcanary.com/ Response headers x-amz-apigw-id BdcatHxLIAMEKNQ= x-amzn-trace-id Root=1-673ba777-56c053fd5ec3c21a51830e86;Parent=1f145beb171af791;Sampled=0;Lineage=1:56167173:0 access-control-allow-methods OPTIONS,POST x-amzn-requestid b4e92635-13fb-47d8-8848-524a1a1ab6fd via 1.1 22b9ddafebf39d72780d68dad970d218.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront content-length 12 x-amz-cf-id XoLt4piJQY0g34GSUh3klIysCoOu8QL5WcSh60S3kwX5TOdxkWKPLQ== date Mon, 18 Nov 2024 20:45:43 GMT content-type application/json x-amz-cf-pop FRA56-C2 access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	130ms 129ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A9659.89999961853%2C%22duration%22%3A261.4000015258789%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A9659.89999961853%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A9921.30000114441%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=&d=1&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:42 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:42 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
POST H2	204	collect region1.analytics.google.com/g/	0 0	85ms 60ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835z8813277038za200&_p=1731962737298&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067554~102067808~102077855~102081485&cid=798396040.1731962738&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EAAC&_s=2&sid=1731962737&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&dt=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&en=page_view&_et=20&tfd=10021 Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:42 GMT content-type text/plain server Golfe2
GET H2	200	analyze r6.visualwebsiteoptimizer.com/	35 B 257 B	381ms 126ms	Image image/gif	34.48.154.7 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://r6.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&duration=0&session_id=1731962737&recording_id=1&vn=4.0.340&rand=0.0961132596268841&end_time=1731962741991&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%22%2520100%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%2520100%2520100%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731962742991&fRS=true&re=%7B%222%22%3A%22DB26F55ADFBDC1D80B1B7E5BF96AF8AD8%22%7D&he=%7B%221%22%3A%22DB26F55ADFBDC1D80B1B7E5BF96AF8AD8%22%7D&v2=true&count=2 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 34.48.154.7 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 7.154.48.34.bc.googleusercontent.com Software r6 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * content-length 35 date Mon, 18 Nov 2024 20:45:42 GMT content-type image/gif server r6
GET H2	200	analyze r6.visualwebsiteoptimizer.com/	35 B 256 B	382ms 127ms	Image image/gif	34.48.154.7 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://r6.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&duration=0&session_id=1731962737&recording_id=1&vn=4.0.340&rand=0.7546738284213459&end_time=1731962741991&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%220%252052%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%2520210%252052%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731962742991&fRS=true&re=%7B%222%22%3A%22DB26F55ADFBDC1D80B1B7E5BF96AF8AD8%22%7D&he=%7B%221%22%3A%22DB26F55ADFBDC1D80B1B7E5BF96AF8AD8%22%7D&v2=true&count=3 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 34.48.154.7 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 7.154.48.34.bc.googleusercontent.com Software r6 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * content-length 35 date Mon, 18 Nov 2024 20:45:42 GMT content-type image/gif server r6
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 419 B	51ms 41ms	XHR text/plain	2001:4860:4802:32::178 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=785234508&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&ul=de-de&de=UTF-8&dt=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YADAAEABAAAAACAAI~&jid=1938649706&gjid=1007189442&cid=798396040.1731962738&tid=UA-52702906-1&_gid=1824735010.1731962743&_r=1&_slc=1&gtm=45He4be0n81PXWC8JWv813277038za200&cd4=&cd5=&cd10=&cd11=&cd20=&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&npa=1&z=688371443 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain Referer https://redcanary.com/ Response headers report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],} x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 20:45:43 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type text/plain cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0 access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 3 server Golfe2
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	128ms 128ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A42%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2a01%3A4a0%3A1338%3A93%3A%3A3&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:43 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:43 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H3	200	collect www.google-analytics.com/	35 B 58 B	46ms 45ms	Image image/gif	216.58.212.142 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&a=785234508&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&ul=de-de&de=UTF-8&dt=Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=798396040.1731962738&tid=UA-52702906-1&_gid=1824735010.1731962743&gtm=45He4be0n81PXWC8JWv813277038za200&cd4=&cd5=&cd10=&cd11=&cd20=&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cd6=Germany&cd7=Berlin&cd8=Berlin&cd9=&cd12=&cd13=&cd14=&cd18=null&npa=1&z=401464275 Protocol H3 Security QUIC, , AES_128_GCM Server 216.58.212.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS ams15s21-in-f142.1e100.net Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers age 10038 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],} x-content-type-options nosniff expires Mon, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 17:58:25 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 server Golfe2
