www.darkreading.com Open in urlscan Pro
2606:4700::6811:7963 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://r20.rs6.net/tn.jsp?f=001fyY3GovbKBvDiIWwViUve-oqQg-FbocuC--vmTujzpvyPqDnvkLV2rjv7Vc1PVFryXpOu7Mj85ElxN0YMT00...
Effective URL:
https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Submission: On March 09 via api (March 9th 2020, 5:25:24 pm UTC) from US

Summary HTTP 340 Redirects Links 54 Behaviour Indicators

Summary

This website contacted 64 IPs in 8 countries across 52 domains to perform 340 HTTP transactions. The main IP is 2606:4700::6811:7963, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.darkreading.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on January 28th 2020. Valid for: 8 months.

This is the only time www.darkreading.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	208.75.122.11 208.75.122.11	40444 (ASN-CC) (ASN-CC)
1 13	2606:4700::68... 2606:4700::6811:7963	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
13	2606:4700:303... 2606:4700:3031::681f:459e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
5	2606:4700:303... 2606:4700:3035::6818:7875	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:303... 2606:4700:3032::681b:9174	13335 (CLOUDFLAR...) (CLOUDFLARENET)
48	2606:4700:303... 2606:4700:3036::681c:3e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.113.131 151.101.113.131	54113 (FASTLY) (FASTLY)
2	108.128.171.217 108.128.171.217	16509 (AMAZON-02) (AMAZON-02)
1	52.222.149.68 52.222.149.68	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:81f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:821::2008	15169 (GOOGLE) (GOOGLE)
1	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
9	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2	2600:9000:205... 2600:9000:2057:7800:e:5a70:ca47:86e1	16509 (AMAZON-02) (AMAZON-02)
1	2606:2800:133... 2606:2800:133:7403:4a68:7eff:710b:1ddf	15133 (EDGECAST) (EDGECAST)
18	2a00:1450:400... 2a00:1450:4001:81e::2002	15169 (GOOGLE) (GOOGLE)
2	15.188.31.119 15.188.31.119	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
1 12	172.217.23.130 172.217.23.130	15169 (GOOGLE) (GOOGLE)
12	143.204.212.151 143.204.212.151	16509 (AMAZON-02) (AMAZON-02)
1 4	23.11.238.95 23.11.238.95	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	46.105.202.39 46.105.202.39	16276 (OVH) (OVH)
15	2a00:1450:400... 2a00:1450:4001:819::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81b::2002	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.31.188.35 52.31.188.35	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:303... 2606:4700:3035::6812:28f2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:205... 2600:9000:2057:7a00:18:1fcd:349:ca21	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81b::2003	15169 (GOOGLE) (GOOGLE)
1 2	2600:9000:205... 2600:9000:2057:6e00:14:85db:2b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
51	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.6.46.73 52.6.46.73	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	3.120.242.149 3.120.242.149	16509 (AMAZON-02) (AMAZON-02)
3 6	52.215.103.126 52.215.103.126	16509 (AMAZON-02) (AMAZON-02)
1	35.177.85.121 35.177.85.121	16509 (AMAZON-02) (AMAZON-02)
34	99.86.3.13 99.86.3.13	16509 (AMAZON-02) (AMAZON-02)
1	13.227.156.100 13.227.156.100	16509 (AMAZON-02) (AMAZON-02)
3	2.18.232.7 2.18.232.7	16625 (AKAMAI-AS) (AKAMAI-AS)
1	23.62.118.225 23.62.118.225	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2620:103::192... 2620:103::192:155:48:119	19994 (RACKSPACE) (RACKSPACE)
1	52.45.19.11 52.45.19.11	14618 (AMAZON-AES) (AMAZON-AES)
11	52.204.255.228 52.204.255.228	14618 (AMAZON-AES) (AMAZON-AES)
4	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST)
1 2	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER)
1 2	142.0.160.13 142.0.160.13	7160 (NETDYNAMICS) (NETDYNAMICS)
1 3	209.167.231.17 209.167.231.17	7160 (NETDYNAMICS) (NETDYNAMICS)
2	23.58.216.7 23.58.216.7	16625 (AKAMAI-AS) (AKAMAI-AS)
16	2606:2800:134... 2606:2800:134:1a0d:1429:742:782:b6	15133 (EDGECAST) (EDGECAST)
1	23.45.108.93 23.45.108.93	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1 5	23.210.248.216 23.210.248.216	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	54.171.23.184 54.171.23.184	16509 (AMAZON-02) (AMAZON-02)
1	34.196.252.78 34.196.252.78	14618 (AMAZON-AES) (AMAZON-AES)
1 1	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE)
2	52.49.96.126 52.49.96.126	16509 (AMAZON-02) (AMAZON-02)
2 2	52.31.92.58 52.31.92.58	16509 (AMAZON-02) (AMAZON-02)
2 2	52.214.152.253 52.214.152.253	16509 (AMAZON-02) (AMAZON-02)
2 3	3.125.70.222 3.125.70.222	16509 (AMAZON-02) (AMAZON-02)
340	64

1 208.75.122.11 (United States) 1 redirects

ASN40444 (ASN-CC, US)
PTR: rs6.net

r20.rs6.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700::6811:7963 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.darkreading.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700:3031::681f:459e (United States)

ASN13335 (CLOUDFLARENET, US)

twimgs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3035::6818:7875 (United States)

ASN13335 (CLOUDFLARENET, US)

i.ubm-us.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsimg.ubm-us.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3032::681b:9174 (United States)

ASN13335 (CLOUDFLARENET, US)

i.cmpnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

48 2606:4700:3036::681c:3e5 (United States)

ASN13335 (CLOUDFLARENET, US)

img.deusm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.113.131 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

6600d6d98e534115970f9529a45f3195.js.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.128.171.217 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-171-217.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.149.68 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-149-68.fra53.r.cloudfront.net

assets.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2057:7800:e:5a70:ca47:86e1 (United States)

ASN16509 (AMAZON-02, US)

cdn.flipboard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:133:7403:4a68:7eff:710b:1ddf (United States)

ASN15133 (EDGECAST, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:81e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.31.119 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

ubmtech.d3.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.217.23.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s18-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 143.204.212.151 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-212-151.fra53.r.cloudfront.net

cf-images.us-east-1.prod.boltdns.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.11.238.95 (United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-11-238-95.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.105.202.39 (France)

ASN16276 (OVH, FR)

u.heatmap.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:819::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.31.188.35 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-188-35.eu-west-1.compute.amazonaws.com

ubm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3035::6812:28f2 (United States)

ASN13335 (CLOUDFLARENET, US)

ins.techweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:7a00:18:1fcd:349:ca21 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2057:6e00:14:85db:2b40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

fpn.flipboard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

51 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.46.73 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-46-73.compute-1.amazonaws.com

assets.informa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.120.242.149 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-242-149.eu-central-1.compute.amazonaws.com

ads.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.215.103.126 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-103-126.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.177.85.121 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-177-85-121.eu-west-2.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 99.86.3.13 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-3-13.fra6.r.cloudfront.net

cache-ssl.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.156.100 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-156-100.muc51.r.cloudfront.net

img.lightreading.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.232.7 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-7.deploy.static.akamaitechnologies.com

a.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.62.118.225 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-118-225.deploy.static.akamaitechnologies.com

img.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:103::192:155:48:119 (United States)

ASN19994 (RACKSPACE, US)

ng.techweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.45.19.11 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-19-11.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.204.255.228 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-255-228.compute-1.amazonaws.com

track.celtra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ton.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.136 (United States) 1 redirects

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.0.160.13 (Ashburn, United States) 1 redirects

ASN7160 (NETDYNAMICS, US)

s657486201.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.167.231.17 (United States) 1 redirects

ASN7160 (NETDYNAMICS, US)
PTR: e017.en25.com

s2150.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.58.216.7 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-58-216-7.deploy.static.akamaitechnologies.com

t.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2606:2800:134:1a0d:1429:742:782:b6 (United States)

ASN15133 (EDGECAST, US)

pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.108.93 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-108-93.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.216 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-216.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.171.23.184 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-23-184.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.196.252.78 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-252-78.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.72.21 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 21.72.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.49.96.126 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-96-126.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.31.92.58 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-92-58.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.214.152.253 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-152-253.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.125.70.222 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
52	moatads.com z.moatads.com geo.moatads.com px.moatads.com	794 KB
48	deusm.com img.deusm.com	977 KB
46	celtra.com ads.celtra.com cache-ssl.celtra.com track.celtra.com	403 KB
22	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	574 KB
20	twimg.com cdn.syndication.twimg.com pbs.twimg.com ton.twimg.com	155 KB
14	doubleclick.net 1 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	106 KB
13	twimgs.com twimgs.com	154 KB
13	darkreading.com 1 redirects www.darkreading.com	140 KB
12	boltdns.net cf-images.us-east-1.prod.boltdns.net	53 KB
11	twitter.com 1 redirects platform.twitter.com syndication.twitter.com	112 KB
10	googletagservices.com www.googletagservices.com	262 KB
9	ml314.com 3 redirects ml314.com in.ml314.com	16 KB
7	adroll.com 1 redirects s.adroll.com d.adroll.com	47 KB
6	teads.tv a.teads.tv t.teads.tv sync.teads.tv	189 KB
5	eloqua.com 2 redirects s657486201.t.eloqua.com s2150.t.eloqua.com	3 KB
5	ubm-us.net i.ubm-us.net dsimg.ubm-us.net	58 KB
4	facebook.com www.facebook.com	278 B
4	facebook.net connect.facebook.net	255 KB
4	scorecardresearch.com 1 redirects sb.scorecardresearch.com	2 KB
4	flipboard.com 1 redirects cdn.flipboard.com fpn.flipboard.com	5 KB
3	eyeota.net 2 redirects ps.eyeota.net	2 KB
3	techweb.com ins.techweb.com ng.techweb.com	2 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	110 KB
3	demdex.net dpm.demdex.net ubm.demdex.net	2 KB
3	cmpnet.com i.cmpnet.com	67 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1 KB
2	adsrvr.org 2 redirects match.adsrvr.org	925 B
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	bing.com bat.bing.com	7 KB
2	heatmap.it u.heatmap.it	11 KB
2	google.de adservice.google.de www.google.de	892 B
2	omtrdc.net ubmtech.d3.sc.omtrdc.net	565 B
2	google.com www.google.com	746 B
2	ubembed.com 6600d6d98e534115970f9529a45f3195.js.ubembed.com assets.ubembed.com	47 KB
2	googleapis.com fonts.googleapis.com	1 KB
1	rlcdn.com 1 redirects idsync.rlcdn.com	389 B
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	ytimg.com s.ytimg.com	10 KB
1	youtube.com www.youtube.com	944 B
1	chartbeat.net ping.chartbeat.net	168 B
1	en25.com img.en25.com	3 KB
1	lightreading.com img.lightreading.com	374 B
1	informa.com assets.informa.com	12 KB
1	jquery.com code.jquery.com	33 KB
1	chartbeat.com static.chartbeat.com	14 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	linkedin.com platform.linkedin.com	55 KB
1	googleadservices.com www.googleadservices.com	10 KB
1	googletagmanager.com www.googletagmanager.com	28 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	rs6.net 1 redirects r20.rs6.net	432 B
0	adsnative.com Failed static.adsnative.com Failed
340	52

	Domain	Requested by
48	img.deusm.com	www.darkreading.com securepubads.g.doubleclick.net
43	px.moatads.com	www.darkreading.com
34	cache-ssl.celtra.com	ads.celtra.com www.darkreading.com
16	pbs.twimg.com	www.darkreading.com platform.twitter.com
15	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.darkreading.com tpc.googlesyndication.com
13	twimgs.com	www.darkreading.com securepubads.g.doubleclick.net
13	www.darkreading.com	1 redirects www.darkreading.com
12	cf-images.us-east-1.prod.boltdns.net	www.darkreading.com
12	securepubads.g.doubleclick.net	1 redirects www.googletagservices.com securepubads.g.doubleclick.net www.darkreading.com
11	track.celtra.com	www.darkreading.com
10	www.googletagservices.com	www.darkreading.com securepubads.g.doubleclick.net
9	platform.twitter.com	www.darkreading.com platform.twitter.com
8	ml314.com	3 redirects z.moatads.com ml314.com
8	z.moatads.com	securepubads.g.doubleclick.net
7	pagead2.googlesyndication.com	www.darkreading.com securepubads.g.doubleclick.net
5	s.adroll.com	1 redirects www.darkreading.com s.adroll.com
4	www.facebook.com	www.darkreading.com connect.facebook.net
4	connect.facebook.net	www.darkreading.com connect.facebook.net
4	sb.scorecardresearch.com	1 redirects www.darkreading.com
3	ps.eyeota.net	2 redirects
3	ton.twimg.com	platform.twitter.com www.darkreading.com
3	s2150.t.eloqua.com	1 redirects www.darkreading.com img.en25.com
3	a.teads.tv	securepubads.g.doubleclick.net a.teads.tv
3	i.cmpnet.com	www.darkreading.com
3	i.ubm-us.net	www.darkreading.com
2	sync.crwdcntrl.net	2 redirects
2	match.adsrvr.org	2 redirects
2	d.adroll.com
2	t.teads.tv	www.darkreading.com
2	s657486201.t.eloqua.com	1 redirects www.darkreading.com
2	syndication.twitter.com	1 redirects www.darkreading.com
2	fpn.flipboard.com	1 redirects www.darkreading.com
2	fonts.gstatic.com	www.darkreading.com
2	www.google-analytics.com	1 redirects www.googletagmanager.com
2	ins.techweb.com	www.darkreading.com ins.techweb.com
2	bat.bing.com	www.darkreading.com
2	u.heatmap.it	www.darkreading.com u.heatmap.it
2	ubmtech.d3.sc.omtrdc.net	i.cmpnet.com www.darkreading.com
2	cdn.flipboard.com	www.darkreading.com
2	www.google.com	dsimg.ubm-us.net www.darkreading.com
2	dpm.demdex.net	i.cmpnet.com www.darkreading.com
2	dsimg.ubm-us.net	www.darkreading.com
2	fonts.googleapis.com	www.darkreading.com
1	idsync.rlcdn.com	1 redirects
1	in.ml314.com	ml314.com
1	d.adroll.mgr.consensu.org	1 redirects
1	s.ytimg.com	www.youtube.com
1	www.youtube.com	www.darkreading.com
1	sync.teads.tv	a.teads.tv
1	cdn.syndication.twimg.com	platform.twitter.com
1	ping.chartbeat.net	www.darkreading.com
1	ng.techweb.com	www.darkreading.com
1	img.en25.com	www.darkreading.com
1	img.lightreading.com	www.darkreading.com
1	geo.moatads.com	z.moatads.com
1	ads.celtra.com	www.darkreading.com
1	stats.g.doubleclick.net	www.darkreading.com
1	assets.informa.com	securepubads.g.doubleclick.net
1	code.jquery.com	securepubads.g.doubleclick.net
1	www.google.de	www.darkreading.com
1	static.chartbeat.com	www.darkreading.com
1	ubm.demdex.net	i.cmpnet.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	adservice.google.de	www.googletagservices.com
1	www.gstatic.com	www.google.com
1	cm.everesttech.net	1 redirects
1	platform.linkedin.com	www.darkreading.com
1	www.googleadservices.com	www.darkreading.com
1	www.googletagmanager.com	www.darkreading.com
1	assets.ubembed.com	6600d6d98e534115970f9529a45f3195.js.ubembed.com
1	6600d6d98e534115970f9529a45f3195.js.ubembed.com	www.darkreading.com
1	maxcdn.bootstrapcdn.com	www.darkreading.com
1	r20.rs6.net	1 redirects
0	static.adsnative.com Failed	www.darkreading.com
340	74

This site contains links to these domains. Also see Links.

Domain
tech.informa.com
informa.com
www.informationweek.com
www.networkcomputing.com
ng.techweb.com
reports.informationweek.com
www.facebook.com
twitter.com
www.linkedin.com
flipboard.com
share.flipboard.com
adclick.g.doubleclick.net
blog.emsisoft.com
webinar.darkreading.com
webinar.informationweek.com
informationweek.com
www.enterpriseconnect.com
web.nvd.nist.gov
www.interop.com
www.itprotoday.com
www.datacenterknowledge.com
www.blackhat.com
info.wrightsmedia.com
privacyportal-eu-cdn.onetrust.com

Subject Issuer	Validity	Valid
darkreading.com CloudFlare Inc ECC CA-2	`2020-01-28` - `2020-10-09`	8 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
z.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-02-27` - `2020-08-07`	5 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
assets.ubembed.com Amazon	`2019-05-02` - `2020-06-02`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
*.flipboard.com DigiCert SHA2 High Assurance Server CA	`2019-11-02` - `2021-11-15`	2 years	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2021-10-14`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.d3.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2019-04-23` - `2020-04-14`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.prod.boltdns.net Amazon	`2019-12-19` - `2021-01-19`	a year	crt.sh
*.scorecardresearch.com Sectigo RSA Organization Validation Secure Server CA	`2019-12-16` - `2020-12-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-01-16` - `2020-04-15`	3 months	crt.sh
*.heatmap.it Sectigo RSA Domain Validation Secure Server CA	`2019-06-14` - `2020-06-26`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.chartbeat.com Gandi Standard SSL CA 2	`2019-04-10` - `2020-04-10`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
informa.com Amazon	`2019-05-21` - `2020-06-21`	a year	crt.sh
*.celtra.com Go Daddy Secure Certificate Authority - G2	`2018-05-15` - `2020-06-15`	2 years	crt.sh
*.ml314.com Amazon	`2020-02-17` - `2021-03-17`	a year	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
img.lightreading.com Amazon	`2019-02-21` - `2020-03-21`	a year	crt.sh
teads.tv Let's Encrypt Authority X3	`2020-01-08` - `2020-04-07`	3 months	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2019-06-21` - `2020-08-19`	a year	crt.sh
ng.techweb.com Let's Encrypt Authority X3	`2019-12-30` - `2020-03-29`	3 months	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2019-12-16` - `2020-12-30`	a year	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.t.eloqua.com DigiCert SHA2 Secure Server CA	`2019-01-14` - `2020-03-14`	a year	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2019-11-06` - `2020-12-06`	a year	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2020-02-10` - `2020-05-10`	3 months	crt.sh

This page contains 20 frames:

Primary Page: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Frame ID: 42009011FA858765251F9B5F386C2710
Requests: 224 HTTP requests in this frame

Frame: https://ubm.demdex.net/dest5.html?d_nsid=0
Frame ID: 95EAD3261D51C5A5B2A919CBDBA09777
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNiduiyliMNbeZohCU8cY0_XT5NxaHivO5AFOkVrdYXCMxBlXyswzx-btBYdN-_f7SC1jVFJxT9dJGTNz02vyWVn4whHHF77NpPy59Oqd_4gw6TEhDMj4lkVWcBD03tJzWxTrg6UJ3ihFdEmssgrBUDxaAa4nGDcoZ4lDvyKP4G6mGjOY_y5PeKpKkNvVpUmxdKdFN73RRCFmWAmIln7YF2d58i3xYOMlJeA-zMo2EPBZajUt9rcIOYDjSr2TKRuu2_-9Wq3J4JVcZ9VFNMNJxaLo1vJ0D8utQBaUmBQMl4xi2Bww7EQ&sai=AMfl-YQwilitUA6euEWoUJvf7QqOsA0_Fmrux9TPz3aJPcI93o6pZ43rdB4Da71lI3aXfxDj8TKAA3jnoeFY35MkxZfQVTJ64gBTxYklnuPYjg&sig=Cg0ArKJSzLbeDw8EbzITEAE&urlfix=1&adurl=
Frame ID: 6DC835FDA412A0F904C4D31B82602325
Requests: 15 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssJTvM44H-ZfksEQtli_QNq9PpE6fHq9BvN0HCRI2WpJ0MtLEToGe2Oi-cbAuViaVGMPQNjfd0KQ-7YvZVBoSh8SMOOVnLwMuqflpAJM_NSEhDs-j_B3Ycd_ocCD92zyeZbHU4EIagmflCG7jA75zY6UdpK8rXpQUoPpQsm5UU2SkT7hiqG2AN4C99dNqw6N35Q14t44Agw-H-4QCKCfb0swfmKhIT6T2eoUE1cxIvJtbI0-x1UF-Fiqu4pLKjHUJNn2ZmXDlgkNuPdIAZjbq5wa191E4rCko8eMKtr&sai=AMfl-YTs6YXYbWSmlDksQry1deXd4KvxilxCc0LOqZA_lDx--xQPzV9Thkm1oFY7eO7QQWny1dg2bYCQYx8u6ik5jU2KvSTQfFtrFLoGnHX6Qw&sig=Cg0ArKJSzKCSKi0Ob4LtEAE&urlfix=1&adurl=
Frame ID: 68300EE4BE4E5F63235D9F636183F8E4
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/error_handler.js
Frame ID: 99D2448516968B75293D615CE9D2D6F3
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuzWfsD68N_L_i1eeIJlP5VNTyc42Ev8Vi-ylrMTgSIIeJtoL0UFnkhVBUmIup8L2QgGddTq1PA2tOfrx2mjtvhA2tpLztgf6mL2upzP2BzGlvhHLsmyDZ_R_swQ68dKe6P_1_G_Dj5m7UdEHkeSWrEDVxnh0X94YMANKze2x8mB7sAezfUFbQRjq750-Q_ABOLZIpPZIzJjkdxjA7M1xn6EEPtBsvVYM3Ue7QTj0AsCfwgjp7DW4lv598_mpE-gZeO8DsBhlazvS2hraOZIBJ_dYBfwNPFW0c&sai=AMfl-YTAaWsZO4DIhoEbSrPzyHlerqocVTJppifKS7hq-PY5OGGX5o_a6vfkLbYuldvaiuEUatyR0fripxHrerkXopwOENAAYQrwTlzpKpzDBA&sig=Cg0ArKJSzI3lbJzRXUmvEAE&urlfix=1&adurl=
Frame ID: 03C8099464893ED72617FB2D4F42220A
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvcPGEkJWG2d2HQhmIH9Rr8gY3RC8D0tO6lPoVPBo8MittTulL2HfB3-Dilk_dLt1LtDfOxX-hqY9NM_EqwYRN1O0TR7KKQdOnXMzhe5E_DaVkTx-bfs_ljnODKnMm2BFvwSHApQ-nvEX4jRKjY88hAyzHLxa9w1wZiNN_Q9508oGjD-vfVOnKtT73iJ-MM6qA22U8NxjETB_a_WIhM0Q50_8Je0rqijiz9DswGyVMuzQOggzZmGIeDqTcxIE-1vquGZNYjM8TvOs3HdHIr0evWKO76XPrH2G78&sai=AMfl-YSyezlPdm_IoBFLeM9AxW1XWzCUolZyJabogCuCIJtV00cNcoA5bwUJ1JiDAgj8C2rfYCQfUxD1G8BdWVNpsFtMtINgOEyRqMcgtY2mIg&sig=Cg0ArKJSzHpX0H8LAsL6EAE&urlfix=1&adurl=
Frame ID: 0B8C8D38185FB4F4154D41BE6BAEE13D
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/error_handler.js
Frame ID: 7B87D81F3B5D9323D56FB19D9C11C8C1
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/error_handler.js
Frame ID: CD341AFA5D005227968868F24C4B0245
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst-AiwVb3KpQvidlXZ70wgASstyIyP1FcnPqNISMMfOWZmL3T9QbxMjujp1f9iN7V9pxYIxXqVUJ31bK8w8soPQhbECntohyVIYVvmox-bo0CSBnPbrqY3erZ2op5N3zuSN79DL51gAS5n5veeAGhWXM6MKqVXF9JxMWSh7oZIKLyW3TaD4sUYL2uao4EJquQHx3rT4vqLTnFvMl7mX4163F9TJ4IVcqWtLB1nWUzsqsQ_XgL-Mnt6PjDycu7gs0YUkTe5ayXRN_uCTA6bEh1zZq6eYjA&sai=AMfl-YQELjD975eIj6GLri-Q8rWaRbPcO0OdgZH3cMwjwiDXBwTyZ6deo27GBpYd3HSWadddRNf5cnuLiIB835G7TCiWenbWFGEllP1Mg_lPdA&sig=Cg0ArKJSzGrniUnShfjUEAE&urlfix=1&adurl=
Frame ID: 84796A09527079D1AFC1DCD7D74DCCBF
Requests: 5 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.0ab153032b20288d9a500659d8c7ba17.html?origin=https%3A%2F%2Fwww.darkreading.com
Frame ID: 893758E94C9032EEB9DA3CA63524E7EF
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D46%23cb%3Df1124314c070434%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff21144df00fb5c%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
Frame ID: 723175C806132BD4533783C3C55E3B64
Requests: 1 HTTP requests in this frame

Frame: https://ins.techweb.com/beacon/record.do?a=68841bbbf037b3bd9eda236cfd0edcb96932f665438d7b833aaa994d869277ac&u=https%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fnew-ransomware-variant-developed-entirely-as-shellcode%252Fd%252Fd-id%252F1337260&t=P
Frame ID: 73D67FADFE08D856A61861E5A8F808BB
Requests: 1 HTTP requests in this frame

Frame: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Frame ID: 28C953CD88BB02C6C2B80E0DF0400F6B
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.0ab153032b20288d9a500659d8c7ba17.en.html
Frame ID: 51B44A908BB0B7D9D85D0C0EF0DC1CB4
Requests: 1 HTTP requests in this frame

Frame: https://pbs.twimg.com/card_img/1233570617380593664/0X-1-Men?format=jpg&name=144x144_2
Frame ID: BF87B3189D3A878545FA5021B042C724
Requests: 22 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Lato:400&text=%20BCDEGILMORSUVadeor
Frame ID: 58BC387DA41C2F17EE79FEA42F481D4F
Requests: 37 HTTP requests in this frame

Frame: https://sync.teads.tv/iframe?pid=21882&userId=8f0bd3fc-1ee3-4a49-b64c-0a8efa5428ba&gdprIab={%22status%22:22,%22consent%22:%22%22,%22reason%22:220}&fromFormat=true&env=js-web&1583774708024
Frame ID: D726A7C65021F98E304FFAE256D85F07
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: ACD169D4CE586B9B4058BC7F566C3259
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 8B1373A96C895B5E0096FD831C4D9FAD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://r20.rs6.net/tn.jsp?f=001fyY3GovbKBvDiIWwViUve-oqQg-FbocuC--vmTujzpvyPqDnvkLV2rjv7Vc1PVFr... HTTP 302
https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-... Page URL

Detected technologies

Unbounce (Editors) Expand

Overall confidence: 100%
Detected patterns

script /ubembed\.com/i

Chartbeat (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /chartbeat\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

SiteCatalyst (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\/s[_-]code.*\.js/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

340
Requests

99 %
HTTPS

47 %
IPv6

52
Domains

74
Subdomains

64
IPs

8
Countries

4742 kB
Transfer

10759 kB
Size

0
Cookies

54 Outgoing links

These are links going to different origins than the main page.