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/dcdn/	23 KB 6 KB	49ms 49ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/dcdn/settings.js?a=906194&settings_type=4&ts=1731958725&dt=desktop&cc=DE Requested by Host: redcanary.com URL: https://redcanary.com/threat-detection-report/techniques/rundll32/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash d1a6f71fcd9002da24791ba3bbafe2c405f49258cd5125a556324a2eeaea8fcf Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cdn_cache_status revalidated cache-control public, max-age=1800, s-maxage=1800 content-encoding gzip etag W/"1731958725_EA" age 0 via 1.1 google not-modified true access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 5740 date Mon, 18 Nov 2024 20:45:43 GMT content-type application/javascript; charset=UTF-8 server gfra1
GET H2	200	favicon.png redcanary.com/wp-content/themes/redcanary/assets/img/	16 KB 16 KB	151ms 150ms	Other image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8b4532ddd365937e2ee31a95189a447d45881cf4dadf2ab66c850786f87774d8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "5c76b1ec-3fb8" accept-ranges bytes access-control-allow-origin * content-length 16312 date Mon, 18 Nov 2024 20:45:43 GMT content-type image/png last-modified Wed, 27 Feb 2019 15:51:08 GMT server nginx vary Accept-Encoding
GET H2	200	favicon.ico redcanary.com/wp-content/themes/redcanary/assets/img/	1 KB 812 B	200ms 198ms	Other image/x-icon	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c3096f016b56aa58ea27707e5636618495175ed50b77c09b91c9cb5c014b79e2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"65e68ad0-47e" access-control-allow-origin * date Mon, 18 Nov 2024 20:45:43 GMT content-type image/x-icon vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Tue, 05 Mar 2024 03:00:32 GMT
GET H2	200	favicon-32x32.png redcanary.com/wp-content/themes/redcanary/assets/img/	1 KB 2 KB	176ms 156ms	Other image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon-32x32.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash a19b17e3c318b115a7531fd404bd12a49d65104d57a1efd064f5ae80b457f52f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/threat-detection-report/techniques/rundll32/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65e68ad0-5c9" accept-ranges bytes access-control-allow-origin * content-length 1481 date Mon, 18 Nov 2024 20:45:44 GMT content-type image/png last-modified Tue, 05 Mar 2024 03:00:32 GMT server nginx vary Accept-Encoding
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	393ms 393ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A43%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2a01%3A4a0%3A1338%3A93%3A%3A3&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:44 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:44 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	217ms 216ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A44%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2a01%3A4a0%3A1338%3A93%3A%3A3&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:45 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:45 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	413ms 413ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A45%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2a01%3A4a0%3A1338%3A93%3A%3A3&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:46 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:46 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	142ms 142ms	Image image/gif	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=111f80ec-025a-457e-81d5-8d2f16fc75c5&session=bbaeab88-fb04-410e-8b25-60b582b7ac53&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2020%3A45%3A46%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%225008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20use%20Rundll32%2C%20a%20native%20Windows%20process%2C%20to%20execute%20malicious%20code%20through%20DLLs%2C%20often%20to%20bypass%20application%20controls.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Rundll32%20-%20Red%20Canary%20Threat%20Detection%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Frundll32%2F&pageViewId=57772016-7b06-471d-8be0-e25eb1804a79&an_uid=6740065282079634641&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2a01%3A4a0%3A1338%3A93%3A%3A3&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 18 Nov 2024 20:45:47 GMT accept-ranges bytes content-length 43 date Mon, 18 Nov 2024 20:45:47 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

redcanary.com

URL

blob:https://redcanary.com/2b3b6099-e518-4afe-a07c-4c4baba1a828

Domain

redcanary.com

URL

blob:https://redcanary.com/a1888501-a648-4e5a-99e2-ef193903acab