URL: https://tech.informa.com/cookie-policy
Title: our use of cookies.

Search URL Search Domain Scan URL

URL: https://informa.com/
Title: Informa PLC

Search URL Search Domain Scan URL

URL: https://informa.com/About-Us/
Title: About us

Search URL Search Domain Scan URL

URL: https://informa.com/Investors/
Title: Investor relations

Search URL Search Domain Scan URL

URL: https://informa.com/Talent/
Title: Talent

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/

Search URL Search Domain Scan URL

URL: https://www.networkcomputing.com/
Title: Network Computing

Search URL Search Domain Scan URL

URL: https://ng.techweb.com/authds/gateway?gateway=true&return=https%3A%2F%2Fwww%2Edarkreading%2Ecom%2Fattacks%2Dbreaches%2Fnew%2Dransomware%2Dvariant%2Ddeveloped%2Dentirely%2Das%2Dshellcode%2Fd%2Fd%2Did%2F1337260%3FngAction%3Dregister
Title: Register

Search URL Search Domain Scan URL

URL: https://reports.informationweek.com/search?search=security
Title: Reports

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/Security
Title: White Papers

Search URL Search Domain Scan URL

URL: https://www.facebook.com/darkreadingcom
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/DarkReading
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/dark-reading/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://flipboard.com/@DarkReading?utm_campaign=tools&utm_medium=follow&action=follow

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper
Title: Tech Library

Search URL Search Domain Scan URL

URL: https://twitter.com/jaivijayan

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/jaivijayan

Search URL Search Domain Scan URL

URL: https://share.flipboard.com/bookmarklet/popout?v=2&title=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&t=1583774706791&utm_campaign=tools&utm_medium=article-share&utm_source=www.darkreading.com

Search URL Search Domain Scan URL

URL: https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsuxsWYGQjpdncWQ61ETzvzsmk9OvEc1nROzqtLyUJwDhQZM77xdolI5Xzt4QkbUiFxG3pZc94X16JUkvGu-z7SS5LsCAbwGSEZFJwoVQzXoseEf6LRv_HX8C2gxeZtrkMSi72B6dWerR_7zuGYGEEFCYCzL1DXrtWv24HCZ_Eo396OM3S3OvEP2SGdCixo4KPVIttIDEoB5_DClUKPaXcEBNlsvpLfd8ZE__GSDsuqNYy_QiBWUxsp41OPU5apUIsheah5zm39lSiICDVJl_B_2jsY%2526sai%253DAMfl-YTp3yQu6pkYkoPJ0uw3MiczutW6tRXNS1RkcmRq9p8Cxo2pbBavFwrl3Kyvzqo7JIUy-KSTmHySqGMZZmyoYYCgW6rc9ltyWxljl8KH1A%2526sig%253DCg0ArKJSzBHEZZXr1t9QEAE%2526urlfix%253D1%2526adurl%253Dhttps://www.darkreading.com/endpoint/is-smishing-the-new-back-door/d/d-id/1337179

Search URL Search Domain Scan URL

URL: https://blog.emsisoft.com/en/35879/pwndlocker-ransomware-decryption-now-available/
Title: said

Search URL Search Domain Scan URL

URL: https://webinar.darkreading.com/5775?keycode=sbx&cid=smartbox_techweb_webcast_8.500000931
Title: Zero-Trust In Practice

Search URL Search Domain Scan URL

URL: https://webinar.informationweek.com/5804?keycode=sbx&cid=smartbox_techweb_webcast_8.500000930
Title: The 6 Must-Haves for Practical Cloud Security

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/security/big-data-analytics/it-careers-tech-drives-constant-change/414453?cid=smartbox_techweb_whitepaper_14.500003868
Title: IT Careers: How to Keep up With an Every-Changing Job Market

Search URL Search Domain Scan URL

URL: https://informationweek.com/whitepaper/security-management-and-analytics/cybersecurity/state-of-cybersecurity-incident-response/414083?cid=smartbox_techweb_analytics_7.300005794
Title: State of Cybersecurity Incident Response

Search URL Search Domain Scan URL

URL: https://informationweek.com/whitepaper/cybersecurity/risk-management-security/assessing-cybersecurity-risk-in-today's-enterprise/411573?cid=smartbox_techweb_analytics_7.300005784
Title: Assessing Cybersecurity Risk in Today's Enterprise

Search URL Search Domain Scan URL

URL: https://www.enterpriseconnect.com/orlando?_smbx&cid=smartbox_techweb_session_16.500220
Title: Get Insights: Cisco vs Microsoft & More at EC20 Orlando

Search URL Search Domain Scan URL

URL: https://webinar.darkreading.com/5722?keycode=sbx&cid=smartbox_techweb_webcast_8.500000935
Title: Shaking Off Security Alert Fatigue: Tips for Taking Control

Search URL Search Domain Scan URL

URL: https://webinar.informationweek.com/5876?keycode=sbx&cid=smartbox_techweb_webcast_8.500000934
Title: The ROI Story: Identifying & Justifying Disruptive Technology

Search URL Search Domain Scan URL

URL: https://webinar.informationweek.com/5836?keycode=sbx&cid=smartbox_techweb_webcast_8.500000933
Title: Shifting Security from Speedbump to Digital Accelerator

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/security-management-and-analytics/security-monitoring/maximize-the-roi-of-detection-and-response/414623?cid=smartbox_techweb_whitepaper_14.500003882
Title: Maximize the ROI of Detection and Response

Search URL Search Domain Scan URL

URL: https://informationweek.com/whitepaper/network-and-perimeter-security/security-management-and-analytics/esg-whitepaper-assessing-network-traffic-analysis-(nta)-requirements/414573?cid=smartbox_techweb_whitepaper_14.500003874
Title: ESG Whitepaper: Assessing Network Traffic Analysis (NTA) Requirements

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/smb-security/cybersecurity/smb's-guide-to-modern-identity/414823?cid=smartbox_techweb_whitepaper_14.500003872
Title: SMB's Guide to Modern Identity

Search URL Search Domain Scan URL

URL: https://informationweek.com/whitepaper/security-management-and-analytics/cybersecurity/state-of-cybersecurity-incident-response/414083?cid=mp_rptbx&_mc=mp_rptbx

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/security-monitoring/how-enterprises-are-developing-and-maintaining-secure-applications/413993?cid=mp_rptbx&_mc=mp_rptbx
Title: How Enterprises Are Developing and Maintaining Secure Applications

Search URL Search Domain Scan URL

URL: https://informationweek.com/whitepaper/cybersecurity/security-management-and-analytics/how-enterprises-are-attacking-the-cybersecurity-problem-2019/413163?cid=mp_rptbx&_mc=mp_rptbx
Title: How Enterprises are Attacking the Cybersecurity Problem

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/database-security/how-data-breaches-affect-the-enterprise/412603?cid=mp_rptbx&_mc=mp_rptbx
Title: How Data Breaches affect the Enterprise

Search URL Search Domain Scan URL

URL: https://www.informationweek.com/whitepaper/cybersecurity/database-security/how-data-breaches-affect-the-enterprise/412603?cid=mp_rptbx&_mc=mp_rptbx#msgs
Title: 0 comments

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-4217
Title: CVE-2020-4217

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7344
Title: CVE-2015-7344

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7968
Title: CVE-2015-7968

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9282
Title: CVE-2020-9282

Search URL Search Domain Scan URL

URL: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7343
Title: CVE-2015-7343

Search URL Search Domain Scan URL

URL: https://www.interop.com/
Title: Interop

Search URL Search Domain Scan URL

URL: https://www.itprotoday.com/
Title: IT Pro Today

Search URL Search Domain Scan URL

URL: https://www.datacenterknowledge.com/
Title: Data Center Knowledge

Search URL Search Domain Scan URL

URL: https://www.blackhat.com/
Title: Black Hat

Search URL Search Domain Scan URL

URL: https://info.wrightsmedia.com/licensing-reprints-request
Title: Reprints

Search URL Search Domain Scan URL

URL: https://tech.informa.com/
Title: Home

Search URL Search Domain Scan URL

URL: https://privacyportal-eu-cdn.onetrust.com/dsarwebform/c1f53e84-9f05-4169-a854-85052b63c50b/5f26b553-52cc-4973-a761-295d5634a6b6.html
Title: CCPA: Do not sell my personal info

Search URL Search Domain Scan URL

URL: https://tech.informa.com/privacy-policy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://tech.informa.com/terms-and-conditions
Title: Terms

Search URL Search Domain Scan URL

URL: http://twitter.com/share/?text=&url=%3Ff%5Fsrc%3Dthissite%5Ftweetlink
Title: Tweet This

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://r20.rs6.net/tn.jsp?f=001fyY3GovbKBvDiIWwViUve-oqQg-FbocuC--vmTujzpvyPqDnvkLV2rjv7Vc1PVFryXpOu7Mj85ElxN0YMT00LgrDcCEQx-NCW68iPP6pL-fHXEpQPSyhKf36py7ajv8i6OPnq7qjlxKFvmKmOC2M2LrXPm9-cULpyzHtLgA62zs8Y60Si6xtQcy6XvTMrTQWHZ54iEKnE5MKkXNsHxgtv3OW6UVHUkPkw5EdRb068ZFWcjSMo5lgY2FeEQed0SZJxmHwrsMiHfmdyLe5GWdhBw==&c=z2N6WpK56tPmMyP6UwmSBaQmhLZu1l8R6C4IXjMelBSMLkHuEEB7yw==&ch=mghepQ50mEB9C6aNCyojc9of1mNpUYECO3zQ08ZryrQ0dhNa7bR8Pg== HTTP 302
https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64

https://cm.everesttech.net/cm/dd?d_uuid=38061357557653343190689918408300372308 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XmZ78gAAAbwa4xTJ

Request Chain 107

https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F314&f=%2Fdarkreading%2Fsection%2F314%2F1337260&rndserial=48306 HTTP 302
https://img.deusm.com/images/spacer.gif

Request Chain 113

https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1583774706755&ns_c=windows-1252&cv=3.5&c8=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1583774706755&ns_c=windows-1252&cv=3.5&c8=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&c9=

Request Chain 129

https://fpn.flipboard.com/pix/__fpn.gif?utm_source=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260 HTTP 307
https://fpn.flipboard.com/tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fattacks-breaches%25252Fnew-ransomware-variant-developed-entirely-as-shellcode%25252Fd%25252Fd-id%25252F1337260&rh=https%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fnew-ransomware-variant-developed-entirely-as-shellcode%252Fd%252Fd-id%252F1337260

Request Chain 135

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNiduiyliMNbeZohCU8cY0_XT5NxaHivO5AFOkVrdYXCMxBlXyswzx-btBYdN-_f7SC1jVFJxT9dJGTNz02vyWVn4whHHF77NpPy59Oqd_4gw6TEhDMj4lkVWcBD03tJzWxTrg6UJ3ihFdEmssgrBUDxaAa4nGDcoZ4lDvyKP4G6mGjOY_y5PeKpKkNvVpUmxdKdFN73RRCFmWAmIln7YF2d58i3xYOMlJeA-zMo2EPBZajUt9rcIOYDjSr2TKRuu2_-9Wq3J4JVcZ9VFNMNJxaLo1vJ0D8utQBaUmBQMl4xi2Bww7EQ&sai=AMfl-YQwilitUA6euEWoUJvf7QqOsA0_Fmrux9TPz3aJPcI93o6pZ43rdB4Da71lI3aXfxDj8TKAA3jnoeFY35MkxZfQVTJ64gBTxYklnuPYjg&sig=Cg0ArKJSzLbeDw8EbzITEAE&urlfix=1&adurl=https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnhK7w9QEQARgBMgil1qRvp9Nq6w HTTP 302
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnhK7w9QEQARgBMgil1qRvp9Nq6w

Request Chain 150

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=137718984&t=pageview&_s=1&dl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&ul=en-us&de=windows-1252&dt=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IAhAAUAB~&jid=494896170&gjid=780852929&cid=2079498175.1583774707&tid=UA-135180592-2&_gid=1576022913.1583774707&_r=1&gtm=2ou2q2&z=927186576 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-135180592-2&cid=2079498175.1583774707&jid=494896170&_gid=1576022913.1583774707&gjid=780852929&_v=j81&z=927186576

Request Chain 209

https://s657486201.t.eloqua.com/visitor/v200/svrGP?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=826&firstPartyCookieDomain=trk.darkreading.com HTTP 302
https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=826&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1

Request Chain 210

https://s2150.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=826&optin=disabled&firstPartyCookieDomain=trk.darkreading.com HTTP 302
https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=826&optin=disabled&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1

Request Chain 301

https://s.adroll.com/j/exp/TQSV74R4GVCSJITSZC2MCP/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 303

https://d.adroll.mgr.consensu.org/consent/iabcheck/TQSV74R4GVCSJITSZC2MCP?_s=e49f839811b65b461156b3cff09f35dd&_b=2 HTTP 302
https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=e49f839811b65b461156b3cff09f35dd&_b=2

Request Chain 315

https://syndication.twitter.com/i/jot HTTP 302
https://platform.twitter.com/jot.html

Request Chain 323

https://idsync.rlcdn.com/395886.gif?partner_uid=3608741126981812256 HTTP 307
https://ml314.com/csync.ashx?fp=ba9934ec1fecbe5d526d9c07f72158b2bd8b36bc4a9bdf3f7e606211ff80e59cf4cb09cee1a4f8eb&person_id=3608741126981812256&eid=50082

Request Chain 324

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=6cb18a0f-41f1-4264-b710-1b1a57f0bd93 HTTP 302
https://ml314.com/csync.ashx?fp=6cb18a0f-41f1-4264-b710-1b1a57f0bd93&person_id=3608741126981812256&eid=53819

Request Chain 325

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3608741126981812256 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3608741126981812256 HTTP 302
https://ml314.com/csync.ashx?fp=85947e48c022abdd7c9de4bd0e43733c&eid=50146&person_id=3608741126981812256

Request Chain 326

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=27k9imymVZhrvQ77Vlw-VX70X83nA67UkBa-Egy5JhFE&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
https://ml314.com/csync.ashx?fp=27k9imymVZhrvQ77Vlw-VX70X83nA67UkBa-Egy5JhFE&person_id=3608741126981812256&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

340 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 1337260 Show response
www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/
Redirect Chain

http://r20.rs6.net/tn.jsp?f=001fyY3GovbKBvDiIWwViUve-oqQg-FbocuC--vmTujzpvyPqDnvkLV2rjv7Vc1PVFryXpOu7Mj85ElxN0YMT00LgrDcCEQx-NCW68iPP6pL-fHXEpQPSyhKf36py7ajv8i6OPnq7qjlxKFvmKmOC2M2LrXPm9-cULpyzHtLg...
https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

158 KB
29 KB

699ms
680ms

Document
text/html

2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

8e2a7a86808b4525f0ec38407f1546fd1402a11a801419b3d16bb278448ec5da

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

:method: GET
:authority: www.darkreading.com
:scheme: https
:path: /attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Mon, 09 Mar 2020 17:25:06 GMT
content-type: text/html
set-cookie: __cfduid=d48f751bfe5b5d3b1731657f9b6c18dd01583774705; expires=Wed, 08-Apr-20 17:25:05 GMT; path=/; domain=.darkreading.com; HttpOnly; SameSite=Lax darkreading_lastvisit=3/9/2020 1:25:06 PM; expires=Fri, 09-Mar-2035 17:25:6 GMT; path=/; HttpOnly darkreading_lastvisit=3/9/2020 1:25:06 PM; expires=Fri, 09-Mar-2035 17:25:6 GMT; path=/; HttpOnly cplChannelTagID=; path=/; secure darkreading%2Dmeter=1337260; expires=Tue, 10-Mar-2020 04:00:00 GMT; path=/ darkreading%5Fvisits=2; expires=Fri, 09-Mar-2035 05:00:00 GMT; path=/ gatewayChecked=; path=/; secure
vary: Accept-Encoding
cache-control: private
x-pingback: http://www.staging.new.informationweek.com/xmlrpc.asp
x-powered-by: ASP.NET
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 57167e4618be3237-FRA
content-encoding: gzip

Redirect headers

Date: Mon, 09 Mar 2020 17:25:05 GMT
Server: Apache
P3P: CP="CAO DSP TAIa OUR NOR UNI"
Location: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Content-Length: 0
Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate, no-cache="Set-Cookie"
Pragma: no-cache
Connection: close
Content-Type: text/html;charset=ISO-8859-1

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 12ms
6ms Stylesheet
text/css 2001:4de0:ac19::1:b:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
access-control-allow-origin: *
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 7050

GET
H2 200 common-footer.css
twimgs.com/nojitter/css/ 9 KB
2 KB 59ms
18ms Stylesheet
text/css 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/common-footer.css?
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eea91bd1f33507891a2909689d21be3a6e0fb1b688037c2a7d59c042503d910

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 09 Jan 2020 06:37:35 GMT
server: cloudflare
age: 2151
etag: W/"23cf-59baf3e93a9c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 57167e4a991e1f1d-FRA

GET
H2 200 css
fonts.googleapis.com/ 2 KB
672 B 20ms
15ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab:700

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

549f49487512850a6147e411ca138deb4d69f5b370e636147619992b45c77c2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 09 Mar 2020 17:25:06 GMT
server: ESF
date: Mon, 09 Mar 2020 17:25:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 darkreading.css
twimgs.com/nojitter/css/ 17 KB
3 KB 62ms
20ms Stylesheet
text/css 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/darkreading.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf167be72549318f78f8c03d0d93b923f8e8e290acec47b870a1cede920e859b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 09:38:14 GMT
server: cloudflare
age: 1699
etag: W/"45f8-54e22b7428d80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 57167e4a991f1f1d-FRA

GET
H2 200 pano-framework.css
www.darkreading.com/styles/ 128 KB
10 KB 25ms
20ms Stylesheet
text/css 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/styles/pano-framework.css?v1.27

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

a78d1a014ffb73ea1788d562070f9de9145793b25ebfb1d9e44b1ae3eb843b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 7055
x-powered-by: ASP.NET
status: 200
strict-transport-security: max-age=63072000; includeSubDomains
last-modified: Tue, 07 Jan 2020 07:22:37 GMT
server: cloudflare
etag: W/"8d7543d2bc5d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 57167e4a68023237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 styles.css
www.darkreading.com/styles/ 292 B
311 B 28ms
23ms Stylesheet
text/css 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/styles/styles.css?v7

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

a8fc74838ba253a4076b8eb46aeed79c10341380609dcfe11bed40d974d1fd10

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3385
x-powered-by: ASP.NET
status: 200
strict-transport-security: max-age=63072000; includeSubDomains
last-modified: Mon, 03 Apr 2017 14:07:01 GMT
server: cloudflare
etag: W/"d632e39083acd21:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 57167e4a68073237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 dr_nativead.css
i.ubm-us.net/oas/nativead/css/ 2 KB
929 B 57ms
16ms Stylesheet
text/css 2606:4700:3035::6818:7875
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/css/dr_nativead.css?v3
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7875 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5932acd6c5f2796f354dedc5e8dfe30e206787365186bbf0f9789d083472a75

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Feb 2019 18:48:56 GMT
server: cloudflare
age: 1699
etag: W/"861-5813e2d913600"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-polished: origSize=2145
cf-ray: 57167e4a98161e47-FRA
cf-bgj: minify

GET
H2 200 nativead.js Show response
i.ubm-us.net/oas/nativead/js/ 1 KB
469 B 77ms
36ms Script
application/javascript 2606:4700:3035::6818:7875
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/js/nativead.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7875 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 984cd1fa5dd20c2b1b8fd77b6bb876a3a211cdf14aaaed6bc1481e3c98027544

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 30 Jul 2015 14:31:41 GMT
server: cloudflare
age: 28618
cf-polished: origSize=1373
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4a98211e47-FRA
cf-bgj: minify

GET
H2 200 dr_nativead.js Show response
i.ubm-us.net/oas/nativead/js/ 8 KB
1 KB 70ms
29ms Script
application/javascript 2606:4700:3035::6818:7875
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ubm-us.net/oas/nativead/js/dr_nativead.js?v3
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7875 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b309c9c4a6c27c7cfc64ab2bc7f545e8d7b41a795c46202ab2a9c633f7128287

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 06 Oct 2017 16:50:20 GMT
server: cloudflare
age: 86091
cf-polished: origSize=8434
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4a98251e47-FRA
cf-bgj: minify

GET
H2 200 respond.min.js Show response
www.darkreading.com/script/ 4 KB
2 KB 31ms
26ms Script
application/x-javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/respond.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

cf7bdb0487590885c13a3cc0a2a1450b3ac649a465de267af12f552be8bcb5fe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3860
x-powered-by: ASP.NET
status: 200
last-modified: Mon, 22 Sep 2014 21:04:30 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"03ccda8d6cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=7200
cf-ray: 57167e4a680b3237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 jquery.mobile.custom.min.js Show response
www.darkreading.com/script/ 8 KB
3 KB 26ms
21ms Script
application/x-javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/jquery.mobile.custom.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

b4cf7d6d50b6a36f070f6c49e975198a9a8930838695b64e480bf1f6199f0572

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5427
x-powered-by: ASP.NET
status: 200
last-modified: Mon, 22 Sep 2014 21:04:30 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"03ccda8d6cf1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=7200
cf-ray: 57167e4a680d3237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 complete.js Show response
twimgs.com/nojitter/js/ 45 KB
9 KB 59ms
19ms Script
application/javascript 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/complete.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8420f59cd348cf0e10e05482724523ad6b83f88467bbfacf6826eaadd3a03985

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 06:04:53 GMT
server: cloudflare
age: 34896
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4a992b1f1d-FRA

GET
H2 200 jquery_3.4.1.js Show response
www.darkreading.com/script/ 284 KB
82 KB 34ms
30ms Script
application/x-javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/jquery_3.4.1.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2521
x-powered-by: ASP.NET
status: 200
strict-transport-security: max-age=63072000; includeSubDomains
last-modified: Wed, 19 Feb 2020 05:10:50 GMT
server: cloudflare
etag: W/"d821f2f3e2e6d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=7200
cf-ray: 57167e4a68123237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 darkreading.js Show response
www.darkreading.com/script/ 27 KB
4 KB 31ms
26ms Script
application/x-javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/darkreading.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

0128cd161adbfcff922002fefc5a391c4996ddb28a690f5063c620359c0f62f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3860
x-powered-by: ASP.NET
status: 200
strict-transport-security: max-age=63072000; includeSubDomains
last-modified: Fri, 28 Feb 2020 06:47:19 GMT
server: cloudflare
etag: W/"a5e61aec2eed51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=7200
cf-ray: 57167e4a68193237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 VisitorAPI.js Show response
i.cmpnet.com/s_code/ 45 KB
14 KB 74ms
33ms Script
application/javascript 2606:4700:3032::681b:9174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.cmpnet.com/s_code/VisitorAPI.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:9174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa92b44ae441805b86a9603ffea3890a8df348fb2269d716c557b6970c11e9f4

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 12 Feb 2020 19:20:49 GMT
server: cloudflare
age: 37084
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4a9962dfdf-FRA

GET
H2 200 at.js Show response
i.cmpnet.com/s_code/ 106 KB
33 KB 68ms
28ms Script
application/javascript 2606:4700:3032::681b:9174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.cmpnet.com/s_code/at.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:9174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42eb48be2f9f6fc91fcda10af9802cb6aa0733e2dd007c224570ae6ece3dac33

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 12 Feb 2020 19:20:49 GMT
server: cloudflare
age: 36838
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4a9964dfdf-FRA

GET
H2 200 informa-iribbon.css
img.deusm.com/darkreading/ 2 KB
1 KB 61ms
21ms Stylesheet
text/css 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.deusm.com/darkreading/informa-iribbon.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ae4b8548f250831a2443bd449af625f6331b7c72e1f408789642a3050596d45

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 25 Apr 2019 07:05:41 GMT
server: cloudflare
age: 740
etag: W/"cea-58755722bdb40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=3306
cf-ray: 57167e4a994f97a2-FRA
cf-bgj: minify

GET
H2 200 informa-iribbon.js Show response
img.deusm.com/darkreading/ 489 B
291 B 61ms
21ms Script
application/javascript 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.deusm.com/darkreading/informa-iribbon.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb295c2a72d39784b18a1d2d5b0c9976807f7cf010fe730b86d43bc55b0ae251

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 25 Apr 2019 07:05:52 GMT
server: cloudflare
age: 4062
etag: W/"229-5875572d3b400"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-polished: origSize=553
cf-ray: 57167e4a995197a2-FRA
cf-bgj: minify

GET
H2 200 cookie_banner.js Show response
www.darkreading.com/script/ 2 KB
789 B 39ms
35ms Script
application/x-javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/cookie_banner.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

020d8d4a55a5f088527c3c75c3ac4920b8f190393f841071d6f3d00807e07abc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5478
x-powered-by: ASP.NET
status: 200
last-modified: Mon, 06 Jan 2020 08:32:43 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"b753a1dd6bc4d51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=7200
cf-ray: 57167e4a681d3237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 / Show response
6600d6d98e534115970f9529a45f3195.js.ubembed.com/ 2 KB
1 KB 57ms
8ms Script
application/json 151.101.113.131
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://6600d6d98e534115970f9529a45f3195.js.ubembed.com/
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.131 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0c7fe4b707e153435add875b62934624b6714a03ae370b26af724eef1eb01f9b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
x-backend-region: eu_west_1
age: 5625
etag: cfa76287dad871e1fb4f4552f84cffc6-v0.178.1
vary: Accept-Encoding
x-cache: Miss from cloudfront, HIT
content-type: application/json
status: 200
cache-control: max-age=0, must-revalidate
access-control-allow-origin: *
x-amz-cf-pop: FRA6-C1
accept-ranges: none
x-amz-apigw-id: JGTFGGp5DoEFr3w=

GET
H2 200 jplayer.blue.monday.css
twimgs.com/nojitter/css/ 12 KB
3 KB 59ms
20ms Stylesheet
text/css 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/jplayer.blue.monday.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a4f12795a11d0957a7e476cdd2516967e3e00f54841456fbd8c0dd607984d92

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 07:28:28 GMT
server: cloudflare
age: 152
etag: W/"2f89-54ec1d5e89f00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 57167e4a99251f1d-FRA

GET
H2 200 style.css
twimgs.com/nojitter/css/ 912 B
397 B 59ms
20ms Stylesheet
text/css 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/style.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a08be5766c0e198ba8171f7decd09065c08a5c850276325cc1792f25e7b356e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 May 2017 07:30:36 GMT
server: cloudflare
age: 4266
etag: W/"390-54ec1dd89bf00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 57167e4a99271f1d-FRA

GET
H2 200 jquery.jplayer.min.js Show response
twimgs.com/nojitter/js/ 48 KB
11 KB 61ms
22ms Script
application/javascript 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery.jplayer.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cddbf405266cd4b3e66229592e63666012dbceaaad02635af5da9d303bfd3ed1

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 11:20:55 GMT
server: cloudflare
age: 28543
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4a99321f1d-FRA

GET
H2 200 jquery.tablesorter.min.js Show response
twimgs.com/nojitter/js/ 16 KB
5 KB 86ms
47ms Script
application/javascript 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/js/jquery.tablesorter.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b90279154254e108748dc80dd226eab336e2c320e4a40569952b46dc5d785536

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Apr 2017 11:21:05 GMT
server: cloudflare
age: 28543
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4a99311f1d-FRA

GET
H2 200 ubm-widget-style.css
dsimg.ubm-us.net/ubm-widget/css/ 29 KB
5 KB 60ms
20ms Stylesheet
text/css 2606:4700:3035::6818:7875
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dsimg.ubm-us.net/ubm-widget/css/ubm-widget-style.css
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7875 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6414656f939f73a463499bd2c5a8f75793658adf6e05d0e4cd61d1ba36636b94

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 11 Apr 2018 16:31:21 GMT
server: cloudflare
age: 3639
etag: W/"7393-569952b4c0840"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-polished: origSize=29587
cf-ray: 57167e4a9a331f11-FRA
cf-bgj: minify

GET
H2 200 ubm-widget-min.js Show response
dsimg.ubm-us.net/ubm-widget/js/ 192 KB
50 KB 86ms
46ms Script
application/javascript 2606:4700:3035::6818:7875
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7875 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffcaeef328a1e67717f714997426aaf936e4b9d378a5fbe1bd2a063dfeb50750

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 11 Apr 2018 17:29:33 GMT
server: cloudflare
age: 5639
etag: W/"2fe99-56995fb6fbbe3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 57167e4a9a3a1f11-FRA

GET
H2 200 ng_forms.js Show response
www.darkreading.com/script/ 31 KB
7 KB 40ms
36ms Script
application/x-javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/script/ng_forms.js?v7.9

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

ccb577fe731d9954057d10cd6d941eef90e15af6d1b0e4b1469f0ad3af3e84e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5478
x-powered-by: ASP.NET
status: 200
strict-transport-security: max-age=63072000; includeSubDomains
last-modified: Wed, 09 Oct 2019 11:57:33 GMT
server: cloudflare
etag: W/"28b83cbc987ed51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=7200
cf-ray: 57167e4a68253237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 widget-extra.css
twimgs.com/nojitter/css/ 443 B
298 B 57ms
19ms Stylesheet
text/css 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://twimgs.com/nojitter/css/widget-extra.css?v1
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61494fd1b573b217034bef7e22044bda91962797d68efada6726910d32bb995b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 13 Sep 2017 07:28:37 GMT
server: cloudflare
age: 1884
etag: W/"1bb-5590d1ba81340"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 57167e4a99281f1d-FRA

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 362 B
1 KB 36ms
35ms XHR
application/json 108.128.171.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=77FB1CFE532B22840A490D45%40AdobeOrg&d_nsid=0&ts=1583774706390

Requested by

Host: i.cmpnet.com
URL: https://i.cmpnet.com/s_code/VisitorAPI.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.128.171.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-108-128-171-217.eu-west-1.compute.amazonaws.com

Software

Resource Hash

726209d3c6b425ecf1d7595ddac0381cb5d63daf5d53b62eb29c50b130075c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Origin: https://www.darkreading.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v062-013b6c16d.edge-irl1.demdex.com 5.65.0.20200212140016 3ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: BoJyOa+VT+A=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.darkreading.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 301
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 bundle.js Show response
assets.ubembed.com/universalscript/releases/v0.178.1/ 162 KB
46 KB 42ms
17ms Script
application/javascript 52.222.149.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.ubembed.com/universalscript/releases/v0.178.1/bundle.js
Requested by: Host: 6600d6d98e534115970f9529a45f3195.js.ubembed.com
URL: https://6600d6d98e534115970f9529a45f3195.js.ubembed.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.149.68 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-149-68.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: df25786bc3951d78d0f763a2a75a1f33b01b8ae2a5157831d2cf4d0348c2ede7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 11 Dec 2019 22:46:22 GMT
content-encoding: gzip
last-modified: Wed, 11 Dec 2019 22:14:50 GMT
server: AmazonS3
age: 7670325
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53
x-amz-cf-id: sSxkJA0jbT-VfJL6P3CrRNdcLyLw1xFRGAQqHLS20uMAPH9uvTwjNg==
via: 1.1 c0486ca54d4ad5a3da496bc2b5f49cd2.cloudfront.net (CloudFront)

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 729 B
636 B 20ms
19ms Script
text/javascript 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit

Requested by

Host: dsimg.ubm-us.net
URL: https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e5741553501e4a93f4f52316c8cbfe332cac5f3fa6a09b07221abb05694b1894

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 469
x-xss-protection: 1; mode=block
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET render.v1.js
static.adsnative.com/static/js/ 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-135180592-2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d2bfca2ce599253f607327986a937c70382e124c8ebda7e307a16de5456e7616

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28478
x-xss-protection: 0
last-modified: Mon, 09 Mar 2020 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 25 KB
10 KB 18ms
17ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f98.1e100.net

Software

cafe /

Resource Hash

90c13e25698f5e3841a21a599c8330237de9d9b719984f51c5dc8939f22330f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9873
x-xss-protection: 0
server: cafe
etag: 9432785303382586228
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 adblockDetector.js Show response
www.darkreading.com/prestitial/ 118 B
224 B 36ms
36ms Script
application/x-javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/prestitial/adblockDetector.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

d61987a91f9b986e18af273a5aee45ec1256c64df947a156efa81dd96dce56df

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4262
x-powered-by: ASP.NET
status: 200
strict-transport-security: max-age=63072000; includeSubDomains
last-modified: Mon, 20 May 2019 09:07:27 GMT
server: cloudflare
etag: W/"46cb5f72ebed51:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=7200
cf-ray: 57167e4b1a713237-FRA
expires: Mon, 09 Mar 2020 19:25:06 GMT

GET
H2 200 iwk-it-network-dr.gif
img.deusm.com/darkreading/ 3 KB
3 KB 496ms
496ms Image
image/gif 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/iwk-it-network-dr.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6df7d1f2b9c65c06c5ae1e798650b6c388f26f6852b8814f942557d712b9745

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 02 Nov 2016 13:53:05 GMT
server: cloudflare
etag: "abc-54051c29ab240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 57167e4bbadd97a2-FRA
content-length: 2748

GET
H2 200 DR_mobile_User_nav.png
img.deusm.com/darkreading/ 1 KB
2 KB 13ms
13ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_mobile_User_nav.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b02cdb496b954e874c4b87d48eb1ea16f088258786ed0d2f0771acc3d01649e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
age: 3780
etag: "5be-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4bcaea97a2-FRA
content-length: 1470

GET
H2 200 spacer.gif
img.deusm.com/images/ 49 B
144 B 497ms
497ms Image
image/gif 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 13 Oct 2000 01:54:07 GMT
server: cloudflare
etag: "31-3737c29f20dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 57167e4beb0b97a2-FRA
content-length: 49

GET
H2 200 DR_search.png
img.deusm.com/darkreading/ 2 KB
2 KB 54ms
36ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_search.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dafb72bcf008c9b9754482b88e8ba8b8e854f1a69483f0753b1c3f12101c1a9f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
age: 3780
etag: "7e9-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5297a2-FRA
content-length: 2025

GET
H2 200 DR_mobile_SM.png
img.deusm.com/darkreading/ 2 KB
2 KB 26ms
9ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_mobile_SM.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfc1797e85a0565d0cfba1621eac801dc5ebd78a02f45e0ab8de5c6c2eb3f987

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
age: 6501
etag: "864-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5397a2-FRA
content-length: 2148

GET
H2 200 DR-sections-nav.png
img.deusm.com/darkreading/ 2 KB
3 KB 39ms
21ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-sections-nav.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f89a03faa36f0b6eeb92b9a8f0b8d2f9d3e564ba8bf13bb169bf05b126ca81e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:03 GMT
server: cloudflare
age: 3780
etag: "9aa-4f2ebd21a06c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5497a2-FRA
content-length: 2474

GET
H2 200 mobile_close.jpg
img.deusm.com/darkreading/ 2 KB
2 KB 27ms
9ms Image
image/jpeg 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/mobile_close.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5c543f59d71e1e4f6b51c896febf86975206dcf9e34757f475b125d64d16ea6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Thu, 13 Mar 2014 12:44:20 GMT
server: cloudflare
age: 3780
etag: "638-4f47c4fdf5100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5597a2-FRA
content-length: 1592

GET
H2 200 DR_logo_314x49.png
img.deusm.com/darkreading/ 7 KB
7 KB 27ms
10ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_logo_314x49.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0615fb751c4db849533b1e432f05428e307591466902876f8ab30d7873b7f38b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Mon, 15 Oct 2018 10:02:43 GMT
server: cloudflare
age: 6501
etag: "1b78-5784189c2b6f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5897a2-FRA
content-length: 7032

GET
H2 200 DR_Newsletters.png
img.deusm.com/darkreading/ 4 KB
4 KB 35ms
18ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR_Newsletters.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33194e1b282eaf349b01b68de4fee20452ff6877b4b82605d5c68c5132444f96

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Sep 2019 13:04:00 GMT
server: cloudflare
age: 3446
etag: "fec-592d378715000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5997a2-FRA
content-length: 4076

GET
H2 200 Jai-Vijayan.jpg
img.deusm.com/informationweek/ 11 KB
11 KB 37ms
20ms Image
image/jpeg 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/Jai-Vijayan.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e9b6fed568a85ee88f1eb2aa1d51cb2073d907cbb0109a5dd703f0b1e5651d6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Mon, 29 Sep 2014 13:34:14 GMT
server: cloudflare
age: 2920
etag: "2c67-5043452972180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5a97a2-FRA
content-length: 11367

GET
H2 200 editor-TW.png
img.deusm.com/informationweek/ 2 KB
2 KB 38ms
21ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-TW.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32821e69d091e71a62b9dbefcd09516c2133b50c50a3f8d597207d9cab5d59b8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:41 GMT
server: cloudflare
age: 4959
etag: "60d-4eb2828b4cf40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5b97a2-FRA
content-length: 1549

GET
H2 200 editor-IN.png
img.deusm.com/informationweek/ 1 KB
2 KB 37ms
20ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-IN.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5cc2027e2da5b3d553fba6a4d2d7276aafa604001e9b0321e18d1fd62b03b3f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:41 GMT
server: cloudflare
age: 4959
etag: "5b7-4eb2828b4cf40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5c97a2-FRA
content-length: 1463

GET
H2 200 editor-RSS.png
img.deusm.com/informationweek/ 2 KB
2 KB 35ms
18ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-RSS.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8f4fa7376444ffe05d0f7b296439401fb9729bdee84d760ee6286e7b663c753

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:41 GMT
server: cloudflare
age: 4959
etag: "6fa-4eb2828b4cf40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c2b5f97a2-FRA
content-length: 1786

GET
H2 200 editor-email.png
img.deusm.com/informationweek/ 2 KB
2 KB 33ms
16ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/editor-email.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 190f689e0f479324a217a5ea88c1acc132b66d24b16559052d59b892ff5dcba2

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2013 19:33:40 GMT
server: cloudflare
age: 2430
etag: "70f-4eb2828a58d00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b6797a2-FRA
content-length: 1807

GET
H2 200 DR-comment.png
img.deusm.com/darkreading/ 1011 B
1 KB 47ms
31ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63484bd691450c081b848e5159315bfcd02720741d3f72a69717643d6630e578

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:02 GMT
server: cloudflare
age: 6501
etag: "3f3-4f2ebd20ac480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b6997a2-FRA
content-length: 1011

GET
H2 200 thumbs-up.png
img.deusm.com/darkreading/ 2 KB
2 KB 36ms
19ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/thumbs-up.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9111d9514a49ad97e7c6d5fd97a00f3232b73537e9155726f32f123eb69b5a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 16:09:21 GMT
server: cloudflare
age: 3789
etag: "607-4f4934ae90e40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b6a97a2-FRA
content-length: 1543

GET
H2 200 thumbs-down.png
img.deusm.com/informationweek/ 2 KB
2 KB 43ms
26ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/thumbs-down.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b19f14d674857362b6e10d0dcb1703b149d9dda6f350d1737562fc36e4e67a81

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Nov 2013 19:20:31 GMT
server: cloudflare
age: 3780
etag: "624-4eba0acaa9dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b6d97a2-FRA
content-length: 1572

GET
H2 200 email-decode.min.js Show response
www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
807 B 15ms
15ms Script
application/javascript 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Fri, 06 Mar 2020 12:22:46 GMT
server: cloudflare
etag: W/"5e624096-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
cf-ray: 57167e4b3b063237-FRA
expires: Wed, 11 Mar 2020 17:25:06 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 12ms
12ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40D0) /
Resource Hash: 95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:06 GMT
Content-Encoding: gzip
Last-Modified: Thu, 05 Mar 2020 00:06:35 GMT
Server: ECS (fcn/40D0)
Age: 361
Etag: "1274f782fe475e8540678e9cdf10fcdb+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 29100

GET
H2 200 flipboard_srsw.png
cdn.flipboard.com/badges/ 322 B
762 B 22ms
5ms Image
image/png 2600:9000:2057:7800:e:5a70:ca47:86e1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flipboard.com/badges/flipboard_srsw.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:7800:e:5a70:ca47:86e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44fc0a3d10c47ae5aa6c77c76b4b8f81aa08022ca464ef235005ddd86570eb5b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 01:31:34 GMT
via: 1.1 560d8d35213ac925f8d05c5730db1582.cloudfront.net (CloudFront)
last-modified: Wed, 07 Feb 2018 22:03:59 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1518040945/ctime:1518040834/gid:20/gname:staff/md5:37351783e1813119a3e0710c16137273/mode:33152/mtime:1518064798/uid:502/uname:jlee
age: 57213
etag: "37351783e1813119a3e0710c16137273"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 322
x-amz-cf-id: XnWR0Nx71Oh0Vkynts40hWUaAIRWgX46ygvFV2898b0ZOuuijzneKw==

GET
H2 200 flbuttons.min.js Show response
cdn.flipboard.com/web/buttons/js/ 7 KB
4 KB 41ms
6ms Script
application/javascript 2600:9000:2057:7800:e:5a70:ca47:86e1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flipboard.com/web/buttons/js/flbuttons.min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:7800:e:5a70:ca47:86e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8e7ad8de87781f6ad65b36a7d3243b44d80dc182df6af076484a2bec85051550

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 01:53:49 GMT
content-encoding: gzip
last-modified: Wed, 11 Oct 2017 00:24:00 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:502/gname:staff/uname:alee/gid:20/mode:33188/mtime:1507680760/atime:1507680783/md5:ec6e4306e5e274d25c4f9afde663da81/ctime:1507680760
age: 55878
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: RiBywyfz_3ikwLvK6Q91lIKuYtitLqWAvawM68N6OvIojyuD8M_lpA==
via: 1.1 560d8d35213ac925f8d05c5730db1582.cloudfront.net (CloudFront)

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 181 KB
55 KB 27ms
6ms Script
text/javascript 2606:2800:133:7403:4a68:7eff:710b:1ddf
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:7403:4a68:7eff:710b:1ddf , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F0A) /
Resource Hash: 6e796da2a1b9bbbdc24bf2e2dc1b8f960f531bfe1033c0f073a4bbfe73e54a84

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:06 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: ECST
Age: 3035
X-Cache: HIT
X-CDN-Proto: HTTP1
X-Li-Pop: prod-efr5
Content-Length: 55596
X-LI-UUID: P8w7nPGv+hUQPgy2LSsAAA==
Last-Modified: Mon, 09 Mar 2020 16:34:31 GMT
Server: ECAcc (frc/8F0A)
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-lva1
Expires: Mon, 9 Mar 2020 17:34:31 GMT

GET
H2 200 Edgepromohorizontal.jpg
img.deusm.com/darkreading/MarilynCohodas/ 12 KB
12 KB 55ms
39ms Image
image/jpeg 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/MarilynCohodas/Edgepromohorizontal.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7259b4d8e7ac33a579f3a8df3b0eb3fa9c0818ae203fb58b45564cf4d2057ca4

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Tue, 27 Aug 2019 12:24:47 GMT
server: cloudflare
age: 1643
etag: "2f0f-591185baf21c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b6f97a2-FRA
content-length: 12047

GET
H2 200 Kelly_Jackson_Higgins.jpg
twimgs.com/nojitter/informationweek/resources/images/ 23 KB
24 KB 29ms
13ms Image
image/jpeg 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twimgs.com/nojitter/informationweek/resources/images/Kelly_Jackson_Higgins.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf298157a19ff06a7b27a36eb4a3be2994016452a5f9c1ad6b480aa7ce3799ff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 12 Jul 2017 11:38:18 GMT
server: cloudflare
age: 81322
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 57167e4c3e1b1f1d-FRA
content-length: 24037

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 44 KB
15 KB 42ms
23ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d1a1e169b7a4da51417cc2f5d7383985686e3f8a9393b60378218ecb421bed8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "451 / 252 of 1000 / last-modified: 1583770429"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14601
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 Robert-Lemos.png
img.deusm.com/darkreading/authors/ 45 KB
46 KB 48ms
32ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/authors/Robert-Lemos.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87cdbacb358e421a482bc1a52dc9cfc04a9f6d8dfe86c7c6c66bcde013792850

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 12 Dec 2018 13:37:24 GMT
server: cloudflare
age: 607
etag: "b5d4-57cd34c52ed00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7097a2-FRA
content-length: 46548

GET
H2 200 Sara-Peters-125x125.jpg
img.deusm.com/enterpriseefficiency/ 27 KB
27 KB 38ms
22ms Image
image/jpeg 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/enterpriseefficiency/Sara-Peters-125x125.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c611336fd66dfb1fe52805debfb7dc11fd1b7f1ef2eee5906e694b2e971cce1

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 26 Mar 2014 20:26:56 GMT
server: cloudflare
age: 3446
etag: "6a74-4f5884a322400"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7297a2-FRA
content-length: 27252

GET
H2 200 NL-icon.png
img.deusm.com/informationweek/ 3 KB
3 KB 40ms
24ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/NL-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8b7ea5cc75abc79d502a95c5ccac8f97aa82fd8c13acc74c84c754eb86cc4c3

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2013 15:09:43 GMT
server: cloudflare
age: 6501
etag: "a27-4eaabc5a3dbc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7397a2-FRA
content-length: 2599

GET
H2 200 id Show response
ubmtech.d3.sc.omtrdc.net/ 2 B
321 B 95ms
22ms XHR
application/x-javascript 15.188.31.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ubmtech.d3.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=41888968043932876440531699762270838695&ts=1583774706430

Requested by

Host: i.cmpnet.com
URL: https://i.cmpnet.com/s_code/VisitorAPI.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Origin: https://www.darkreading.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-5dd475c59f-zbcbl
vary: Origin
x-c: master-1187.Ief0e9e.M0-357
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=XmZ78gAAAbwa4xTJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=38061357557653343190689918408300372308
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XmZ78gAAAbwa4xTJ

42 B
915 B

40ms
40ms

Image
image/gif

108.128.171.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=XmZ78gAAAbwa4xTJ

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.128.171.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-108-128-171-217.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v062-02f279d94.edge-irl1.demdex.com 5.65.0.20200212140016 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: ejBTam1iR0Y=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Mon, 09 Mar 2020 17:25:06 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=XmZ78gAAAbwa4xTJ
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/v1QHzzN92WdopzN_oD7bUO2P/ 259 KB
92 KB 21ms
6ms Script
text/javascript 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/v1QHzzN92WdopzN_oD7bUO2P/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8fafe784f7e1f13fccc7782f6c524a6f340b0b487b65c45aac414d09e6daded8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 02 Mar 2020 18:23:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 02 Mar 2020 05:05:22 GMT
server: sffe
age: 601314
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 94503
x-xss-protection: 0
expires: Tue, 02 Mar 2021 18:23:12 GMT

GET
H2 200 pubads_impl_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ 165 KB
60 KB 38ms
15ms Script
text/javascript 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

sffe /

Resource Hash

8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 61481
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ 113 B
782 B 36ms
16ms Script
application/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=www.darkreading.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 108
x-xss-protection: 0

GET
H2 200 video-arrow_left_off.gif
img.deusm.com/darkreading/ 1 KB
1 KB 39ms
24ms Image
image/gif 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/video-arrow_left_off.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f61400081191bf755c967c186a8fd356b02010fac3412f84cf83d5dfe10dd5d

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 16:02:37 GMT
server: cloudflare
age: 6501
etag: "53e-4f49332d48140"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7497a2-FRA
content-length: 1342

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/fa726b0a-898c-4556-9c4e-8513ab3eb45d/11ab51b4-e776-4639-97c3-07e5210bfd9d/160x90/match/ 3 KB
4 KB 89ms
11ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/fa726b0a-898c-4556-9c4e-8513ab3eb45d/11ab51b4-e776-4639-97c3-07e5210bfd9d/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: fdb0066a030a45bd44f17d459c6369901b3fa648c94de3afa0f824d87dfd1527

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 05:00:32 GMT
Via: 1.1 c5c25772c7f14e267596e0f8ce51d9bc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 44674
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: Vqm9lgtBHGc3n2a3rLtwaBxXyUVGoTmSgtLeRlhVNnXtbmC8fWvnag==

GET
H2 200 comment.png
img.deusm.com/informationweek/ 1 KB
1 KB 40ms
25ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f65ccd30d1c95588b51035a804dd49090d7fbe6c2829a576a31d1b6a3e0f86b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Nov 2013 19:22:53 GMT
server: cloudflare
age: 3446
etag: "446-4eba0b5215d40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7597a2-FRA
content-length: 1094

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/2fe20654-2cfe-4555-8102-d79cc405847e/0e955e8e-0506-45e1-b715-3062ef29198b/160x90/match/ 5 KB
5 KB 85ms
8ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/2fe20654-2cfe-4555-8102-d79cc405847e/0e955e8e-0506-45e1-b715-3062ef29198b/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: 6dd394ad8df7d5e2ed0f220ff18451f281ccc907cae0d25d233c51533ad8887f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 05:46:56 GMT
Via: 1.1 511c8b6c7e903efca023a504d527516b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 41890
X-Powered-From: us-east-1c
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: jKfRRv_uHMPw1TXH9zjFd8a1gkDwN4x3E-41Yx1XJqN8njJT6cAGnA==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c601c055-fcb3-4a63-98f8-d1882e680cbc/32d6c778-320c-47c4-91cf-4508cb0d5c40/160x90/match/ 3 KB
4 KB 103ms
24ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c601c055-fcb3-4a63-98f8-d1882e680cbc/32d6c778-320c-47c4-91cf-4508cb0d5c40/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: 01b4ebef3b601f246d0adbff5259fabbe7c8e0311f1169b495f0bb2b862db981

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 05:38:25 GMT
Via: 1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 42400
X-Powered-From: us-east-1e
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: EhxWwbGZygtpeSbiSpmHUXK3PuV12RD4v4tYhvzlB7u3mb1_bbVUKw==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/a7f317ff-8706-4af7-9f0e-9e2417e9af2d/29fd1a56-9d84-4424-bebd-e25a67a974d3/160x90/match/ 4 KB
5 KB 96ms
13ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/a7f317ff-8706-4af7-9f0e-9e2417e9af2d/29fd1a56-9d84-4424-bebd-e25a67a974d3/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: eb12eaa9c690d06187a7099545a6bf52318a2364411fc9c4ec73e7fa4ecbb0f9

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 06:13:20 GMT
Via: 1.1 511c8b6c7e903efca023a504d527516b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 40306
X-Powered-From: us-east-1c
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: VBlIy4pnBsncFLiqjUk-abgXxPLUVfZUwcnCNygpyT_QiJkDzEdtZw==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/7d8fd3f5-736a-4751-9741-c63476a1c55f/9e10932e-22cf-4161-8f97-7ded08968b25/160x90/match/ 4 KB
4 KB 98ms
12ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/7d8fd3f5-736a-4751-9741-c63476a1c55f/9e10932e-22cf-4161-8f97-7ded08968b25/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: 2ec7b8d3c38a996f67dd4e580c975ece3e9d936d4267167d12604a59a5ff2c87

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 08 Mar 2020 22:11:16 GMT
Via: 1.1 511c8b6c7e903efca023a504d527516b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 69230
X-Powered-From: us-east-1a
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: hPQyVNCp5qj7396sruFRapTy9EzpIcs6CDBWJrq08LJMF8CnqppH9A==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/3afccae7-9c97-4434-b702-84e95b2c9e9b/213e62f9-b1ab-4368-a58c-5bf046478bff/160x90/match/ 4 KB
4 KB 109ms
23ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/3afccae7-9c97-4434-b702-84e95b2c9e9b/213e62f9-b1ab-4368-a58c-5bf046478bff/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: c670b28572ed7804386b274eb1ddafbc0253a1aff515b0d15805c57c26bcee64

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 04:04:33 GMT
Via: 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 48033
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: OnvfDwIs_8pQq3C3kNKuU8QCTQ9Uo6x0WaJlsxDp3GZwfaPWXqao4g==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/1d764395-3566-4875-8962-a175d38af9e5/main/160x90/2m58s368ms/match/ 5 KB
5 KB 11ms
8ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/1d764395-3566-4875-8962-a175d38af9e5/main/160x90/2m58s368ms/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: f598a8748bf3e022bb3b431e6a0ad2b735d99b41288d56361dc9ce63b4e4d285

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 02:06:43 GMT
Via: 1.1 c5c25772c7f14e267596e0f8ce51d9bc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 55103
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: kSilQfKZ6PgY9Cdx5VmSKkQMfi0v5l36JJGvpnKGnXpE7XeKdYP-yA==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/96082f18-026e-44fb-abf1-f81e163dc2f2/cb35f38f-1826-419f-a5e0-7e1971f4c1c6/160x90/match/ 4 KB
4 KB 19ms
18ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/96082f18-026e-44fb-abf1-f81e163dc2f2/cb35f38f-1826-419f-a5e0-7e1971f4c1c6/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: 71c805ad1e5135a1d4dd9fccaa913bbdaf94cc3608d9619e5b546c1b865a2c16

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 08:47:07 GMT
Via: 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 31079
X-Powered-From: us-east-1c
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: vsCPoQCH6J1u3tXAFFyYkMQRKcdCDbINQFfeAMfn4QJRGoBNQganqA==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/25c39f65-9707-4f3a-9f06-88fccdd69a43/main/160x90/4m39s829ms/match/ 4 KB
5 KB 10ms
10ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/25c39f65-9707-4f3a-9f06-88fccdd69a43/main/160x90/4m39s829ms/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: 20cbcc1c3a0b7c92033adbeb8f6f8b0cb03067db48a19f7116b40e8f2fbf8b3a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 02:47:42 GMT
Via: 1.1 511c8b6c7e903efca023a504d527516b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 52644
X-Powered-From: us-east-1d
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: QN4g-ZC1izuGrQX8a5r4f4FjJKfTpFcj4fnmmxSsbrgttFZUNbOVZw==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/d0e7fead-2e5a-4562-a430-556e3516311c/e5ff9746-37c2-40c4-bb2d-10e4ec8d3ad3/160x90/match/ 4 KB
4 KB 11ms
11ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/d0e7fead-2e5a-4562-a430-556e3516311c/e5ff9746-37c2-40c4-bb2d-10e4ec8d3ad3/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: 9bb134ceb966cd6cbccfec7ab7dcb2fede6b0a5705e991030c0c248670d99168

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 10:36:02 GMT
Via: 1.1 c5c25772c7f14e267596e0f8ce51d9bc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 24544
X-Powered-From: us-east-1a
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: 7P3lmjk3aNcUx3mfkjMgG5PvsqHy74KHMcAcBjsmtUSam7bZs6gy1A==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c0da3834-c2d6-4c82-bef6-4ccdef7da688/911a7f6c-fc39-413a-bb28-272f6702ab8e/160x90/match/ 4 KB
4 KB 8ms
8ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c0da3834-c2d6-4c82-bef6-4ccdef7da688/911a7f6c-fc39-413a-bb28-272f6702ab8e/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: 731e7bf0e3b7c8fb1978a6c04ba3940b77ce5166bd55dcc2c710baa011c517c6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 01:43:41 GMT
Via: 1.1 511c8b6c7e903efca023a504d527516b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 56485
X-Powered-From: us-east-1a
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: H6_87TLNKINluEFf_EwV6oLT20IOfV2WZjd_N9gUN87tHGiavgsaNQ==

GET
H/1.1 200
OK image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/d28d35f7-16e0-4c08-9500-8257f224764a/0c968b04-c649-44ca-96b7-867f99c5e6b4/160x90/match/ 4 KB
5 KB 11ms
10ms Image
image/jpeg 143.204.212.151
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/d28d35f7-16e0-4c08-9500-8257f224764a/0c968b04-c649-44ca-96b7-867f99c5e6b4/160x90/match/image.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.212.151 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-212-151.fra53.r.cloudfront.net
Software: / BC
Resource Hash: de309132f417ea1f43ee235841b11e40081e1ea204cbbf29b9c896dc3350dd64

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 04:04:33 GMT
Via: 1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Age: 48032
X-Powered-From: us-east-1c
X-Powered-By: BC
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Id: FHQ_LU6fika_PHZeln74yeNFQ3kOVpjWS_uuJPv7HFOFakRQ7yV6GQ==

GET
H2 200 video-arrow_right_on.gif
img.deusm.com/darkreading/ 2 KB
3 KB 38ms
26ms Image
image/gif 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/video-arrow_right_on.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7d1ee4f5a608fa05b8f9c6cbd47e3eab7516facc3380d704b7332805877afff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 14 Mar 2014 15:55:19 GMT
server: cloudflare
age: 6501
etag: "9f7-4f49318b927c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7697a2-FRA
content-length: 2551

GET
H2 200 JK-FebruaryCartoon.jpg
img.deusm.com/darkreading/MarilynCohodas/ 803 KB
804 KB 50ms
38ms Image
image/jpeg 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/MarilynCohodas/JK-FebruaryCartoon.jpg
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2cb9c5d8afc8f538bea2f545024ae5d6040d9a580d3bfc235189dd9953132af

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 12 Feb 2020 16:26:11 GMT
server: cloudflare
age: 6501
etag: "c8bd3-59e636e2dcec0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7797a2-FRA
content-length: 822227

GET
H2 200 DRTD_Cover_6EmgThrts.png
twimgs.com/custom_content/ 44 KB
44 KB 28ms
16ms Image
image/png 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twimgs.com/custom_content/DRTD_Cover_6EmgThrts.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b2fd43985ac7b6217a7cbe64e46baf5485f32751a97b4ff2b630bd3f1e2924e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 28 Feb 2020 17:19:39 GMT
server: cloudflare
age: 84164
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 57167e4c3e1d1f1d-FRA
content-length: 45359

GET
H2 200 survey_jspage.asp Show response
www.darkreading.com/ 7 KB
1 KB 547ms
529ms Script
text/html 2606:4700::6811:7963
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.darkreading.com/survey_jspage.asp?survey_id=130&cbust=82552

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET

Resource Hash

47b3c860615f2e891107d75ab26407dc9029a16ee7bb76f7510c50a70688b2ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
status: 200
cache-control: private
strict-transport-security: max-age=63072000; includeSubDomains
cf-ray: 57167e4c2e643237-FRA

GET
H2 200 DRRPT_CVR_IRChallenge.png
twimgs.com/custom_content/ 43 KB
43 KB 44ms
33ms Image
image/png 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twimgs.com/custom_content/DRRPT_CVR_IRChallenge.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aefbf827e3559e0744dc70139d33206a03d5edeb74b3f54cea1ff86b2928bd7c

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 28 Feb 2020 17:22:43 GMT
server: cloudflare
age: 69030
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 57167e4c3e1f1f1d-FRA
content-length: 44080

GET
H2 200 DR-bug.png
img.deusm.com/darkreading/ 1 KB
2 KB 50ms
39ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-bug.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f30d5c0433d74c8224a2343a3c6c08468015909c22315b8693f9bdee33f48217

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:01 GMT
server: cloudflare
age: 3446
etag: "5d2-4f2ebd1fb8240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7c97a2-FRA
content-length: 1490

GET
H2 200 Social-FB.png
img.deusm.com/darkreading/ 2 KB
3 KB 48ms
37ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/Social-FB.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbb475f48d03815474a554d3c16599917c2fabf811e3fe2772aeabeee474aa8f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 11 Oct 2019 04:28:57 GMT
server: cloudflare
age: 6501
etag: "9a2-5949af4d49440"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7d97a2-FRA
content-length: 2466

GET
H2 200 Social-Twitter.png
img.deusm.com/darkreading/ 3 KB
3 KB 508ms
498ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/Social-Twitter.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f762bf1a58c917c1ad50006bfcd192ab55b2d01a857b7c08b6c40e3af878695

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 11 Oct 2019 12:05:31 GMT
server: cloudflare
etag: "a2c-594a155a3d8c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b7e97a2-FRA
content-length: 2604

GET
H2 200 Social-LI.png
img.deusm.com/darkreading/ 3 KB
3 KB 41ms
31ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/Social-LI.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4bbed2de83df27dc8130644101bce3dd9ddd1c178815e42bcb49118b4a73593c

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 11 Oct 2019 12:05:08 GMT
server: cloudflare
age: 6501
etag: "a0b-594a15444e500"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b8197a2-FRA
content-length: 2571

GET
H2 200 Social-Flip.png
img.deusm.com/darkreading/ 825 B
926 B 47ms
37ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/Social-Flip.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 973ccce3f58b175a9e021c76978726083cc7e5cbed75cd0ff09ff83919934d15

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 16 Oct 2019 04:56:12 GMT
server: cloudflare
age: 6501
etag: "339-594ffeb7d9300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b8297a2-FRA
content-length: 825

GET
H2 200 Social-RSS.png
img.deusm.com/darkreading/ 3 KB
3 KB 42ms
32ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/Social-RSS.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0761aa1289035f3d20430d55e475043a8fa40deff221715e31068905d561753

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 11 Oct 2019 12:05:19 GMT
server: cloudflare
age: 6501
etag: "a73-594a154ecbdc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b8497a2-FRA
content-length: 2675

GET
H2 200 Whitelogo.png
twimgs.com/nojitter/img/ 7 KB
7 KB 27ms
17ms Image
image/png 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twimgs.com/nojitter/img/Whitelogo.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8041ba3d02102bd99dcead4dcc9882c484902362927cfd598e389e930f68ceb

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Thu, 09 Jan 2020 05:04:54 GMT
server: cloudflare
age: 23423
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 57167e4c3e201f1d-FRA
content-length: 7304

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 69ms
21ms Script
application/x-javascript 23.11.238.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.11.238.95 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-11-238-95.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 884
Expires: Tue, 10 Mar 2020 17:25:06 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
30 KB 16ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: tLaZ5iQJJ4j8DeBfZ1XR4NQ7gfzihgMIvpwpDyaI2w7geS6T5qDUz1w4Ri8HRXGt/tqOQ2FNdwV8gac6DV3fKg==
x-fb-trip-id: 420120009
date: Mon, 09 Mar 2020 17:25:06 GMT, Mon, 09 Mar 2020 17:25:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 log.js Show response
u.heatmap.it/ 27 KB
11 KB 93ms
28ms Script
application/x-javascript 46.105.202.39
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u.heatmap.it/log.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: f851a9c6eb2bc09da1f51b84e5d218efa514d76c6fa53e803f22ad7dca9f93cf

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 07 Mar 2020 09:38:52 GMT
content-encoding: br
last-modified: Fri, 28 Feb 2020 13:51:05 GMT
x-cdn-pop-ip: 137.74.120.0/27
etag: W/"5e591ac9-6b00"
x-cacheable: Matched cache
vary: Accept-Encoding
content-type: application/x-javascript; charset=UTF-8
status: 200
cache-control: max-age=604800
x-cdn-pop: sbg
accept-ranges: bytes
content-length: 10520
x-request-id: 917506
expires: Sat, 07 Mar 2020 10:38:52 GMT

GET
H2 200 background-pattern.png
img.deusm.com/darkreading/ 493 B
681 B 46ms
39ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/background-pattern.png
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98fb88ec226feae902fb7f98528a41db7abd7de155a6d7b65658c6ab7f2b95f4

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.27
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:01 GMT
server: cloudflare
age: 6354
etag: "1ed-4f2ebd1fb8240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4c3b8597a2-FRA
content-length: 493

GET
H2 200 iribbon-logo.gif
twimgs.com/nojitter/gama/ 2 KB
2 KB 20ms
14ms Image
image/gif 2606:4700:3031::681f:459e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://twimgs.com/nojitter/gama/iribbon-logo.gif
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681f:459e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3bd482cd3ec17583f25ad0819d1ccbcd0cdcb0fe26f8d87b7f30fd61b3dc640

Request headers

Referer: https://img.deusm.com/darkreading/informa-iribbon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 19 Apr 2019 06:59:19 GMT
server: cloudflare
age: 23839
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 57167e4c3e211f1d-FRA
content-length: 1931

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 80 KB
18 KB 140ms
132ms XHR
text/plain 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1141506495506630&correlator=1573053620435146&output=ldjh&impl=fifs&adsid=NT&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200309&iu_parts=2441%2Cdarkreading%2Cattacks_breaches&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=2x2%2C5x5%2C300x250%7C336x280%7C300x600%7C336x850%2C6x6%2C1x2%2C728x90%7C970x250%2C336x27%2C300x250%7C336x280%7C300x600%7C336x850%2C300x60%2C3x3%2C4x4%2C8x2%2C8x4&prev_scp=pos%3Dwelcome%26testAd%3D%7Cpos%3DTAPunit%26testAd%3D%7Cpos%3Drec1%26testAd%3D%7Cpos%3Dpromo%26testAd%3D%7Cpos%3Dwallpaper%26testAd%3D%7Cpos%3Dtop%26testAd%3D%7Cpos%3Dlogo%26testAd%3D%7Cpos%3Drec2%26testAd%3D%7Cpos%3Deventpromo%26testAd%3D%7Cpos%3Dribbon%26testAd%3D%7Cpos%3Dvideo%26testAd%3D%7Cpos%3Dnative%26testAd%3D%7Cpos%3Dinsight%26testAd%3D&cust_params=kw%3DAdvanced_Threats%252CAttacks%252CAttacks-Breaches%252CBreaches%252CEndpoint_Security%26aid%3D1337260&cookie_enabled=1&bc=31&abxe=1&lmt=1583774706&dt=1583774706599&dlt=1583774706294&idt=250&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adys=35%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adks=1417865500%2C2285942263%2C4220632109%2C4159207384%2C2332965166%2C2966194094%2C2269036440%2C4220632108%2C1032152201%2C885452677%2C693593060%2C929715771%2C3939335409&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&dssz=45&icsg=4187643458208&std=0&csl=80&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x1200%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&msz=1600x2%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&ga_vid=2079498175.1583774707&ga_sid=1583774707&ga_hid=137718984&fws=0%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

9a33c7d20bf573e9d3e0f86ccad6c36bf6fe8e5094768e4fe01e33fe3cd183d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Origin: https://www.darkreading.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18104
x-xss-protection: 0
google-lineitem-id: 5225689428,5271825262,5271825262,-2,5223470855,5239214548,-2,5314204047,-2,-2,42403476,5305207436,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138303944225,138301772089,138301433147,-2,138303914748,138296534672,-2,138305844955,-2,-2,138212589663,138305361674,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020030501.js Show response
securepubads.g.doubleclick.net/gpt/ 69 KB
25 KB 28ms
21ms Script
text/javascript 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

sffe /

Resource Hash

ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Mar 2020 14:08:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25689
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 34ms
6ms Other
text/html 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/ 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/?random=1583774706620&cv=9&fst=1583774706620&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&tiba=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96299ace5c463e8afc087fa1d03051487f1692c42264f5221ea4ad973273b88b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1059
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 23 KB
7 KB 28ms
27ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 89b531e78902333807b825faf77cd11cc927fe364ea2ba9307f65365f7e811f7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:05 GMT
content-encoding: gzip
last-modified: Fri, 31 Jan 2020 21:01:31 GMT
x-msedge-ref: Ref A: 554F358B67FC409BAC7BBB00EA34F6C7 Ref B: FRAEDGE0220 Ref C: 2020-03-09T17:25:06Z
access-control-allow-origin: *
etag: "8087c39c79d8d51:0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7295

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e06370b8e243c8fe64fd3ada669f839977615a5e24a06809d8131521c2d7aaf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: qbzV5AIuzYk3Lj1U9pWnWw==
status: 200
date: Mon, 09 Mar 2020 17:25:06 GMT, Mon, 09 Mar 2020 17:25:06 GMT
expires: Mon, 09 Mar 2020 17:38:17 GMT
alt-svc: h3-27=":443"; ma=3600
content-length: 1779
x-fb-debug: H7p0ZHGlCu/IMbe2A6mZnajH6Dg55/j2HQrpeEYcGYIzfd+JaOr3EF+i9DpqWLtP90jUvAeTZQx13/m+kpujzw==
x-fb-trip-id: 420120009
x-fb-content-md5: 6cd9e92f731667a22685e3ab73e88e84
etag: "89a23fe69807787402d04c4a96e2405e"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK Cookie set dest5.html
ubm.demdex.net/ Frame 95EA 0
0 159ms
33ms Document
text/html 52.31.188.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ubm.demdex.net/dest5.html?d_nsid=0

Requested by

Host: i.cmpnet.com
URL: https://i.cmpnet.com/s_code/VisitorAPI.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.188.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-188-35.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: ubm.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=38061357557653343190689918408300372308
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Fri, 21 Feb 2020 14:08:21 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=38061357557653343190689918408300372308;Path=/;Domain=.demdex.net;Expires=Sat, 05-Sep-2020 17:25:06 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: 97AsPEIwSDA=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 ubm-tech-global-app-measurement.js Show response
i.cmpnet.com/s_code/ 56 KB
20 KB 20ms
18ms Script
application/javascript 2606:4700:3032::681b:9174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.cmpnet.com/s_code/ubm-tech-global-app-measurement.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:9174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 924b3a471d549de6251aea0e74fe6eb136141d3f0a8bf001906fff933dec45d4

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 14 Jul 2018 00:08:25 GMT
server: cloudflare
age: 35252
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 57167e4cd894dfdf-FRA

GET
H2

200

spacer.gif
img.deusm.com/images/
Redirect Chain

https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F314&f=%2Fdarkreading%2Fsection%2F314%2F1337260&rndserial=48306
https://img.deusm.com/images/spacer.gif

49 B
230 B

11ms
11ms

Image
image/gif

2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2000 01:54:07 GMT
server: cloudflare
age: 0
etag: "31-3737c29f20dc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 57167e50f90997a2-FRA
content-length: 49

Redirect headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 302
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
content-type: text/html
location: https://img.deusm.com/images/spacer.gif
cache-control: private
cf-ray: 57167e4cd8bb3237-FRA

GET
H2 200 lightreading_rating_dot_10x7.gif
img.deusm.com/lightreading/ 49 B
162 B 12ms
10ms Image
image/gif 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/lightreading/lightreading_rating_dot_10x7.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Sep 2013 21:21:36 GMT
server: cloudflare
age: 6501
etag: "31-4e73bd694b800"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 57167e4cdc3397a2-FRA
content-length: 49

GET
H2 200 twitter_intevol_18x18.gif
img.deusm.com/darkreading/ 619 B
724 B 16ms
14ms Image
image/gif 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/twitter_intevol_18x18.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebe3a0272a317857bf566a0deec42181bf0e89d280bb3143bba14da1ae1ddb10

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Feb 2018 10:56:35 GMT
server: cloudflare
age: 6501
etag: "26b-564c561c21ec0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
accept-ranges: bytes
cf-ray: 57167e4cdc3697a2-FRA
content-length: 619

GET
H2 200 beacon-min.js Show response
ins.techweb.com/beacon/js/ 6 KB
2 KB 46ms
16ms Script
application/javascript 2606:4700:3035::6812:28f2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.techweb.com/beacon/js/beacon-min.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:28f2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a290ede885635a3f7bb2b8e630bf795f15dde146fea32520b775bee1b2926ff3

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Mar 2017 17:04:42 GMT
server: cloudflare
age: 2404
etag: W/"6108-1490288682000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
status: 200
cache-control: max-age=14400
cf-ray: 57167e4d0d4e3248-FRA
content-type: application/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-135180592-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 5576
date: Mon, 09 Mar 2020 15:52:10 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18174
expires: Mon, 09 Mar 2020 17:52:10 GMT

GET
H2 200 832000476880185 Show response
connect.facebook.net/signals/config/ 447 KB
112 KB 16ms
15ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/832000476880185?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6b32273d502be4ac793cba3d1e1524fcfe423a433c822ab529b1f77af0b8d60b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 114947
x-xss-protection: 0
pragma: public
x-fb-debug: lZSlITW9lGrXL9WIWSLkSNF1iUHgc1K0OOEbwITA23VDTNZJKny2uUTaGdv/2d2p8ThTj+CzXnum+1k3N/tyxw==
x-fb-trip-id: 420120009
date: Mon, 09 Mar 2020 17:25:06 GMT, Mon, 09 Mar 2020 17:25:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1583774706755&ns_c=windows-1252&cv=3.5&c8=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c7=https%3A%2F%2Fwww.darkreadin...
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1583774706755&ns_c=windows-1252&cv=3.5&c8=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c7=https%3A%2F%2Fwww.darkreadi...

0
248 B

18ms
7ms

Image
text/plain

23.11.238.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1583774706755&ns_c=windows-1252&cv=3.5&c8=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&c9=
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.11.238.95 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-11-238-95.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:06 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1583774706755&ns_c=windows-1252&cv=3.5&c8=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c7=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&c9=
Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:06 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 35 KB
14 KB 30ms
7ms Script
application/x-javascript 2600:9000:2057:7a00:18:1fcd:349:ca21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:7a00:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:21:51 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 02:24:02 GMT
server: nginx
age: 195
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: E0Ul3BRRYdARCiiK2g8tS7xiN3o_fhGsKnUREdLlHSqZdCUUu7rhYw==
via: 1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)
expires: Mon, 09 Mar 2020 19:21:51 GMT

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 383 KB
111 KB 9ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=3d224dcaefabd859e751450e71c4adb5&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

32dcd73ca3788f4f757d371d426005ae1a99cbbc4969f6aaa2ed503474925d08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Origin: https://www.darkreading.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: mVtfXjNn44wylSMrDcPxLQ==
status: 200
date: Mon, 09 Mar 2020 17:25:06 GMT, Mon, 09 Mar 2020 17:25:06 GMT
expires: Tue, 09 Mar 2021 17:18:28 GMT
alt-svc: h3-27=":443"; ma=3600
content-length: 112854
x-fb-debug: T+w0TL6LDCW/RfJolU7XVIyIdiNkUA49qfKa1PWl2shBhq+eJvoMnln7roO1B2VLFB9ZdJZ8EncBhl/apbQNIw==
x-fb-trip-id: 420120009
x-fb-content-md5: 8dcd5607fef8b26ddaeace602122afea
etag: "3eeca7c6c38fd9bca465466834972603"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 rss-icon.png
img.deusm.com/darkreading/ 2 KB
2 KB 14ms
10ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/rss-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bb0d75d42e3ccf1a9d1a055bcddfbc23003ed3ab75bb0eb49c05ba747bce8c9

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
age: 3446
etag: "649-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4caf97a2-FRA
content-length: 1609

GET
H2 200 tw-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 14ms
11ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/tw-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48d211ee8f54e0f314ee98a2b63e6e470b33fb1de29d326c742be16125bda71a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
age: 3779
etag: "56e-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4cb097a2-FRA
content-length: 1390

GET
H2 200 flipboard-icon.png
img.deusm.com/darkreading/ 425 B
526 B 467ms
463ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/flipboard-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22c53eeed2c33c21657590793b89fed83648ee555686c0e9ff90b39c1dab406f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 30 Nov 2018 12:31:36 GMT
server: cloudflare
etag: "1a9-57be0fae8ba00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4cb297a2-FRA
content-length: 425

GET
H2 200 facebook-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 459ms
456ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/facebook-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e19e8f9902a8b9ec4840aaf54110d6f502c5fb500303dc605f8776c40f7fb67

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: REVALIDATED
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
etag: "4a9-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4cb397a2-FRA
content-length: 1193

GET
H2 200 li-icon.png
img.deusm.com/darkreading/ 1 KB
1 KB 14ms
11ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/li-icon.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 976aabc512994a6ecc5981a85c489d1bb242ba6734b746a964d69db615f72875

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Mon, 24 Feb 2014 16:00:47 GMT
server: cloudflare
age: 3446
etag: "54b-4f329132149c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4cb597a2-FRA
content-length: 1355

GET
H2 200 reb-border.png
img.deusm.com/darkreading/ 331 B
511 B 455ms
452ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/reb-border.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 523296d1a2c9a67ee707b5e0bc582f488e5786ec9b343c7b3da58a0d162d643b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 03 Nov 2016 06:29:01 GMT
server: cloudflare
etag: "14b-5405fac56e540"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4cb697a2-FRA
content-length: 331

GET
H2 200 nav-background.png
img.deusm.com/darkreading/ 3 KB
3 KB 496ms
493ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/nav-background.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6595372db2688a9dfb0991bc6cea16343042dd3caa33483b393d21a77d1c4be

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.27
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 22 Feb 2014 17:43:38 GMT
server: cloudflare
etag: "af8-4f30247448680"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4cb897a2-FRA
content-length: 2808

GET
H2 200 nav-background-edge.png
img.deusm.com/darkreading/ 3 KB
3 KB 17ms
15ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/nav-background-edge.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd2f3015d1e62a6f24420652afa85f8dbce31636ea8ee86781dc794c243dec68

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.27
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Tue, 11 Jun 2019 06:13:41 GMT
server: cloudflare
age: 5080
etag: "aeb-58b0632bf0f40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d4cb997a2-FRA
content-length: 2795

GET
H2 200 BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Omb2RlV9Su1cai.woff
fonts.gstatic.com/s/robotoslab/v11/ 15 KB
15 KB 11ms
9ms Font
font/woff 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v11/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Omb2RlV9Su1cai.woff

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b6f5ef9a0c4b8bdc17d9f04174cf25472ee3e519abe18e5edfe46a736ec86bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Roboto+Slab:700
Origin: https://www.darkreading.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 24 Feb 2020 20:53:05 GMT
x-content-type-options: nosniff
last-modified: Tue, 04 Feb 2020 23:35:54 GMT
server: sffe
age: 1197121
content-type: font/woff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 15360
x-xss-protection: 0
expires: Tue, 23 Feb 2021 20:53:05 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1007530244/ 42 B
110 B 27ms
23ms Image
image/gif 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1007530244/?random=1583774706620&cv=9&fst=1583773200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&tiba=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&fmt=3&is_vtc=1&random=1863257292&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1007530244/ 42 B
110 B 22ms
18ms Image
image/gif 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1007530244/?random=1583774706620&cv=9&fst=1583773200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&tiba=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&fmt=3&is_vtc=1&random=1863257292&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 www.darkreading.com.js Show response
u.heatmap.it/conf/ 0
211 B 86ms
85ms Script
text/javascript 46.105.202.39
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u.heatmap.it/conf/www.darkreading.com.js
Requested by: Host: u.heatmap.it
URL: https://u.heatmap.it/log.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
x-cacheable: Cacheable
x-cdn-pop-ip: 137.74.120.0/27
content-type: text/javascript;charset=UTF-8
status: 204
cache-control: max-age=60
x-cdn-pop: sbg
x-request-id: 769163353
expires: Mon, 09 Mar 2020 17:30:07 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5476211&Ver=2&mid=20abf12d-f198-7b5e-9605-c1fb004a8130&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&p=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&r=&evt=pageLoad&msclkid=N&rn=98455
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 204
pragma: no-cache
date: Mon, 09 Mar 2020 17:25:05 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: A69D862CA9BE4D3F81B6628FB0AD1952 Ref B: FRAEDGE0220 Ref C: 2020-03-09T17:25:06Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

__fpn.gif
fpn.flipboard.com/tr/
Redirect Chain

https://fpn.flipboard.com/pix/__fpn.gif?utm_source=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260
https://fpn.flipboard.com/tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fattacks-breaches%25252Fnew-ransomware-variant-developed-entirely-as-shellcode%25252Fd%25...

35 B
357 B

10ms
7ms

Image
image/gif

2600:9000:2057:6e00:14:85db:2b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fpn.flipboard.com/tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fattacks-breaches%25252Fnew-ransomware-variant-developed-entirely-as-shellcode%25252Fd%25252Fd-id%25252F1337260&rh=https%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fnew-ransomware-variant-developed-entirely-as-shellcode%252Fd%252Fd-id%252F1337260
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:6e00:14:85db:2b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 09 Mar 2020 16:52:13 GMT
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
last-modified: Thu, 12 Oct 2017 18:19:12 GMT
server: AmazonS3
age: 1973
etag: "28d6814f309ea289f847c69cf91194c6"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 35
x-amz-cf-id: u8xxaqYtZt8SaGfnzvKz-ehs8Tn0lyOfuocDzFXXZ_eWNszDLEiYag==

Redirect headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:06 GMT
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
location: /tr/__fpn.gif?qs=utm_source%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fattacks-breaches%25252Fnew-ransomware-variant-developed-entirely-as-shellcode%25252Fd%25252Fd-id%25252F1337260&rh=https%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fnew-ransomware-variant-developed-entirely-as-shellcode%252Fd%252Fd-id%252F1337260
x-cache: LambdaGeneratedResponse from cloudfront
status: 307
cache-control: no-cache, no-store, must-revalidate
content-length: 0
x-amz-cf-id: WDWOiOhJzVxBpArI40G66OqhnlwD_QZlCTfTX6HUa8c7Z023Ctff7Q==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 bullet.png
img.deusm.com/informationweek/ 1 KB
1 KB 13ms
13ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/bullet.png
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e0e2ad3a93ec78d016efee0993b5856ba9b4acafcee3aa4d6f7162f039fcce4

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Sat, 02 Nov 2013 00:57:26 GMT
server: cloudflare
age: 2093
etag: "41e-4ea272a96e980"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4d9d3597a2-FRA
content-length: 1054

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6DC8 0
0 26ms
26ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNiduiyliMNbeZohCU8cY0_XT5NxaHivO5AFOkVrdYXCMxBlXyswzx-btBYdN-_f7SC1jVFJxT9dJGTNz02vyWVn4whHHF77NpPy59Oqd_4gw6TEhDMj4lkVWcBD03tJzWxTrg6UJ3ihFdEmssgrBUDxaAa4nGDcoZ4lDvyKP4G6mGjOY_y5PeKpKkNvVpUmxdKdFN73RRCFmWAmIln7YF2d58i3xYOMlJeA-zMo2EPBZajUt9rcIOYDjSr2TKRuu2_-9Wq3J4JVcZ9VFNMNJxaLo1vJ0D8utQBaUmBQMl4xi2Bww7EQ&sai=AMfl-YQwilitUA6euEWoUJvf7QqOsA0_Fmrux9TPz3aJPcI93o6pZ43rdB4Da71lI3aXfxDj8TKAA3jnoeFY35MkxZfQVTJ64gBTxYklnuPYjg&sig=Cg0ArKJSzLbeDw8EbzITEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H/1.1 200
OK jquery-1.11.0.min.js Show response
code.jquery.com/ Frame 6DC8 94 KB
33 KB 23ms
10ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.0.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:06 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Oct 2014 00:16:07 GMT
Server: nginx
ETag: W/"54499a47-1787d"
Vary: Accept-Encoding
X-HW: 1583774706.dop167.fr8.shc,1583774706.dop167.fr8.t,1583774706.cds001.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 33357

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6DC8 73 KB
28 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame 6DC8 289 KB
98 KB 43ms
12ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:53 GMT
server: AmazonS3
x-amz-request-id: B3AF4FB2CB7667E0
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42195
accept-ranges: bytes
content-length: 99749
x-amz-id-2: RG8WrOn/euzYXC+etzZDBPw7gwj4uRtLknsJYX5sFaBXv7st1n2eYNNwafDNdLDomNZGsjr5xgg=

GET
H2

200

imgad
tpc.googlesyndication.com/pagead/ Frame 6DC8
Redirect Chain

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNiduiyliMNbeZohCU8cY0_XT5NxaHivO5AFOkVrdYXCMxBlXyswzx-btBYdN-_f7SC1jVFJxT9dJGTNz02vyWVn4whHHF77NpPy59Oqd_4gw6TEhDMj4lkVWcBD03tJzWxTrg6UJ3i...
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnhK7w9QEQARgBMgil1qRvp9Nq6w

116 KB
116 KB

10ms
8ms

Image
image/png

2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnhK7w9QEQARgBMgil1qRvp9Nq6w

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d67581d18a9d2df5fb620752a03f947d9559a384b0702b51edf8db94006e9d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 04:00:48 GMT
x-content-type-options: nosniff
server: cafe
age: 48258
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=604800
content-disposition: attachment; filename="image.png"
content-type: image/png
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 118293
x-xss-protection: 0
expires: Mon, 16 Mar 2020 04:00:48 GMT

Redirect headers

date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
content-type: text/html; charset=UTF-8
server: cafe
access-control-allow-origin: *
location: https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnhK7w9QEQARgBMgil1qRvp9Nq6w
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: private
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 ad-overlay25.jpg
assets.informa.com/advert/ Frame 6DC8 12 KB
12 KB 1250ms
192ms Image
image/jpeg 52.6.46.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.informa.com/advert/ad-overlay25.jpg
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.6.46.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-46-73.compute-1.amazonaws.com
Software: Apache/2.4.6 (CentOS) /
Resource Hash: a782f5c6312b15a57bc5cd6516c26c08bea8ebe5f27cf1062d08ed933c1e37a6

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 25 Oct 2019 20:17:32 GMT
server: Apache/2.4.6 (CentOS)
etag: "2e7e-595c1d70f28f8"
content-type: image/jpeg
status: 200
accept-ranges: bytes
content-length: 11902

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8b7d1f10441c7349e88ed2a168e0635836f6724999f91ea8d15ecd4811dad38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27645
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6830 0
0 19ms
19ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssJTvM44H-ZfksEQtli_QNq9PpE6fHq9BvN0HCRI2WpJ0MtLEToGe2Oi-cbAuViaVGMPQNjfd0KQ-7YvZVBoSh8SMOOVnLwMuqflpAJM_NSEhDs-j_B3Ycd_ocCD92zyeZbHU4EIagmflCG7jA75zY6UdpK8rXpQUoPpQsm5UU2SkT7hiqG2AN4C99dNqw6N35Q14t44Agw-H-4QCKCfb0swfmKhIT6T2eoUE1cxIvJtbI0-x1UF-Fiqu4pLKjHUJNn2ZmXDlgkNuPdIAZjbq5wa191E4rCko8eMKtr&sai=AMfl-YTs6YXYbWSmlDksQry1deXd4KvxilxCc0LOqZA_lDx--xQPzV9Thkm1oFY7eO7QQWny1dg2bYCQYx8u6ik5jU2KvSTQfFtrFLoGnHX6Qw&sig=Cg0ArKJSzKCSKi0Ob4LtEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6830 73 KB
28 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame 6830 289 KB
98 KB 70ms
47ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:53 GMT
server: AmazonS3
x-amz-request-id: B3AF4FB2CB7667E0
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42195
accept-ranges: bytes
content-length: 99749
x-amz-id-2: RG8WrOn/euzYXC+etzZDBPw7gwj4uRtLknsJYX5sFaBXv7st1n2eYNNwafDNdLDomNZGsjr5xgg=

GET
H2 200 error_handler.js Show response
tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/ Frame 99D2 9 KB
4 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/error_handler.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c77f42aea4f02906b5e36f9f9024db87b1e1b37c818be2126a3e24d158ac4c02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 04 Mar 2020 00:50:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491678
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3882
x-xss-protection: 0
server: cafe
etag: 12722542110663117063
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 00:50:28 GMT

GET
H2 200 6330518418272117337
tpc.googlesyndication.com/simgad/ Frame 99D2 27 KB
28 KB 11ms
9ms Image
image/jpeg 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6330518418272117337

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e6d76ec41c1baf73290dd70b2a10a26051d77980e34d048527b6445e7d403dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 05 Mar 2020 22:50:48 GMT
x-content-type-options: nosniff
age: 326058
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28073
x-xss-protection: 0
last-modified: Tue, 27 Aug 2019 17:28:53 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 05 Mar 2021 22:50:48 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/ Frame 99D2 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a0a556e0975784e00d56bb4b5ccea4ca10e03f6bc1ff88ad56e903c937689db9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 04 Mar 2020 00:53:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491472
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1050
x-xss-protection: 0
server: cafe
etag: 8346891053275810791
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 00:53:54 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 99D2 73 KB
28 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame 99D2 289 KB
98 KB 73ms
54ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:53 GMT
server: AmazonS3
x-amz-request-id: B3AF4FB2CB7667E0
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42195
accept-ranges: bytes
content-length: 99749
x-amz-id-2: RG8WrOn/euzYXC+etzZDBPw7gwj4uRtLknsJYX5sFaBXv7st1n2eYNNwafDNdLDomNZGsjr5xgg=

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
219 B 91ms
67ms Image
image/gif 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=1141506495506630&r=728x90%7C970x250&w=728&h=90

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 03C8 0
0 20ms
19ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuzWfsD68N_L_i1eeIJlP5VNTyc42Ev8Vi-ylrMTgSIIeJtoL0UFnkhVBUmIup8L2QgGddTq1PA2tOfrx2mjtvhA2tpLztgf6mL2upzP2BzGlvhHLsmyDZ_R_swQ68dKe6P_1_G_Dj5m7UdEHkeSWrEDVxnh0X94YMANKze2x8mB7sAezfUFbQRjq750-Q_ABOLZIpPZIzJjkdxjA7M1xn6EEPtBsvVYM3Ue7QTj0AsCfwgjp7DW4lv598_mpE-gZeO8DsBhlazvS2hraOZIBJ_dYBfwNPFW0c&sai=AMfl-YTAaWsZO4DIhoEbSrPzyHlerqocVTJppifKS7hq-PY5OGGX5o_a6vfkLbYuldvaiuEUatyR0fripxHrerkXopwOENAAYQrwTlzpKpzDBA&sig=Cg0ArKJSzI3lbJzRXUmvEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 03C8 73 KB
28 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame 03C8 289 KB
98 KB 30ms
30ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:53 GMT
server: AmazonS3
x-amz-request-id: B3AF4FB2CB7667E0
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42195
accept-ranges: bytes
content-length: 99749
x-amz-id-2: RG8WrOn/euzYXC+etzZDBPw7gwj4uRtLknsJYX5sFaBXv7st1n2eYNNwafDNdLDomNZGsjr5xgg=

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=137718984&t=pageview&_s=1&dl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2F...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-135180592-2&cid=2079498175.1583774707&jid=494896170&_gid=1576022913.1583774707&gjid=780852929&_v=j81&z=927186576

35 B
102 B

19ms
18ms

Image
image/gif

2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-135180592-2&cid=2079498175.1583774707&jid=494896170&_gid=1576022913.1583774707&gjid=780852929&_v=j81&z=927186576

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Mon, 09 Mar 2020 17:25:07 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:06 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-135180592-2&cid=2079498175.1583774707&jid=494896170&_gid=1576022913.1583774707&gjid=780852929&_v=j81&z=927186576
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 418
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0B8C 0
0 49ms
40ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvcPGEkJWG2d2HQhmIH9Rr8gY3RC8D0tO6lPoVPBo8MittTulL2HfB3-Dilk_dLt1LtDfOxX-hqY9NM_EqwYRN1O0TR7KKQdOnXMzhe5E_DaVkTx-bfs_ljnODKnMm2BFvwSHApQ-nvEX4jRKjY88hAyzHLxa9w1wZiNN_Q9508oGjD-vfVOnKtT73iJ-MM6qA22U8NxjETB_a_WIhM0Q50_8Je0rqijiz9DswGyVMuzQOggzZmGIeDqTcxIE-1vquGZNYjM8TvOs3HdHIr0evWKO76XPrH2G78&sai=AMfl-YSyezlPdm_IoBFLeM9AxW1XWzCUolZyJabogCuCIJtV00cNcoA5bwUJ1JiDAgj8C2rfYCQfUxD1G8BdWVNpsFtMtINgOEyRqMcgtY2mIg&sig=Cg0ArKJSzHpX0H8LAsL6EAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0B8C 73 KB
28 KB 26ms
16ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame 0B8C 289 KB
98 KB 17ms
8ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:53 GMT
server: AmazonS3
x-amz-request-id: B3AF4FB2CB7667E0
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42195
accept-ranges: bytes
content-length: 99749
x-amz-id-2: RG8WrOn/euzYXC+etzZDBPw7gwj4uRtLknsJYX5sFaBXv7st1n2eYNNwafDNdLDomNZGsjr5xgg=

GET
H2 200 error_handler.js Show response
tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/ Frame 7B87 9 KB
4 KB 15ms
12ms Script
text/javascript 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/error_handler.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c77f42aea4f02906b5e36f9f9024db87b1e1b37c818be2126a3e24d158ac4c02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 04 Mar 2020 00:50:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491678
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3882
x-xss-protection: 0
server: cafe
etag: 12722542110663117063
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 00:50:28 GMT

GET
H2 200 12369806259566731077
tpc.googlesyndication.com/simgad/ Frame 7B87 37 KB
37 KB 16ms
13ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12369806259566731077

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

999023ff259a0e58ef0053e6b5b512af582f7f032d11a79a1a212ec2be8e27df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 04 Feb 2020 14:11:55 GMT
x-content-type-options: nosniff
age: 2949191
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37689
x-xss-protection: 0
last-modified: Mon, 27 Jan 2020 21:59:08 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Feb 2021 14:11:55 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/ Frame 7B87 2 KB
1 KB 14ms
11ms Script
text/javascript 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a0a556e0975784e00d56bb4b5ccea4ca10e03f6bc1ff88ad56e903c937689db9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 04 Mar 2020 00:53:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491472
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1050
x-xss-protection: 0
server: cafe
etag: 8346891053275810791
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 00:53:54 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7B87 73 KB
28 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame 7B87 289 KB
98 KB 18ms
16ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:55 GMT
server: AmazonS3
x-amz-request-id: 20F1C6301E8D945C
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=0
accept-ranges: bytes
content-length: 99749
x-amz-id-2: QEngLMpPIIfF9MVBia8EDrdKpu2mbQUfqivWrJ6RGlpoaXJ5nHHHdRe0FoCPP4BGPbBXnwObFFQ=

GET
H2 200 DR-hot-topics-comment.png
img.deusm.com/darkreading/ 1 KB
1 KB 16ms
13ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/darkreading/DR-hot-topics-comment.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9182e8a1e20a5437d2f311b096b2a98a33d54e94d4d9d6d01c5db3861460d04e

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.27
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT
cf-cache-status: HIT
last-modified: Fri, 21 Feb 2014 14:56:02 GMT
server: cloudflare
age: 3446
etag: "4a5-4f2ebd20ac480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4e7e3497a2-FRA
content-length: 1189

GET
H2 200 /
www.facebook.com/tr/ 44 B
248 B 9ms
9ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=832000476880185&ev=PageView&dl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&rl=&if=false&ts=1583774706976&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=30&fbp=fb.1.1583774706975.331263687&it=1583774706745&coo=false&rqm=GET

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:06 GMT, Mon, 09 Mar 2020 17:25:06 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 09 Mar 2020 17:25:06 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 99D2 0
0 20ms
19ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpF71U0XY6rBymZOLv1IzgJSrLt_U5PKsi8ftF12F5u4bPL9OghhLDjEKj12Fh3GXEYbz33z9CfYlwakJzT9qpk0RE0-ZBhbGTtjmintgpirfVW5IrGHo64FYGsE3aweepoCfRTn8Q23a7RMU0o5_YgK8VPKIMLAsMCaR4NUVoQz6W9wQ3b5RcAEEfsr4NNC4bbJKcnRf1Y90_4Fo1U7ZQNnrq4oDB8zRQWUWFXqHYbyT9TYyzBMaFcGP0Q1A1bak0MOaPu5bwH3qobvFL7z1W_MEt420&sai=AMfl-YRMSWqjy8NHlv9NXrqE8wAFS49Aic_VOeKyhFgcFsOqKsmJDIBghobCnYc0cHzU6f-XMObvFKWqgVrXWLKeHsPos1cRa8mkv0BkGGU-mw&sig=Cg0ArKJSzPIWata1mSHAEAE&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK web.js Show response
ads.celtra.com/ae3ce7b5/ Frame 0B8C 14 KB
5 KB 55ms
18ms Script
application/javascript 3.120.242.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.celtra.com/ae3ce7b5/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjssHicAim8qggHNzGdCpi2X2NJVlyRziP7KwkKoot7NEOzPqc4ptvDfimWht1AsWjmf7_SCbfwZlO_ChrBi_G72kschVUnhB98nU6f8byL9C7HdCsGpuGZf59oCchureo_yR8ckdh1HpWPkI1g7AIqeRlurNtZYMke1J6lWMtZjJu0Urwto9wQOzE2VWcIX7c_2ZfLlE-K9RK_SyaV5jKdR0btZ1IoDlpFstRog73lJmyFO3NclU7dVJxAaImG2V6xxvZSyIf8th1kNgjFml2xg_UE7fxk7B%252526sai%25253DAMfl-YTh5OmtmlSXEw2sCcNNde1KN0RV5Sz-6fm-JfJcS14-xNuylY72k-PAabWtmcneCTlhYpnT7vzqJpUJK2kccb_6S9wn6IYuX9kp32QxTA%252526sig%25253DCg0ArKJSzPXR0yymszALEAE%252526urlfix%25253D1%252526adurl%25253D&expandDirection=undefined&clickEvent=advertiser&externalAdServer=DCM&tagVersion=6&externalCreativeId=138301772089&externalPlacementId=43863396&externalSiteId=27868836&externalLineItemId=5271825262&externalCampaignId=2652522375&externalCreativeSize=&externalUserId=%25m&externalDestinationUrl=&scriptId=celtra-script-1&clientTimestamp=1583774707.046&clientTimeZoneOffsetInMinutes=-60&hostPageLoadId=026821125012707947
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.242.149 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-120-242-149.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: fc937ce1b8ba00973e0ae5a18c30dada07a271d1e3f86f6a3b38aa28944924e1

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:07 GMT
Content-Encoding: gzip
Content-Type: application/javascript; charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 4586
Expires: 0

GET
H2 200 NL-button.png
img.deusm.com/informationweek/ 2 KB
3 KB 11ms
10ms Image
image/png 2606:4700:3036::681c:3e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.deusm.com/informationweek/NL-button.png
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:3e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b5688f8b168e06251901442c4f2f72b30c4477cb472833cde7979a8dca0a862

Request headers

Referer: https://www.darkreading.com/styles/pano-framework.css?v1.27
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2013 15:09:43 GMT
server: cloudflare
age: 3447
etag: "9c6-4eaabc5a3dbc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 57167e4f2ee797a2-FRA
content-length: 2502

GET
DATA 200
OK truncated
/ Frame 6DC8 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 32df070de698280624a56831ba45ed7d81aca91656449c995bc27b7ecc8c0d39

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 6830 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a78175dbd179decf574f642359a7023ec93803a7860733da37387c298e1047f8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 99D2 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 986a9a68846891187a526dae3ba212d577c71244ee1a61550098d867c07e8b03

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ Frame 6DC8 26 KB
12 KB 33ms
32ms Script
application/javascript 52.215.103.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?922020
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.103.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-103-126.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 9c6af299685617864c257472040f437ef951afec994720a24781931cc3527017

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:06 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Mar 2020 06:28:27 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=47000
Connection: keep-alive
Content-Length: 11933
Expires: Tue, 10 Mar 2020 06:28:27 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ 113 B
287 B 84ms
33ms Script
text/html 35.177.85.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707104&de=800992366892&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=2&cb=0&ym=0&cu=1583774707104&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&zMoatPS=welcome&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=welcome&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=2101450804&cs=0&callback=MoatDataJsonpRequest_8772993
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.177.85.121 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-177-85-121.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 08b9930656cc11228e9fff356f686957aaae564864fd833f682d8a7cf9b2568f

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
server: TornadoServer/4.5.3
etag: "debe25cb5fed3b6cf74c5063727da5240f09c9f7"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 113

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707104&de=800992366892&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=3&cb=0&ym=0&cu=1583774707104&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&zMoatPS=welcome&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=welcome&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1868609750&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 39ms
39ms Fetch
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=640989409269461&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=3d224dcaefabd859e751450e71c4adb5&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/
Origin: https://www.darkreading.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
x-fb-debug: zjC5t4cYVInKMn4+DBQwmXWURmsI810M4K5FaIvLtqUCQVb52i5pax/7jWAHZZYQuQRvesFtOzzendRxL61VVw==
fb-s: unknown
status: 200
date: Mon, 09 Mar 2020 17:25:07 GMT, Mon, 09 Mar 2020 17:25:07 GMT
strict-transport-security: max-age=15552000; preload
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.darkreading.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-27=":443"; ma=3600
content-length: 0
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7B87 0
0 18ms
18ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6NayEkhtHp2OjVbCZxWNoMOyrvaJNp_RYuoydxfmtdX6y_71vejeM2NaLncX0C55e8Ecp9E7RJobuoUkf7n3JgT4cHBuxLCJiCMQQ72ahfoz__6mDVLWY93feQRh2nt7n5acndkjGPzoBnt3VvCEYHdoT_7DeC2uo2oh65ThLvVe0xRVf-2zU8Foyh348r1YvlNhTVmdG9LM16rLSrElmX6P9gzRxkAvi5YMEqFv83WvQK1pJIOK6HfAWAb7vzuhfB-m8kRT8qybhcjEWA7cPjhSCWrYiw6Ll&sai=AMfl-YSK-Sr0JAXUUpuuHxQkn1Gi54eOG7cW1C29XO70YUDW7UhHq22HJTQc4zsSTCb3rT2-6jtd3dWkPiAp4OcleOP82ydpYtRjKUdyvDqmmA&sig=Cg0ArKJSzIrqyx9y0YKdEAE&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0B8C 221 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b10a4f01914d6d1d67b68554e556679bbdc63005698cdd7bfc6b44cb69da4b2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 7B87 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91b999073494a3ced432cb47d480d8402966c7c01f43a25439695c73b7c7dcf6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 error_handler.js Show response
tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/ Frame CD34 9 KB
4 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/error_handler.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c77f42aea4f02906b5e36f9f9024db87b1e1b37c818be2126a3e24d158ac4c02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 04 Mar 2020 00:50:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491679
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3882
x-xss-protection: 0
server: cafe
etag: 12722542110663117063
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 00:50:28 GMT

GET
H2 200 12233897056553615782
tpc.googlesyndication.com/simgad/ Frame CD34 24 KB
24 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12233897056553615782

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46e1109b1a9dc991584ac42539c30d102c54689b011168c0c0d12af0ab4c4efb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 05 Mar 2020 21:09:56 GMT
x-content-type-options: nosniff
age: 332111
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 24535
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 19:53:08 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 05 Mar 2021 21:09:56 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/ Frame CD34 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20200303/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a0a556e0975784e00d56bb4b5ccea4ca10e03f6bc1ff88ad56e903c937689db9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 04 Mar 2020 00:53:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491473
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1050
x-xss-protection: 0
server: cafe
etag: 8346891053275810791
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Mar 2020 00:53:54 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame CD34 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame CD34 289 KB
98 KB 9ms
8ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:53 GMT
server: AmazonS3
x-amz-request-id: B3AF4FB2CB7667E0
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42194
accept-ranges: bytes
content-length: 99749
x-amz-id-2: RG8WrOn/euzYXC+etzZDBPw7gwj4uRtLknsJYX5sFaBXv7st1n2eYNNwafDNdLDomNZGsjr5xgg=

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707173&de=340090255465&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=7&cb=0&ym=0&cu=1583774707173&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20049636%3A2624997803%3A5223470855%3A138303914748&zMoatPS=wallpaper&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=wallpaper&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1045417734&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 web.js Show response
cache-ssl.celtra.com/api/creatives/fb77a540/compiled/ Frame 0B8C 596 KB
129 KB 30ms
12ms Script
application/javascript 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cache-ssl.celtra.com/api/creatives/fb77a540/compiled/web.js?v=41-9d1dda24f1&secure=1&cachedVariantChoices=W10-&eventMetadataExperiment=newMeta&inmobi=0&adx-in-banner-video=1
Requested by: Host: ads.celtra.com
URL: https://ads.celtra.com/ae3ce7b5/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjssHicAim8qggHNzGdCpi2X2NJVlyRziP7KwkKoot7NEOzPqc4ptvDfimWht1AsWjmf7_SCbfwZlO_ChrBi_G72kschVUnhB98nU6f8byL9C7HdCsGpuGZf59oCchureo_yR8ckdh1HpWPkI1g7AIqeRlurNtZYMke1J6lWMtZjJu0Urwto9wQOzE2VWcIX7c_2ZfLlE-K9RK_SyaV5jKdR0btZ1IoDlpFstRog73lJmyFO3NclU7dVJxAaImG2V6xxvZSyIf8th1kNgjFml2xg_UE7fxk7B%252526sai%25253DAMfl-YTh5OmtmlSXEw2sCcNNde1KN0RV5Sz-6fm-JfJcS14-xNuylY72k-PAabWtmcneCTlhYpnT7vzqJpUJK2kccb_6S9wn6IYuX9kp32QxTA%252526sig%25253DCg0ArKJSzPXR0yymszALEAE%252526urlfix%25253D1%252526adurl%25253D&expandDirection=undefined&clickEvent=advertiser&externalAdServer=DCM&tagVersion=6&externalCreativeId=138301772089&externalPlacementId=43863396&externalSiteId=27868836&externalLineItemId=5271825262&externalCampaignId=2652522375&externalCreativeSize=&externalUserId=%25m&externalDestinationUrl=&scriptId=celtra-script-1&clientTimestamp=1583774707.046&clientTimeZoneOffsetInMinutes=-60&hostPageLoadId=026821125012707947
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 89c196ec658af676f972dba9c07c0da79d2c6434e38c01698187488db700197d

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 05 Mar 2020 13:06:50 GMT
content-encoding: gzip
age: 361097
x-cache: Hit from cloudfront
status: 200
content-length: 130941
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
server: Apache
etag: "10d488084a3d92a95913f976b35230db1e60fad014c01469b022394f7bf80139"
vary: Accept-Encoding
x-varnish: 2457771
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: KIfAhB1KVE_gO5HUQptWVe4YDgT33BRxuj8fIPwm-SjsSB35M67YDA==

GET
DATA 200
OK truncated
/ Frame 0B8C 167 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
BLOB 200
OK 37281778-359b-4d9b-99ac-3185fc4d4f27
https://www.darkreading.com/ Frame 0B8C 167 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.darkreading.com/37281778-359b-4d9b-99ac-3185fc4d4f27
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Content-Length: 167
Content-Type: image/png

GET
H2 200 spacer.gif
img.lightreading.com/images/ 49 B
374 B 100ms
13ms Image
image/gif 13.227.156.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.lightreading.com/images/spacer.gif
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.227.156.100 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-156-100.muc51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 06:21:58 GMT
via: 1.1 a4e2e59f66a1d4717bfa6c64f818168c.cloudfront.net (CloudFront)
last-modified: Fri, 20 Jun 2014 19:05:53 GMT
server: AmazonS3
age: 39790
etag: "4909631c93ffa90e65247e3fd4454f2d"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: MUC51-C1
accept-ranges: bytes
content-length: 49
x-amz-cf-id: ySlojOaX_bCLBOQNxql5HXiFSc6hS3OlSsmX7beuJaFKsG0rw6-ZNg==

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame CD34 0
0 18ms
18ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssLKbZLNFE5DLVzPCrHXbQhntvcxIK6KtTd1kOYKpr7KcJZyS7AI9nz8nkei_T4U1hc5mszTs8ByEbdmPUlPWSxOCgghOGead-3j75bG1VOpiFRepDaw9NPvlb_8SL1NsMC68nJCd4-e4wixqZdr3xHDHsk-STUnupCG5HJP2_T-IxXWtzmAoKGB0sQbEIVGsZipLWq8I1Yey7zcNZRQXqN5AiokoCeN2j7mB1JszQClMyERoq65Hprl_OzGQmQ9pycTPxBfjNh_P9gLK_6v5L3zKbtFhc&sai=AMfl-YSpG25rwXkG7qQP1-iH-Of8ZUpTscHlYZV0qT8qrvv7geqq-ulwHyeFbBHalyRZH-17uoCw9KVo9byy797ufkPk9oWa_mkqBWijYR71QQ&sig=Cg0ArKJSzCSW-pTwiR7mEAE&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame CD34 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b79f5c38e0f42108b7a0a64434e881acb07f31b1a36d67fba9502b39ed827df4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707196&de=701337247319&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=11&cb=0&ym=0&cu=1583774707196&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&zMoatPS=top&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=top&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1789557625&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8479 0
0 21ms
20ms Fetch
image/gif 172.217.23.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst-AiwVb3KpQvidlXZ70wgASstyIyP1FcnPqNISMMfOWZmL3T9QbxMjujp1f9iN7V9pxYIxXqVUJ31bK8w8soPQhbECntohyVIYVvmox-bo0CSBnPbrqY3erZ2op5N3zuSN79DL51gAS5n5veeAGhWXM6MKqVXF9JxMWSh7oZIKLyW3TaD4sUYL2uao4EJquQHx3rT4vqLTnFvMl7mX4163F9TJ4IVcqWtLB1nWUzsqsQ_XgL-Mnt6PjDycu7gs0YUkTe5ayXRN_uCTA6bEh1zZq6eYjA&sai=AMfl-YQELjD975eIj6GLri-Q8rWaRbPcO0OdgZH3cMwjwiDXBwTyZ6deo27GBpYd3HSWadddRNf5cnuLiIB835G7TCiWenbWFGEllP1Mg_lPdA&sig=Cg0ArKJSzGrniUnShfjUEAE&urlfix=1&adurl=

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 tag Show response
a.teads.tv/page/11512/ Frame 8479 1 KB
995 B 34ms
8ms Script
application/javascript 2.18.232.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/11512/tag
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 06a65aae752e354adc66b935cb0fade25c9d8a058817ea4905777409ad6d4ba7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
access-control-allow-origin: *
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: private, must-revalidate, max-age=3600
access-control-allow-credentials: true
content-length: 663
expires: Mon, 09 Mar 2020 18:25:07 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8479 73 KB
28 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1583497562441669"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28126
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/pentonmedia53440730609/ Frame 8479 289 KB
98 KB 9ms
8ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
last-modified: Thu, 20 Feb 2020 16:31:53 GMT
server: AmazonS3
x-amz-request-id: B3AF4FB2CB7667E0
etag: "a12bd163654327e7ec198d6d87345585"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42194
accept-ranges: bytes
content-length: 99749
x-amz-id-2: RG8WrOn/euzYXC+etzZDBPw7gwj4uRtLknsJYX5sFaBXv7st1n2eYNNwafDNdLDomNZGsjr5xgg=

POST
H2 200 /
www.facebook.com/tr/ 0
30 B 7ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Origin: https://www.darkreading.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryw9MqWNw6AKbtNgDK

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://www.darkreading.com
date: Mon, 09 Mar 2020 17:25:07 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-27=":443"; ma=3600
content-length: 0

GET
H2 200 s57239109942171
ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/ 43 B
244 B 24ms
23ms Image
image/gif 15.188.31.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/s57239109942171?AQB=1&ndh=1&pf=1&t=9%2F2%2F2020%2018%3A25%3A7%201%20-60&mid=41888968043932876440531699762270838695&aamlh=6&ce=UTF-8&ns=ubmtech&pageName=darkreading.com%20attacks%2Fbreaches%20jai%20vijayan%20new%20ransomware%20variant%20developed%20entirely%20as%20shellcode&g=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&cc=USD&events=event5&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&h1=Dark%20Reading%7CAttacks%2FBreaches&c2=1337260&v2=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c3=Dark%20Reading%20%7C%201337260%20%7C%20New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c4=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&c5=Attacks%2FBreaches%20-%20Attacks%2FBreaches&c7=Jai%20Vijayan&c8=2a01%3A4f8%3A192%3A5414%3A%3A2%20%7C%20Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&v10=monday%7C1%3A00pm&c11=News%20Analysis&v12=1337260&c13=monday%7C1%3A00pm&v13=www.darkreading.com&v15=First%20Visit&c17=New&v17=New&c19=Un-Registered&c20=20200306&c22=First%20Visit&c23=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&v28=Jai%20Vijayan&v37=News%20Analysis&c41=2&c48=1&v48=1&c50=2.8.2&v61=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&AQE=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
x-c: master-1187.Ief0e9e.M0-357
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 10 Mar 2020 17:25:07 GMT
server: jag
xserver: anedge-5dd475c59f-ffldh
etag: 3401130285483786240-4614162015672357021
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sun, 08 Mar 2020 17:25:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 13ms
12ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F6330518418272117337&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707196&de=701337247319&cu=1583774707196&m=18&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2466&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=3&an=0&gf=3&gg=0&ix=3&ic=3&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=3&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&bo=27868836&bp=43863396&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=2118247425&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H/1.1 200
OK widget_iframe.0ab153032b20288d9a500659d8c7ba17.html
platform.twitter.com/widgets/ Frame 8937 0
0 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.0ab153032b20288d9a500659d8c7ba17.html?origin=https%3A%2F%2Fwww.darkreading.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40DD) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 300529
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 09 Mar 2020 17:25:07 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Wed, 04 Mar 2020 23:33:04 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40DD)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5825

GET
H2 200 like.php
www.facebook.com/plugins/ Frame 7231 0
0 81ms
81ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D46%23cb%3Df1124314c070434%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff21144df00fb5c%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=3d224dcaefabd859e751450e71c4adb5&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D46%23cb%3Df1124314c070434%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff21144df00fb5c%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: fr=0GxyAJAwjnecad9AF..BeZnvy...1.0.BeZnvy.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
strict-transport-security: max-age=15552000; preload
content-encoding: br
timing-allow-origin: *
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-type: text/html; charset="utf-8"
x-fb-debug: xQV3wltD+tOIciOtybpUtQnEuMv4vK+5qTGz6Pt3yHekFKyYlsVEJTyez4fuwoXUG45wNY3M8dZUG+J3apX5jQ==
date: Mon, 09 Mar 2020 17:25:07 GMT Mon, 09 Mar 2020 17:25:07 GMT
alt-svc: h3-27=":443"; ma=3600

GET
H2 204 record.do
ins.techweb.com/beacon/ Frame 73D6 0
0 498ms
498ms Document
text/plain 2606:4700:3035::6812:28f2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.techweb.com/beacon/record.do?a=68841bbbf037b3bd9eda236cfd0edcb96932f665438d7b833aaa994d869277ac&u=https%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fnew-ransomware-variant-developed-entirely-as-shellcode%252Fd%252Fd-id%252F1337260&t=P
Requested by: Host: ins.techweb.com
URL: https://ins.techweb.com/beacon/js/beacon-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:28f2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: ins.techweb.com
:scheme: https
:path: /beacon/record.do?a=68841bbbf037b3bd9eda236cfd0edcb96932f665438d7b833aaa994d869277ac&u=https%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fnew-ransomware-variant-developed-entirely-as-shellcode%252Fd%252Fd-id%252F1337260&t=P
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

status: 204
date: Mon, 09 Mar 2020 17:25:08 GMT
set-cookie: __cfduid=d3ed5d526cd214e9b3be34e0efc4d213e1583774707; expires=Wed, 08-Apr-20 17:25:07 GMT; path=/; domain=.techweb.com; HttpOnly; SameSite=Lax Insights=24-bb26d82c-d83f-4ba1-bfd9-72c022c911e1; Domain=.techweb.com; Expires=Sat, 08-Mar-2025 17:25:08 GMT; Path=/
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 57167e528fbd3248-FRA

GET
H/1.1 200
OK elqCfg.min.js Show response
img.en25.com/i/ 6 KB
3 KB 54ms
23ms Script
application/x-javascript 23.62.118.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img.en25.com/i/elqCfg.min.js

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.62.118.225 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-62-118-225.deploy.static.akamaitechnologies.com

Software

Resource Hash

6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Jan 2020 17:21:27 GMT
ETag: "164336148d1d51:0"
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-cache, no-store
Date: Mon, 09 Mar 2020 17:25:07 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 2115
Expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
DATA 200
OK truncated
/ Frame 8479 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6bc989074a638723131c3bc22eead89716e09dc81f6c58ea823899ca45928cf6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK moment~timeline~tweet.455020da08b6506cf851a0b4f3301f17.js Show response
platform.twitter.com/js/ 24 KB
8 KB 7ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline~tweet.455020da08b6506cf851a0b4f3301f17.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4191) /
Resource Hash: b5dfc0d97e0734652638fc54c6174755ae124537eaecf8df5df3f37ce857bd9e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Mar 2020 23:32:52 GMT
Server: ECS (fcn/4191)
Age: 326473
Etag: "cc60fd1793986415fac893ab3f63748e+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 7865

GET
H/1.1 200
OK timeline.d228dcf3573461f298b082c9a5c0a42c.js Show response
platform.twitter.com/js/ 21 KB
7 KB 14ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/timeline.d228dcf3573461f298b082c9a5c0a42c.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40D0) /
Resource Hash: 72945876902af2cd35e37c7dc27c9a1ece0e3f3185100c36f5e55e468182467a

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Mar 2020 23:32:53 GMT
Server: ECS (fcn/40D0)
Age: 326467
Etag: "cd03198280cd4775cf9715d3c461a225+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 6656

GET
H/1.1 200
OK button.93a0c25c2d2f3081c705c98c2d9dec0e.js Show response
platform.twitter.com/js/ 7 KB
3 KB 20ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.93a0c25c2d2f3081c705c98c2d9dec0e.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40D0) /
Resource Hash: cef013ba053c40f6bfa36baf6b11dca3426b1697bb52bec0902a4746f5f7d169

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Mar 2020 23:32:51 GMT
Server: ECS (fcn/40D0)
Age: 326471
Etag: "0745fc0bb127ba13d716d66761b4628d+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 2298

GET
H/1.1 200 Cookie set login.jsp
ng.techweb.com/authds/login/ Frame 28C9 0
0 471ms
118ms Document
text/html 2620:103::192:155:48:119
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/script/jquery_3.4.1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:103::192:155:48:119 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: NG /
Resource Hash

Request headers

Host: ng.techweb.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

Set-Cookie: JSESSIONID=78D344AC71046549BFEFBB44A77B0C0B; Path=/; Secure; HttpOnly
vary: accept-encoding
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 755
Date: Mon, 09 Mar 2020 17:25:07 GMT
Server: NG
Content-Encoding: gzip
Connection: Keep-Alive

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 306ms
101ms Image
image/gif 52.45.19.11
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=darkreading.com&p=%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&u=BeVhpEC6POmBGOqPh&d=darkreading.com&g=53678&g0=News&g1=Jai%20Vijayan&n=1&f=00001&c=0&x=0&m=0&y=5019&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=2264&t=DFJLd4B8NvFWCnA-7DDEkhXLL5I1S&V=118&i=New%20Ransomware%20Variant%20Developed%20Entirely%20as%20Shellcode&tz=-60&sn=1&sv=BTX_ObD0Ei5WBOyunHBjSHJGDbxQOn&sd=1&im=067b2fff&_
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.19.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-19-11.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 200
pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
cache-control: no-cache, no-store, must-revalidate
expires: 0
content-length: 43
content-type: image/gif

GET
H2 200 teads-format.min.js Show response
a.teads.tv/media/format/v3/ 683 KB
188 KB 15ms
15ms Script
text/javascript 2.18.232.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/page/11512/tag
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 550c6a88ee405b6fb7ccc8f8c678267cbf9ea9e84943e40666e351236caf13e8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
last-modified: Fri, 06 Mar 2020 11:50:10 GMT
x-amz-request-id: 4B60E1D11D2165FA
etag: "8ea06d687280ac50f6f10b33ef678170"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
status: 200
cache-control: private, must-revalidate, max-age=600, no-transform
x-bucket: b
accept-ranges: bytes
content-length: 191204
x-amz-id-2: cWiZCnM8Ie9TyaOU+VB6uB9LcZEcgtBnmiv4jFp3L5hUjdIp855zN/K7+CEWZjGWcCG1hiAieMk=
expires: Mon, 09 Mar 2020 17:35:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 14ms
13ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707239&de=720726408576&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=15&cb=0&ym=0&cu=1583774707239&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4743426211%3A2649638154%3A5305207436%3A138305361674&zMoatPS=native&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=native&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1709148036&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 406ms
102ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjAsImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwNy42ODcsIm5hbWUiOiJjb250YWluZXJCZWNhbWVWaWV3YWJsZSJ9XX0=?crc32c=1714556210
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 profile Show response
cdn.syndication.twimg.com/timeline/ 171 KB
12 KB 47ms
24ms Script
application/javascript 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_DarkReading_old&dnt=true&domain=www.darkreading.com&lang=en&screen_name=DarkReading&suppress_response_codes=true&t=1759749&tz=GMT%2B0100&with_replies=false

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D3A) /

Resource Hash

adaa73d536a85fc4e5194a0644aac1a330ad70dab0445b4f6770b98d3576b593

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 230
x-cache: HIT
status: 200
content-disposition: attachment; filename=jsonp.jsonp
strict-transport-security: max-age=631138519
content-length: 11568
x-xss-protection: 0
x-response-time: 161
last-modified: Mon, 09 Mar 2020 17:21:17 GMT
server: ECS (lcy/1D3A)
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: must-revalidate, max-age=300
x-connection-hash: 0835931382b8229ebf827e19e64027fc
accept-ranges: bytes
timing-allow-origin: *
x-transaction: 00b2486800c05328
expires: Mon, 09 Mar 2020 17:30:07 GMT

GET
H2 200 syndication
syndication.twitter.com/i/jot/ 43 B
123 B 135ms
135ms Image
image/gif 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?dnt=1&l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1583774707822%2C%22dnt%22%3Atrue%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 0
x-response-time: 122
pragma: no-cache
last-modified: Mon, 09 Mar 2020 17:25:07 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 4483d13387e4c26a29f996681f47b427
x-transaction: 00500c9b00d47625
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1

200
OK

svrGP.aspx Show response
s657486201.t.eloqua.com/visitor/v200/
Redirect Chain

https://s657486201.t.eloqua.com/visitor/v200/svrGP?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=826&firstPartyCookieDomain=trk.darkreading.com
https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=826&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1

0
404 B

121ms
121ms

Script
application/javascript

142.0.160.13
NETDYNAMICS

General

Check archive.org

Show headers Download Go to

Full URL

https://s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=826&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

142.0.160.13 Ashburn, United States, ASN7160 (NETDYNAMICS, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 09 Mar 2020 17:25:08 GMT
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: private,no-cache, no-store
Content-Type: application/javascript
Content-Length: 20
Expires: -1

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Mon, 09 Mar 2020 17:25:08 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: //s657486201.t.eloqua.com/visitor/v200/svrGP.aspx?pps=50&siteid=657486201&DLKey=7435f16d0b5c4189a89d0d109d2517f5&DLLookup=&ms=826&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 325
Expires: -1

GET
H/1.1

200
OK

svrGP.aspx
s2150.t.eloqua.com/visitor/v200/
Redirect Chain

https://s2150.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=826&optin=disabled&firstPartyCookieDomain=trk.darkreading.com
https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=826&optin=disabled&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1

49 B
373 B

189ms
189ms

Image
image/gif

209.167.231.17
NETDYNAMICS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=826&optin=disabled&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

209.167.231.17 , United States, ASN7160 (NETDYNAMICS, US),

Reverse DNS

e017.en25.com

Software

Resource Hash

f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Mon, 09 Mar 2020 17:25:09 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: private,no-cache, no-store
Content-Type: image/gif
Content-Length: 49
Expires: -1

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Mon, 09 Mar 2020 17:25:09 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: //s2150.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=826&optin=disabled&firstPartyCookieDomain=trk.darkreading.com&elqCookie=1
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 305
Expires: -1

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707254&de=856187413122&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=19&cb=0&ym=0&cu=1583774707254&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&zMoatPS=TAPunit&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=TAPunit&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1345258747&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H/1.1 200
OK tweet_button.0ab153032b20288d9a500659d8c7ba17.en.html
platform.twitter.com/widgets/ Frame 51B4 0
0 6ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.0ab153032b20288d9a500659d8c7ba17.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40D0) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 326472
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 09 Mar 2020 17:25:07 GMT
Etag: "34c828ff6fbafe182750e873b1776495+gzip"
Last-Modified: Wed, 04 Mar 2020 23:33:00 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40D0)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 12387

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 9ms
9ms Image
image/gif 23.11.238.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1583774707898&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=96373584&cs_ucfr=1&referer=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.11.238.95 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-11-238-95.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:07 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 track
t.teads.tv/ 23 B
143 B 110ms
77ms Image
image/gif 23.58.216.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=placementCall&ts=1583774707895&pageId=11512&pid=21882&env=js-web&pfid=[pfid]&f=1&fv=265&referer=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.216.7 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-58-216-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 200
date: Mon, 09 Mar 2020 17:25:08 GMT
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 23
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 track
t.teads.tv/ 23 B
143 B 110ms
77ms Image
image/gif 23.58.216.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=slotAvailable&ts=1583774707896&pageId=11512&pid=21882&env=js-web&pfid=[pfid]&f=1&slot=native&fv=265&referer=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.216.7 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-58-216-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 200
date: Mon, 09 Mar 2020 17:25:08 GMT
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 23
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ad Show response
a.teads.tv/page/11512/ 168 B
429 B 67ms
67ms XHR
application/json 2.18.232.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/11512/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&page=%7B%22id%22%3A11512%2C%22placements%22%3A%5B%7B%22id%22%3A21882%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A489%2C%22height%22%3A275%7D%2C%22slotType%22%3A%22native%22%7D%5D%2C%22gdpr_iab%22%3A%7B%22status%22%3A22%2C%22consent%22%3A%22%22%2C%22reason%22%3A220%7D%7D&userId=8f0bd3fc-1ee3-4a49-b64c-0a8efa5428ba&formatVersion=2.22.61&env=js-web&netBw=9.1&ttfb=680
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: eb2994e47a5c04ad9deb84c59d0b7fc3bd9d97d7e830047ea980c2e757577600

Request headers

Accept: application/json; charset=UTF-8
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Origin: https://www.darkreading.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.darkreading.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 169
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 10ms
10ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707264&de=467916279984&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=23&cb=0&ym=0&cu=1583774707264&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=30729156%3A2652522375%3A5271825262%3A138301433147&zMoatPS=rec1&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=rec1&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1466278097&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 imgad
tpc.googlesyndication.com/pagead/ 34 KB
34 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKCXlNaldBABGAEyCG_ySAcDH6AT

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66a92244de497ebea9b54ea4b9ccd71b8737cda6cc1fb99c6a5eb7e7ee809053

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 13:17:40 GMT
x-content-type-options: nosniff
server: cafe
age: 14847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=604800
content-type: image/jpeg
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 34411
x-xss-protection: 0
expires: Mon, 16 Mar 2020 13:17:40 GMT

GET
H2 200 0X-1-Men
pbs.twimg.com/card_img/1233570617380593664/ Frame BF87 6 KB
6 KB 7ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1233570617380593664/0X-1-Men?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/419A) /

Resource Hash

7e2a850bdefa6b9bb2075030d39bcc5dd8f9beb4be4042e772b00657e527c9cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
age: 1427
x-cache: HIT
status: 200
content-length: 6390
x-response-time: 183
surrogate-key: card_img card_img/bucket/5 card_img/1233570617380593664
last-modified: Sat, 29 Feb 2020 01:50:08 GMT
server: ECS (fcn/419A)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: c4f66ba40885cd7800893cdcb6ab5ec3
accept-ranges: bytes

GET
H2 200 DWoDJPlp
pbs.twimg.com/card_img/1236056291241492480/ Frame BF87 5 KB
5 KB 7ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1236056291241492480/DWoDJPlp?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/40DE) /

Resource Hash

58b80e76b2b6651b65aff604f3bd10c953b6e166eb3346c138f920ddc1ad8273

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
age: 240945
x-cache: HIT
status: 200
content-length: 4622
x-response-time: 133
surrogate-key: card_img card_img/bucket/9 card_img/1236056291241492480
last-modified: Fri, 06 Mar 2020 22:27:19 GMT
server: ECS (fcn/40DE)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 73a181d57f778fad0edf59d65ab42f2a
accept-ranges: bytes

GET
H2 200 DNP-QoaV
pbs.twimg.com/card_img/1235994630598127618/ Frame BF87 6 KB
7 KB 12ms
11ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1235994630598127618/DNP-QoaV?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/40E2) /

Resource Hash

7dae52f46383dc9d6ae308dc581ec1e932e36b95b017cbd0fcb7d0b22630b190

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
age: 254200
x-cache: HIT
status: 200
content-length: 6529
x-response-time: 141
surrogate-key: card_img card_img/bucket/9 card_img/1235994630598127618
last-modified: Fri, 06 Mar 2020 18:22:18 GMT
server: ECS (fcn/40E2)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: cbb581458c49e15635df8342a1818c93
accept-ranges: bytes

GET
H2 200 BXChPYVV
pbs.twimg.com/card_img/1232768320639766528/ Frame BF87 8 KB
8 KB 13ms
12ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1232768320639766528/BXChPYVV?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/41AB) /

Resource Hash

4472e0ceca33180067aafdf870091d23fb1a0164e80c07ec1c2bc48db842be73

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
age: 332396
x-cache: HIT
status: 200
content-length: 7884
x-response-time: 134
surrogate-key: card_img card_img/bucket/0 card_img/1232768320639766528
last-modified: Wed, 26 Feb 2020 20:42:06 GMT
server: ECS (fcn/41AB)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: d4b6f5a7a3b1102daababe2a0341418d
accept-ranges: bytes

GET
H2 200 Z_TSE_7a
pbs.twimg.com/card_img/1234894042019835904/ Frame BF87 5 KB
5 KB 6ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1234894042019835904/Z_TSE_7a?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/41AB) /

Resource Hash

49dcb28156fbd6c88489ceae8a96eab5e121f1d6d91c82276532d62645aa760b

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:07 GMT
x-content-type-options: nosniff
age: 456693
x-cache: HIT
status: 200
content-length: 4795
x-response-time: 131
surrogate-key: card_img card_img/bucket/6 card_img/1234894042019835904
last-modified: Tue, 03 Mar 2020 17:28:57 GMT
server: ECS (fcn/41AB)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 3cccc15d9cc517f244b9c5bbd30e8860
accept-ranges: bytes

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F12369806259566731077&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=251&w=301&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707264&de=467916279984&cu=1583774707264&m=13&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=2466&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=2&an=0&gf=2&gg=0&ix=2&ic=2&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=2&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4&cd=0&ah=4&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301433147&bo=27868836&bp=43863396&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1400473357&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:07 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H/1.1 200
OK timeline.6ae14a2a71097d42bfcef79bdb383b8d.light.ltr.css
platform.twitter.com/css/ Frame BF87 52 KB
12 KB 6ms
6ms Stylesheet
text/css 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/timeline.6ae14a2a71097d42bfcef79bdb383b8d.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A8) /
Resource Hash: 12bf529a0f4d0a3f10d003a07d5b91e40579a3da18022a9896a9ccd9e5dc1b33

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 09 Mar 2020 17:25:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Mar 2020 23:32:47 GMT
Server: ECS (fcn/41A8)
Age: 326473
Etag: "0100ec69a2c00683a1ae89e074b822c1+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12155

GET
H/1.1 200
OK timeline.6ae14a2a71097d42bfcef79bdb383b8d.light.ltr.css
platform.twitter.com/css/ 52 KB
52 KB 6ms
6ms Image
text/css 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/timeline.6ae14a2a71097d42bfcef79bdb383b8d.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A8) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 09 Mar 2020 17:25:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Mar 2020 23:32:47 GMT
Server: ECS (fcn/41A8)
Age: 326473
Etag: "0100ec69a2c00683a1ae89e074b822c1+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12155

GET
H2 200 css
fonts.googleapis.com/ Frame 58BC 269 B
364 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400&text=%20BCDEGILMORSUVadeor

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

05fb3aec19b88f9bfe8d138014f7333eace881236b39f8270e02d12705a1fa6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 09 Mar 2020 17:25:07 GMT
server: ESF
date: Mon, 09 Mar 2020 17:25:07 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 09 Mar 2020 17:25:07 GMT

GET
H2 200 iframe
sync.teads.tv/ Frame D726 0
0 77ms
58ms Document
text/html 23.45.108.93
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.teads.tv/iframe?pid=21882&userId=8f0bd3fc-1ee3-4a49-b64c-0a8efa5428ba&gdprIab={%22status%22:22,%22consent%22:%22%22,%22reason%22:220}&fromFormat=true&env=js-web&1583774708024
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.108.93 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-108-93.deploy.static.akamaitechnologies.com
Software: akka-http/10.1.5 /
Resource Hash

Request headers

:method: GET
:authority: sync.teads.tv
:scheme: https
:path: /iframe?pid=21882&userId=8f0bd3fc-1ee3-4a49-b64c-0a8efa5428ba&gdprIab={%22status%22:22,%22consent%22:%22%22,%22reason%22:220}&fromFormat=true&env=js-web&1583774708024
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: cs=1; tt_viewer=bea23f24-05e6-4239-90c8-fdc623b46f85
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

status: 200
content-type: text/html; charset=UTF-8
server: akka-http/10.1.5
vary: Accept-Encoding
content-encoding: gzip
expires: Mon, 09 Mar 2020 17:25:08 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
content-length: 647
set-cookie: tt_bluekai=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_exelate=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_emetriq=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_liveramp=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_neustar=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_salesforce=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_dar=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_skp=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None tt_retargetly=; Expires=Tue, 10 Mar 2020 17:25:08 GMT; Max-Age=86400; Domain=.teads.tv; Path=/; Secure; SameSite=None

GET
H2 200 One%20Phish%2C%20Two%20Phish%2C%20Three%20Phish%2C%20Fraud%20Phish.jpg
cache-ssl.celtra.com/api/blobs/ecb2149c003d7c5bc5369bbae684a912c877da90758ad44987c426db3460652c/ Frame 58BC 24 KB
25 KB 12ms
11ms Image
image/jpeg 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/ecb2149c003d7c5bc5369bbae684a912c877da90758ad44987c426db3460652c/One%20Phish%2C%20Two%20Phish%2C%20Three%20Phish%2C%20Fraud%20Phish.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 4fcf5bed75a5547edeb07af473406d2dac2f503d5619ccfe1292f0c6ebabbb88

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 17 Feb 2020 23:56:18 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1790929
x-cache: Hit from cloudfront
status: 200
content-length: 24801
server: Apache
etag: "4fcf5bed75a5547edeb07af473406d2dac2f503d5619ccfe1292f0c6ebabbb88"
x-varnish: 6142714 6901778
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: j6VFXeCBCHPViLvj4o0rzWQ49MFCl5LODeQZelsRcf_GZ6cwRhgj5g==

GET
H2 200 0X-1-Men
pbs.twimg.com/card_img/1233570617380593664/ Frame BF87 6 KB
6 KB 7ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1233570617380593664/0X-1-Men?format=jpg&name=144x144_2

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.455020da08b6506cf851a0b4f3301f17.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/419A) /

Resource Hash

7e2a850bdefa6b9bb2075030d39bcc5dd8f9beb4be4042e772b00657e527c9cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 1428
x-cache: HIT
status: 200
content-length: 6390
x-response-time: 183
surrogate-key: card_img card_img/bucket/5 card_img/1233570617380593664
last-modified: Sat, 29 Feb 2020 01:50:08 GMT
server: ECS (fcn/419A)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: c4f66ba40885cd7800893cdcb6ab5ec3
accept-ranges: bytes

GET
H2 200 DWoDJPlp
pbs.twimg.com/card_img/1236056291241492480/ Frame BF87 5 KB
5 KB 8ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1236056291241492480/DWoDJPlp?format=jpg&name=144x144_2

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.455020da08b6506cf851a0b4f3301f17.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/40DE) /

Resource Hash

58b80e76b2b6651b65aff604f3bd10c953b6e166eb3346c138f920ddc1ad8273

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 240946
x-cache: HIT
status: 200
content-length: 4622
x-response-time: 133
surrogate-key: card_img card_img/bucket/9 card_img/1236056291241492480
last-modified: Fri, 06 Mar 2020 22:27:19 GMT
server: ECS (fcn/40DE)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 73a181d57f778fad0edf59d65ab42f2a
accept-ranges: bytes

GET
H2 200 DNP-QoaV
pbs.twimg.com/card_img/1235994630598127618/ Frame BF87 6 KB
6 KB 8ms
8ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1235994630598127618/DNP-QoaV?format=jpg&name=144x144_2

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.455020da08b6506cf851a0b4f3301f17.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/40E2) /

Resource Hash

7dae52f46383dc9d6ae308dc581ec1e932e36b95b017cbd0fcb7d0b22630b190

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 254201
x-cache: HIT
status: 200
content-length: 6529
x-response-time: 141
surrogate-key: card_img card_img/bucket/9 card_img/1235994630598127618
last-modified: Fri, 06 Mar 2020 18:22:18 GMT
server: ECS (fcn/40E2)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: cbb581458c49e15635df8342a1818c93
accept-ranges: bytes

GET
H2 200 BXChPYVV
pbs.twimg.com/card_img/1232768320639766528/ Frame BF87 8 KB
8 KB 8ms
8ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1232768320639766528/BXChPYVV?format=jpg&name=144x144_2

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.455020da08b6506cf851a0b4f3301f17.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/41AB) /

Resource Hash

4472e0ceca33180067aafdf870091d23fb1a0164e80c07ec1c2bc48db842be73

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 332397
x-cache: HIT
status: 200
content-length: 7884
x-response-time: 134
surrogate-key: card_img card_img/bucket/0 card_img/1232768320639766528
last-modified: Wed, 26 Feb 2020 20:42:06 GMT
server: ECS (fcn/41AB)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: d4b6f5a7a3b1102daababe2a0341418d
accept-ranges: bytes

GET
H2 200 Z_TSE_7a
pbs.twimg.com/card_img/1234894042019835904/ Frame BF87 5 KB
5 KB 9ms
8ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1234894042019835904/Z_TSE_7a?format=jpg&name=144x144_2

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.455020da08b6506cf851a0b4f3301f17.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/41AB) /

Resource Hash

49dcb28156fbd6c88489ceae8a96eab5e121f1d6d91c82276532d62645aa760b

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 456694
x-cache: HIT
status: 200
content-length: 4795
x-response-time: 131
surrogate-key: card_img card_img/bucket/6 card_img/1234894042019835904
last-modified: Tue, 03 Mar 2020 17:28:57 GMT
server: ECS (fcn/41AB)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 3cccc15d9cc517f244b9c5bbd30e8860
accept-ranges: bytes

GET
H2 200 A4mG0U5P_normal.jpg
pbs.twimg.com/profile_images/885169621795565573/ Frame BF87 2 KB
2 KB 11ms
11ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/885169621795565573/A4mG0U5P_normal.jpg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/40B4) /

Resource Hash

25b438de3e944547e69c6de98e403f46a9aa4fb98e6d1bb34954fd30ebc19b56

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 474967
x-cache: HIT
status: 200
content-length: 1883
x-response-time: 343
surrogate-key: profile_images profile_images/bucket/8 profile_images/885169621795565573
last-modified: Wed, 12 Jul 2017 16:08:58 GMT
server: ECS (fcn/40B4)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 6893c7aec60ff9264cd0151adf95082d
accept-ranges: bytes

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ Frame BF87 44 KB
7 KB 16ms
7ms Stylesheet
text/css 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 220506
x-ton-expected-size: 45170
x-cache: HIT
status: 200
strict-transport-security: max-age=631138519
content-length: 6839
x-response-time: 8
surrogate-key: tfw
last-modified: Tue, 14 May 2019 18:53:54 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-connection-hash: eab7a31320ea11179fdbffcdb0ac32cd
accept-ranges: bytes
expires: Mon, 16 Mar 2020 17:25:08 GMT

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ 44 KB
44 KB 16ms
8ms Image
text/css 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 220506
x-ton-expected-size: 45170
x-cache: HIT
status: 200
strict-transport-security: max-age=631138519
content-length: 6839
x-response-time: 8
surrogate-key: tfw
last-modified: Tue, 14 May 2019 18:53:54 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-connection-hash: eab7a31320ea11179fdbffcdb0ac32cd
accept-ranges: bytes
expires: Mon, 16 Mar 2020 17:25:08 GMT

GET
DATA 200
OK truncated
/ Frame BF87 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame BF87 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame BF87 644 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 the-fundamental-guide-to-building-a-better-security-operation-center-soc.jpeg.jpg
cache-ssl.celtra.com/api/blobs/ac31fa92554ee99e92925a887c3d41e1c952694ab620b812c1b3cd2b3b26f832/ Frame 58BC 9 KB
9 KB 14ms
14ms Image
image/jpeg 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/ac31fa92554ee99e92925a887c3d41e1c952694ab620b812c1b3cd2b3b26f832/the-fundamental-guide-to-building-a-better-security-operation-center-soc.jpeg.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 53f83e776d713dd6b76e98420c835c52e590dad99052a334b4944469786b08b8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 13:55:35 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1913372
x-cache: Hit from cloudfront
status: 200
content-length: 9155
server: Apache
etag: "53f83e776d713dd6b76e98420c835c52e590dad99052a334b4944469786b08b8"
x-varnish: 5476255 3092094
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: jmTkFS5kGPYBl6oRXpyWhPf5T7jK41mwiRHIU771Q7VJteBZwmxzlg==

GET
H2 200 the-essential-guide-to-security.png
cache-ssl.celtra.com/api/blobs/b2dc6daa6d8dbc54f1c3b32d2b3af56cf4fe6b736e89cb8ac9d56b6b6b89f155/ Frame 58BC 14 KB
15 KB 18ms
17ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/b2dc6daa6d8dbc54f1c3b32d2b3af56cf4fe6b736e89cb8ac9d56b6b6b89f155/the-essential-guide-to-security.png?transform=crush&quality=256
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 300da6e41a56c8946f29a6094e4addf4320ea4451e2e1dd8826c919f6c79f639

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 01:59:18 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1956349
x-cache: Hit from cloudfront
status: 200
content-length: 14772
server: Apache
etag: "300da6e41a56c8946f29a6094e4addf4320ea4451e2e1dd8826c919f6c79f639"
x-varnish: 6855257 2821127
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: z_iKDfMT29wJ6QtbQ5pNEitMuuUzYHaIHvi4HHopOCFBjmBzJ4-edg==

GET
H2 200 how%20to%20uplevel%20your%20defenses.jpg
cache-ssl.celtra.com/api/blobs/fa8228d2052a370dacf08cba112fd29f10722f75bca3d2e8e5de118e3e92e73f/ Frame 58BC 33 KB
33 KB 18ms
18ms Image
image/jpeg 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/fa8228d2052a370dacf08cba112fd29f10722f75bca3d2e8e5de118e3e92e73f/how%20to%20uplevel%20your%20defenses.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: c7124f8ff86138008f3386c9fafd3c17a6e5e6c739e6edcf5d47e750f46c1aff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 06:40:46 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1939462
x-cache: Hit from cloudfront
status: 200
content-length: 33641
server: Apache
etag: "c7124f8ff86138008f3386c9fafd3c17a6e5e6c739e6edcf5d47e750f46c1aff"
x-varnish: 2870903
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: fVnao2irFTe0XmN66fq0J6yPcYvuC01evuSKd3uCIx2_xZDxfMWiTA==

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707424&de=191007637240&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=27&cb=0&ym=0&cu=1583774707424&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=21887076%3A2672868198%3A5314204047%3A138305844955&zMoatPS=rec2&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=rec2&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1395915918&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame 58BC 781 B
1 KB 13ms
13ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 19 Sep 2019 00:25:46 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 14921961
x-cache: Hit from cloudfront
status: 200
content-length: 781
server: Apache
etag: "308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish: 5902826
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: JWWVz4rXJW2L3lV2IawCNtD_bdDWmz0B91cLKmqrzP-vI6ez8_RURw==

GET
H2 200 tw_hover.png
cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/ Frame 58BC 777 B
1 KB 17ms
17ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/tw_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 01:29:44 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1612524
x-cache: Hit from cloudfront
status: 200
content-length: 777
server: Apache
etag: "1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e"
x-varnish: 8852695
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: lgAJyGKKLQ9w2AjW3yQQyz2i03-1KU6jq58zqqOnIjHdu4ypUDNntw==

GET
H2 200 li.png
cache-ssl.celtra.com/api/blobs/8abad5101e4e04aaad9758773bd0e6eead30303742f732e5235e7d73be899598/ Frame 58BC 608 B
1 KB 18ms
18ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/8abad5101e4e04aaad9758773bd0e6eead30303742f732e5235e7d73be899598/li.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 2e8c15ba0e22d227940fcc5ae790599e1b32a636d9b28e174e864a4884ee7e48

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 06:38:14 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1939614
x-cache: Hit from cloudfront
status: 200
content-length: 608
server: Apache
etag: "2e8c15ba0e22d227940fcc5ae790599e1b32a636d9b28e174e864a4884ee7e48"
x-varnish: 6132502
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: CanZ2F8EovGVvA_e7vVYTvkY8seUhny7UVA3fC1p42JIFMEfSWoUEw==

GET
H2 200 li_hover.png
cache-ssl.celtra.com/api/blobs/b7a1a128e1e4be19257209f345f26c688422071122ed660518782b609158ad7a/ Frame 58BC 612 B
1 KB 19ms
18ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/b7a1a128e1e4be19257209f345f26c688422071122ed660518782b609158ad7a/li_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 3bb72e5a3bd7858a708f629dfc7e2f2aa9d87ee8a43b1c22b300e49cd59b09d7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 06 Feb 2020 07:20:19 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2801089
x-cache: Hit from cloudfront
status: 200
content-length: 612
server: Apache
etag: "3bb72e5a3bd7858a708f629dfc7e2f2aa9d87ee8a43b1c22b300e49cd59b09d7"
x-varnish: 1283940
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: iSV21LahOmO_4m3RJWol_xC_y2by97k7gSJR-zp87RW2R0e-ZP0LYQ==

GET
H2 200 fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame 58BC 348 B
862 B 18ms
18ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 17 Feb 2020 05:44:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1856440
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish: 2528039 5524949
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: pVO14NNDXHz4FGxDUXECn6biB5oOuKJHEcqhgIDHEvpfd61vcTOpZg==

GET
H2 200 fb_hover.png
cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/ Frame 58BC 348 B
854 B 18ms
18ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/fb_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 04:24:32 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2034036
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39"
x-varnish: 83703
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: kXHr9BcyNpccPoQfHGSfHSiVk4VhgdL2qvpqtkST4atkz9hHa_YN7w==

GET
H2 200 yt.png
cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/ Frame 58BC 914 B
1 KB 19ms
18ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/yt.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 25 Jan 2020 00:08:03 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 3863825
x-cache: Hit from cloudfront
status: 200
content-length: 914
server: Apache
etag: "8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28"
x-varnish: 6724994
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: TQSMbAZiqT06MHFf-n4M5kCSNYhzsMlOYeVMIoBq4aUYi5gb9w8vBQ==

GET
H2 200 yt_hover.png
cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/ Frame 58BC 918 B
1 KB 19ms
19ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/yt_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 06:02:37 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2028150
x-cache: Hit from cloudfront
status: 200
content-length: 918
server: Apache
etag: "6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677"
x-varnish: 632457
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: OTFMtj4fFCYmKIwZyPLNALVcgh_uNOfwf9kxEZZXW6Vgto5rqXMq5w==

GET
H2 200 The%20SIEM%20Buyers%20Guide%20for%202020.jpeg.jpg
cache-ssl.celtra.com/api/blobs/dd0e38d4a8b6756d7eafd68a1381a554411570385bd98f31b199708d056716a1/ Frame 58BC 15 KB
15 KB 12ms
11ms Image
image/jpeg 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/dd0e38d4a8b6756d7eafd68a1381a554411570385bd98f31b199708d056716a1/The%20SIEM%20Buyers%20Guide%20for%202020.jpeg.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 85825dee492b21f4730c29f8be895a878ef69e5780d87b57659341626d337193

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 08:51:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2018021
x-cache: Hit from cloudfront
status: 200
content-length: 15253
server: Apache
etag: "85825dee492b21f4730c29f8be895a878ef69e5780d87b57659341626d337193"
x-varnish: 6232255
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: LPC0n8R_6pc3iTh8i5F-bPFd5LC56pqwbz5GRL1Yp4d4jpbPtZoRaA==

GET
H2 200 splunk-logo.png
cache-ssl.celtra.com/api/blobs/470f3ac2f042a93825f23e987a7252b94b94086eaeadc1ef123c4bc40a8acf8a/ Frame 58BC 7 KB
8 KB 12ms
11ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/470f3ac2f042a93825f23e987a7252b94b94086eaeadc1ef123c4bc40a8acf8a/splunk-logo.png?transform=crush&quality=256
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 50152a4756f38eac1830111c706d04740b68ddb53d97aa94c68de6026235b18e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 06:40:45 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1939462
x-cache: Hit from cloudfront
status: 200
content-length: 7301
server: Apache
etag: "50152a4756f38eac1830111c706d04740b68ddb53d97aa94c68de6026235b18e"
x-varnish: 1322025
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: IpFNdEDkYMZZui0qURQROzDdkBiQ6gq4HvK1cCP0XSg1Wh5WLb909Q==

GET
H2 200 font
fonts.gstatic.com/l/ Frame 58BC 2 KB
2 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/l/font?kit=S6uyw4BMUTPHvxw6WQevLjTIr55xq7MRmoOKXtz4bjVMPb5_&skey=2d58b92a99e1c086&v=v16

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f3c29694754d2b8fd7c310f93f42217d6a01acefe0606f5778d4f804c4eb895a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Lato:400&text=%20BCDEGILMORSUVadeor
Origin: https://www.darkreading.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 09 Mar 2020 13:51:23 GMT
x-content-type-options: nosniff
age: 12825
status: 200
content-disposition: attachment; filename="font.woff2"; filename*=UTF-8''font.woff2
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2276
x-xss-protection: 0
last-modified: Tue, 23 Jul 2019 17:22:44 GMT
server: ESF
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: private, max-age=86400
timing-allow-origin: *
expires: Mon, 09 Mar 2020 13:51:23 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F12233897056553615782&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707424&de=191007637240&cu=1583774707424&m=19&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3990&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=0&su=1&of=1&oz=0&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=21887076%3A2672868198%3A5314204047%3A138305844955&bo=27868836&bp=43863396&bd=rec2&zMoatPS=rec2&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=511448064&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1583774707622&de=142259656182&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=31&cb=0&ym=0&cu=1583774707622&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=17527716%3A193997916%3A42403476%3A138212589663&zMoatPS=video&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=video&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A2164&fs=177454&na=1391128820&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 splunk-logo.png
cache-ssl.celtra.com/api/blobs/470f3ac2f042a93825f23e987a7252b94b94086eaeadc1ef123c4bc40a8acf8a/ Frame 58BC 7 KB
8 KB 12ms
12ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/470f3ac2f042a93825f23e987a7252b94b94086eaeadc1ef123c4bc40a8acf8a/splunk-logo.png?transform=crush&quality=256
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 50152a4756f38eac1830111c706d04740b68ddb53d97aa94c68de6026235b18e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 06:40:45 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1939462
x-cache: Hit from cloudfront
status: 200
content-length: 7301
server: Apache
etag: "50152a4756f38eac1830111c706d04740b68ddb53d97aa94c68de6026235b18e"
x-varnish: 1322025
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: LzpV0E1RFmHJhvkf-HU6RUi1gx8Jb-NoPB2EjQaXHL_DIJh3cf9SCQ==

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/ecb2149c003d7c5bc5369bbae684a912c877da90758ad44987c426db3460652c/One%20Phish%2C%20Two%20Phish%2C%20Three%20Phish%2C%20Fraud%20Phish.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 4fcf5bed75a5547edeb07af473406d2dac2f503d5619ccfe1292f0c6ebabbb88

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 17 Feb 2020 23:56:18 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1790929
x-cache: Hit from cloudfront
status: 200
content-length: 24801
server: Apache
etag: "4fcf5bed75a5547edeb07af473406d2dac2f503d5619ccfe1292f0c6ebabbb88"
x-varnish: 6142714 6901778
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: 7hO4gSGVadJA2dJaddWZnVm4ZQtw6hgZGuTAcN1bR3SUEL5MLYuL2w==

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/ac31fa92554ee99e92925a887c3d41e1c952694ab620b812c1b3cd2b3b26f832/the-fundamental-guide-to-building-a-better-security-operation-center-soc.jpeg.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 53f83e776d713dd6b76e98420c835c52e590dad99052a334b4944469786b08b8

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 13:55:35 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1913372
x-cache: Hit from cloudfront
status: 200
content-length: 9155
server: Apache
etag: "53f83e776d713dd6b76e98420c835c52e590dad99052a334b4944469786b08b8"
x-varnish: 5476255 3092094
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: 1lnt70RnG-E8OOxxvRP35okaa9O3gEmBnRpFrry0Jd1HJrruDLdBmw==

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/b2dc6daa6d8dbc54f1c3b32d2b3af56cf4fe6b736e89cb8ac9d56b6b6b89f155/the-essential-guide-to-security.png?transform=crush&quality=256
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 300da6e41a56c8946f29a6094e4addf4320ea4451e2e1dd8826c919f6c79f639

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 01:59:18 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1956349
x-cache: Hit from cloudfront
status: 200
content-length: 14772
server: Apache
etag: "300da6e41a56c8946f29a6094e4addf4320ea4451e2e1dd8826c919f6c79f639"
x-varnish: 6855257 2821127
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: Cza-6Oz5VOSlF6gePOBy0Lp1ZfhjkKSQUV9cnRKIJX39lW5Iv1y_Rw==

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/fa8228d2052a370dacf08cba112fd29f10722f75bca3d2e8e5de118e3e92e73f/how%20to%20uplevel%20your%20defenses.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: c7124f8ff86138008f3386c9fafd3c17a6e5e6c739e6edcf5d47e750f46c1aff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 06:40:46 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1939462
x-cache: Hit from cloudfront
status: 200
content-length: 33641
server: Apache
etag: "c7124f8ff86138008f3386c9fafd3c17a6e5e6c739e6edcf5d47e750f46c1aff"
x-varnish: 2870903
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: f4CDJpQH1vLwpvUOv4Ux8R-gH5YqFXytC-UlGUWdDym1jUdlZe9M3g==

GET
H2 200 tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame 58BC 781 B
1 KB 13ms
11ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 14 Feb 2020 13:44:21 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2086846
x-cache: Hit from cloudfront
status: 200
content-length: 781
server: Apache
etag: "308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish: 6036561 3973619
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: XoAQQWxd_JXKsFrQjq90TmvQWS08FF1A4cNU111sooqT4ejAOZpsww==

GET
H2 200 li.png
cache-ssl.celtra.com/api/blobs/8abad5101e4e04aaad9758773bd0e6eead30303742f732e5235e7d73be899598/ Frame 58BC 608 B
1 KB 14ms
13ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/8abad5101e4e04aaad9758773bd0e6eead30303742f732e5235e7d73be899598/li.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 2e8c15ba0e22d227940fcc5ae790599e1b32a636d9b28e174e864a4884ee7e48

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 06:38:14 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1939614
x-cache: Hit from cloudfront
status: 200
content-length: 608
server: Apache
etag: "2e8c15ba0e22d227940fcc5ae790599e1b32a636d9b28e174e864a4884ee7e48"
x-varnish: 6132502
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: c-FsWaO3rvJEnMR_ru2d5HgrKmwhVUDBJUD4l1I1zhQVoNLCN3IYXw==

GET
H2 200 fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame 58BC 348 B
862 B 15ms
14ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 17 Feb 2020 05:44:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1856440
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish: 2528039 5524949
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: LpQiwhxyyWFqKVygx4z7rWydYRqWlSrsejbLJ4UTqtnTYZ1nDFCIwA==

GET
H2 200 yt.png
cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/ Frame 58BC 914 B
1 KB 16ms
15ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/yt.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 25 Jan 2020 00:08:03 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 3863825
x-cache: Hit from cloudfront
status: 200
content-length: 914
server: Apache
etag: "8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28"
x-varnish: 6724994
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: s2CobLDPdxxPCfMdVtVW3i8DRd1bNk5W9XcKRvjYZiZiV7psujvCJw==

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/dd0e38d4a8b6756d7eafd68a1381a554411570385bd98f31b199708d056716a1/The%20SIEM%20Buyers%20Guide%20for%202020.jpeg.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 85825dee492b21f4730c29f8be895a878ef69e5780d87b57659341626d337193

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 08:51:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2018021
x-cache: Hit from cloudfront
status: 200
content-length: 15253
server: Apache
etag: "85825dee492b21f4730c29f8be895a878ef69e5780d87b57659341626d337193"
x-varnish: 6232255
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: jCfUcqr4-DXPik52uddyVVdwOvpWs_QhYV0v86Pjcj7UCNp5ZqXr2w==

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 102ms
102ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjEsImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwNy43MjEsInNjb3BlIjoiZ2xvYmFsIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNiIsIm9yaWVudGF0aW9uIjowLCJ0b3Btb3N0UmVhY2hhYmxlV2luZG93Ijp7IndpZHRoIjoxNjAwLCJoZWlnaHQiOjEyMDB9LCJob3N0V2luZG93Ijp7IndpZHRoIjo1LCJoZWlnaHQiOjV9LCJuZXN0aW5nIjp7ImlmcmFtZSI6dHJ1ZSwiZnJpZW5kbHlJZnJhbWUiOnRydWUsImlhYkZyaWVuZGx5SWZyYW1lIjp0cnVlLCJob3N0aWxlSWZyYW1lIjpmYWxzZSwiaWZyYW1lRGVwdGgiOjF9LCJwYWdlVmlzaWJpbGl0eUFwaSI6dHJ1ZSwicmVxdWVzdEFuaW1hdGlvbkZyYW1lIjp0cnVlLCJ0b3BXaW5kb3dOYXRpdmVSQUZTdXBwb3J0ZWQiOnRydWUsImFsbG93Tm9uTmF0aXZlUkFGRm9yVmlld2FibGVUaW1lVXNlZCI6ZmFsc2UsImNsaWVudFRpbWVab25lT2Zmc2V0SW5NaW51dGVzIjotNjAsInN1cHBvcnRzQ29udGFpbmVyVmlld2FiaWxpdHkiOnRydWUsInN1cHBvcnRzQ29udGFpbmVySW5pdGlhbFZpZXdhYmlsaXR5Ijp0cnVlLCJ0YWdQYXJlbnRXaWR0aCI6MCwidGFnUGFyZW50SGVpZ2h0IjowLCJhbXBEZXRlY3RlZCI6ZmFsc2UsImFtcE5lc3RpbmdMZXZlbCI6IiIsInNhZmVGcmFtZURldGVjdGVkIjpmYWxzZSwiZmV0Y2hTdXBwb3J0ZWQiOnRydWUsImFzYXBFbmFibGVkIjpudWxsLCJuYXRpdmVQcm9taXNlc1N1cHBvcnRlZCI6dHJ1ZSwiYmVhY29uU3VwcG9ydGVkIjp0cnVlLCJJbnRlcnNlY3Rpb25PYnNlcnZlclN1cHBvcnRlZCI6dHJ1ZSwiaXNNdXRhdGlvbk9ic2VydmVyU3VwcG9ydGVkIjp0cnVlLCJ3ZWJWaWV3IjpudWxsLCJpc1dpbmRvd09wZW5OYXRpdmUiOnRydWUsInByb3RvTG9hZGluZyI6eyJkYXRhTG9hZFN0YXR1cyI6InN1cHBvcnRlZCIsImJsb2JMb2FkU3RhdHVzIjoic3VwcG9ydGVkIn0sInRvcFdpbmRvd0xvY2F0aW9uIjoiaHR0cHM6Ly93d3cuZGFya3JlYWRpbmcuY29tIiwidG9wV2luZG93TG9jYXRpb25MZW5ndGgiOjI3LCJuYW1lIjoiZW52aXJvbm1lbnRJbmZvIn0seyJzZXNzaW9uSWQiOiJzMTU4Mzc3NDcwN3g3M2I4ZjYzZWZjMGZkOHg1MTYwNTg3NCIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiMzkyNzQwMTgyOTQzNzY3OCIsImluZGV4IjoyLCJjbGllbnRUaW1lc3RhbXAiOjE1ODM3NzQ3MDguMTQ4LCJuYW1lIjoiY3JlYXRpdmVMb2FkZWQiLCJ2aWV3YWJpbGl0eTAwTWVhc3VyYWJsZSI6dHJ1ZSwidmlld2FiaWxpdHk1MDFNZWFzdXJhYmxlIjp0cnVlLCJ2aWV3YWJsZVRpbWVNZWFzdXJhYmxlIjp0cnVlLCJjZG5WYXJpYW50Ijoibm9uZSJ9LHsic2Vzc2lvbklkIjoiczE1ODM3NzQ3MDd4NzNiOGY2M2VmYzBmZDh4NTE2MDU4NzQiLCJhY2NvdW50SWQiOiI0NGI3NGIzNSIsInN0cmVhbSI6ImFkRXZlbnRzIiwiaW5zdGFudGlhdGlvbiI6IjM5Mjc0MDE4Mjk0Mzc2NzgiLCJpbmRleCI6MywiY2xpZW50VGltZXN0YW1wIjoxNTgzNzc0NzA4LjE3MSwibmFtZSI6InZpZXdwb3J0UGxhY2VtZW50R2VvbWV0cnkiLCJwYWdlRGltZW5zaW9ucyI6eyJoZWlnaHQiOjYwMTQsIndpZHRoIjoxNTg1fSwidmlld3BvcnRQb3NpdGlvblJlY3QiOnsid2lkdGgiOjE2MDAsImhlaWdodCI6MTIwMCwibGVmdCI6MCwidG9wIjowfSwiZmlyc3RQbGFjZW1lbnRQb3NpdGlvblJlY3QiOnsibGVmdCI6OTM0LjUsInRvcCI6NDMzLjkyMTg3NSwid2lkdGgiOjMzNiwiaGVpZ2h0Ijo2MDB9fSx7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjQsImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwOC4xNzMsIm5hbWUiOiJ2aWV3YWJsZTAwIiwiY3JpdGVyaW9uIjp7Im5hbWUiOiJDb3JlIiwicmF0aW8iOjAsInRpbWUiOjB9fSx7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjUsImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwOC4xODUsInVuaXROYW1lIjoiYmFubmVyIiwidW5pdFZhcmlhbnRMb2NhbElkIjpudWxsLCJzY3JlZW5Mb2NhbElkIjoxMzY4LCJzY3JlZW5UaXRsZSI6IlJlc291cmNlcyIsInNjcmVlbklzTWFzdGVyIjpmYWxzZSwib2JqZWN0TG9jYWxJZCI6bnVsbCwib2JqZWN0TmFtZSI6bnVsbCwib2JqZWN0Q2xhenoiOm51bGwsImluaXRpYXRpb25UaW1lc3RhbXAiOjE1ODM3NzQ3MDguMTg1LCJuYW1lIjoic2NyZWVuU2hvd24ifSx7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjYsImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwOC4xODUsIm5hbWUiOiJjcmVhdGl2ZVJlbmRlcmVkIn1dfQ==?crc32c=221945411
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=13&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Fsecurepubads.g.doubleclick.net%2Fpcs%2Fview%3Fxai%3DAKAOjssNiduiyliMNbeZohCU8cY0_XT5NxaHivO5AFOkVrdYXCMxBlXyswzx-btBYdN-_f7SC1jVFJxT9dJGTNz02vyWVn4whHHF77NpPy59Oqd_4gw6TEhDMj4lkVWcBD03tJzWxTrg6UJ3ihFdEmssgrBUDxaAa4nGDcoZ4lDvyKP4G6mGjOY_y5PeKpKkNvVpUmxdKdFN73RRCFmWAmIln7YF2d58i3xYOMlJeA-zMo2EPBZajUt9rcIOYDjSr2TKRuu2_-9Wq3J4JVcZ9VFNMNJxaLo1vJ0D8utQBaUmBQMl4xi2Bww7EQ%26sai%3DAMfl-YQwilitUA6euEWoUJvf7QqOsA0_Fmrux9TPz3aJPcI93o6pZ43rdB4Da71lI3aXfxDj8TKAA3jnoeFY35MkxZfQVTJ64gBTxYklnuPYjg%26sig%3DCg0ArKJSzLbeDw8EbzITEAE%26urlfix%3D1%26adurl%3Dhttps%3A%2F%2Ftpc.googlesyndication.com%2Fpagead%2Fimgad%3Fid%3DCICAgKDnhK7w9QEQARgBMgil1qRvp9Nq6w&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=480&w=640&fy=472.5&gp=358&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707104&de=800992366892&cu=1583774707104&m=605&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=358&lb=5019&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=17&an=0&gf=17&gg=0&ix=17&ic=17&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=17&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=34&cd=0&ah=34&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&bo=27868836&bp=43863396&bd=welcome&zMoatPS=welcome&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1468676178&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 0X-1-Men
pbs.twimg.com/card_img/1233570617380593664/ Frame BF87 6 KB
6 KB 7ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1233570617380593664/0X-1-Men?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/419A) /

Resource Hash

7e2a850bdefa6b9bb2075030d39bcc5dd8f9beb4be4042e772b00657e527c9cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 1428
x-cache: HIT
status: 200
content-length: 6390
x-response-time: 183
surrogate-key: card_img card_img/bucket/5 card_img/1233570617380593664
last-modified: Sat, 29 Feb 2020 01:50:08 GMT
server: ECS (fcn/419A)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: c4f66ba40885cd7800893cdcb6ab5ec3
accept-ranges: bytes

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 195ms
102ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjcsImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwOC4yMDQsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNTgzNzc0NzA4LjE3NCwidG8iOjE1ODM3NzQ3MDguMTc0fV19?crc32c=2261533473
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 iframe_api Show response
www.youtube.com/ Frame 58BC 859 B
944 B 23ms
22ms Script
application/javascript 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

bdde153c2225a8ece83bee8df43f9f677bba41681f9be21e450a95efce937c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 news_stroke_v1_78ce5b21fb24a7c7e528d22fc25bd9f9df7f24e2.svg
ton.twimg.com/tfw/assets/ Frame BF87 829 B
552 B 6ms
6ms Image
image/svg+xml 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ton.twimg.com/tfw/assets/news_stroke_v1_78ce5b21fb24a7c7e528d22fc25bd9f9df7f24e2.svg

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/41AC) /

Resource Hash

5c0f79d0286f1fd3db48e1b689358017b302c0f4babde540329e8c644cf119c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391459
x-ton-expected-size: 829
x-cache: HIT
status: 200
strict-transport-security: max-age=631138519
content-length: 395
x-response-time: 9
surrogate-key: tfw
last-modified: Tue, 14 May 2019 18:53:55 GMT
server: ECS (fcn/41AC)
etag: "CTUg6L9PuY+d9h5xpE0zmw=="
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-connection-hash: 3cff49b14a61e9ffe2c5a78d26501cb4
accept-ranges: bytes
expires: Mon, 16 Mar 2020 17:25:08 GMT

GET
H2 200 tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame 58BC 781 B
1 KB 8ms
8ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 14 Feb 2020 13:44:21 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2086846
x-cache: Hit from cloudfront
status: 200
content-length: 781
server: Apache
etag: "308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish: 6036561 3973619
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: VApSODhnDb0nip_K0chNsagg3-qKtSO4J9FeF2aNaQI4hpZ_aYsAuw==

GET
H2 200 tw_hover.png
cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/ Frame 58BC 777 B
1 KB 12ms
11ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/tw_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 01:29:44 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1612524
x-cache: Hit from cloudfront
status: 200
content-length: 777
server: Apache
etag: "1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e"
x-varnish: 8852695
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: sSrUtIBiZ32QkkFiGyxCLei4y6ITw_JPcdVnVEygO911TUZhnipDRA==

GET
H2 200 li.png
cache-ssl.celtra.com/api/blobs/8abad5101e4e04aaad9758773bd0e6eead30303742f732e5235e7d73be899598/ Frame 58BC 608 B
1 KB 8ms
8ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/8abad5101e4e04aaad9758773bd0e6eead30303742f732e5235e7d73be899598/li.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 2e8c15ba0e22d227940fcc5ae790599e1b32a636d9b28e174e864a4884ee7e48

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sun, 16 Feb 2020 06:38:14 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1939614
x-cache: Hit from cloudfront
status: 200
content-length: 608
server: Apache
etag: "2e8c15ba0e22d227940fcc5ae790599e1b32a636d9b28e174e864a4884ee7e48"
x-varnish: 6132502
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: YLyzUJq54pXkb8ZUgoMg5HViTxDjyWaLKvk8Wah-dsXif5qyeoTb_Q==

GET
H2 200 li_hover.png
cache-ssl.celtra.com/api/blobs/b7a1a128e1e4be19257209f345f26c688422071122ed660518782b609158ad7a/ Frame 58BC 612 B
1 KB 21ms
20ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/b7a1a128e1e4be19257209f345f26c688422071122ed660518782b609158ad7a/li_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 3bb72e5a3bd7858a708f629dfc7e2f2aa9d87ee8a43b1c22b300e49cd59b09d7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 06 Feb 2020 07:20:19 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2801089
x-cache: Hit from cloudfront
status: 200
content-length: 612
server: Apache
etag: "3bb72e5a3bd7858a708f629dfc7e2f2aa9d87ee8a43b1c22b300e49cd59b09d7"
x-varnish: 1283940
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 1gU5YWrzX_L6dU3LCcNfGavCBmFAiBZ8j_b1G7HwxhziC317GD3LKA==

GET
H2 200 fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame 58BC 348 B
860 B 9ms
8ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 17 Feb 2020 05:44:27 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 1856440
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish: 2528039 5524949
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: wmqtpe3m0a6vBrXuwSVo3z9aghVYeDWbzbwBhFlbpYir4bDsjQzmUQ==

GET
H2 200 fb_hover.png
cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/ Frame 58BC 348 B
854 B 12ms
12ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/fb_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 04:24:32 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2034036
x-cache: Hit from cloudfront
status: 200
content-length: 348
server: Apache
etag: "9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39"
x-varnish: 83703
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: NhLEHd9QEfDIbbovGiLsEQGhLIeE59mb85D-xSzf_D0kiKbVV4Q9OA==

GET
H2 200 yt.png
cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/ Frame 58BC 914 B
1 KB 7ms
7ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/13d77e3befd746d58356da2f0b0d1d20af11ba13ea0ca8cd7b73871ef1d40edd/yt.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 25 Jan 2020 00:08:03 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 3863825
x-cache: Hit from cloudfront
status: 200
content-length: 914
server: Apache
etag: "8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28"
x-varnish: 6724994
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: l6Ul77uiSnbmBKH_22gG36mfTZuc31mLAK5scmlFf_y7oP3LLKIYww==

GET
H2 200 yt_hover.png
cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/ Frame 58BC 918 B
1 KB 12ms
11ms Image
image/png 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/05c871534a66ba01deefbc75b6ed2f9281993581e903223785a6f6a7ff82bebb/yt_hover.png?transform=crush
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 06:02:37 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2028150
x-cache: Hit from cloudfront
status: 200
content-length: 918
server: Apache
etag: "6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677"
x-varnish: 632457
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: sIM80Pt4VrVejWK5YQUNNvlfHBODU8VGp_Pbid8IvvorI3knTZezXg==

GET
H2 200 blogtab_600x331.jpg
cache-ssl.celtra.com/api/blobs/1c37233d9afe8917c95eacd136e46f37651163b2d4e33c16baf1224cda11b871/ Frame 58BC 33 KB
33 KB 9ms
9ms Image
image/jpeg 99.86.3.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache-ssl.celtra.com/api/blobs/1c37233d9afe8917c95eacd136e46f37651163b2d4e33c16baf1224cda11b871/blogtab_600x331.jpg?transform=crush&quality=85
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.3.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-13.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 5ae735414fe2497e924391ed5121dacd3c6d564121a8413972be632935fc6c73

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 15 Feb 2020 04:24:33 GMT
via: 1.1 varnish (Varnish/5.0), 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 2034035
x-cache: Hit from cloudfront
status: 200
content-length: 33738
server: Apache
etag: "5ae735414fe2497e924391ed5121dacd3c6d564121a8413972be632935fc6c73"
x-varnish: 5461448
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control: max-age=31556926
access-control-allow-credentials: false
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: image/jpeg
x-amz-cf-id: -gRwBRq1dqlWWgn8HbpEH97nMDRGXd7h0RHsQ2vQONqJHpmCBeuw8Q==

GET
H2 200 DWoDJPlp
pbs.twimg.com/card_img/1236056291241492480/ Frame BF87 5 KB
5 KB 6ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1236056291241492480/DWoDJPlp?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/40DE) /

Resource Hash

58b80e76b2b6651b65aff604f3bd10c953b6e166eb3346c138f920ddc1ad8273

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 240946
x-cache: HIT
status: 200
content-length: 4622
x-response-time: 133
surrogate-key: card_img card_img/bucket/9 card_img/1236056291241492480
last-modified: Fri, 06 Mar 2020 22:27:19 GMT
server: ECS (fcn/40DE)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 73a181d57f778fad0edf59d65ab42f2a
accept-ranges: bytes

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vflkAsU_-/ Frame 58BC 27 KB
10 KB 76ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vflkAsU_-/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39b400a9f636b03c497e9f79bb638536984d3619774d1a01993a46df9a1be610

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 08:26:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32324
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 10183
x-xss-protection: 0
last-modified: Sun, 08 Mar 2020 11:08:47 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Tue, 17 Mar 2020 08:26:24 GMT

GET
H2 200 DNP-QoaV
pbs.twimg.com/card_img/1235994630598127618/ Frame BF87 6 KB
6 KB 7ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1235994630598127618/DNP-QoaV?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/40E2) /

Resource Hash

7dae52f46383dc9d6ae308dc581ec1e932e36b95b017cbd0fcb7d0b22630b190

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 254201
x-cache: HIT
status: 200
content-length: 6529
x-response-time: 141
surrogate-key: card_img card_img/bucket/9 card_img/1235994630598127618
last-modified: Fri, 06 Mar 2020 18:22:18 GMT
server: ECS (fcn/40E2)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: cbb581458c49e15635df8342a1818c93
accept-ranges: bytes

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707196&de=701337247319&cu=1583774707196&m=1142&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1135&an=3&gi=1&gf=1135&gg=3&ix=1135&ic=1135&ez=1&ck=1135&kw=932&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1135&bx=3&ci=1135&jz=932&dj=1&aa=1&ad=1009&cn=0&gn=1&gk=1009&gl=0&ik=1009&co=1009&cp=932&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=932&cd=5&ah=932&am=5&rf=0&re=1&ft=1009&fv=0&fw=1009&wb=1&cl=0&at=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&bo=27868836&bp=43863396&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1557625821&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707196&de=701337247319&cu=1583774707196&m=1143&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1135&an=1135&gi=1&gf=1135&gg=1135&ix=1135&ic=1135&ez=1&ck=1135&kw=932&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1135&bx=1135&ci=1135&jz=932&dj=1&aa=1&ad=1009&cn=1009&gn=1&gk=1009&gl=1009&ik=1009&co=1009&cp=932&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=932&cd=932&ah=932&am=932&rf=0&re=1&ft=1009&fv=1009&fw=1009&wb=1&cl=0&at=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&bo=27868836&bp=43863396&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=974060185&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 imgad
tpc.googlesyndication.com/pagead/ 308 KB
309 KB 8ms
8ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKDnhLbEkQEQARgBMghPYz9NAZc2Ig

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6bef375bb199a0575c58918203cef98c4f346fd1684f9fc6b8425017fc09822

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

timing-allow-origin: *
date: Mon, 02 Mar 2020 18:14:22 GMT
x-content-type-options: nosniff
server: cafe
age: 601846
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=604800
content-disposition: attachment; filename="image.png"
content-type: image/png
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 315741
x-xss-protection: 0
expires: Mon, 09 Mar 2020 18:14:22 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707196&de=701337247319&cu=1583774707196&m=1145&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1135&an=1135&gi=1&gf=1135&gg=1135&ix=1135&ic=1135&ez=1&ck=1135&kw=932&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1135&bx=1135&ci=1135&jz=932&dj=1&aa=1&ad=1009&cn=1009&gn=1&gk=1009&gl=1009&ik=1009&co=1009&cp=932&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=932&cd=932&ah=932&am=932&rf=0&re=1&ft=1009&fv=1009&fw=1009&wb=1&cl=0&at=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&bo=27868836&bp=43863396&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=75042652&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Fwww.darkreading.com%2F%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=1111&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=13&an=0&gf=13&gg=0&ix=13&ic=13&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=13&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=26&cd=0&ah=26&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=546400092&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=251&w=301&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707264&de=467916279984&cu=1583774707264&m=1107&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=58&vx=58%3A58%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1101&an=2&gf=989&gg=2&ix=989&ic=989&ez=1&ck=1101&kw=879&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1101&bx=2&ci=1101&jz=879&dj=1&aa=0&ad=986&cn=0&gk=874&gl=0&ik=874&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=879&cd=4&ah=879&am=4&rf=0&re=1&ft=986&fv=0&fw=986&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301433147&bo=27868836&bp=43863396&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1475664472&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 BXChPYVV
pbs.twimg.com/card_img/1232768320639766528/ Frame BF87 8 KB
8 KB 7ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1232768320639766528/BXChPYVV?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/41AB) /

Resource Hash

4472e0ceca33180067aafdf870091d23fb1a0164e80c07ec1c2bc48db842be73

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 332397
x-cache: HIT
status: 200
content-length: 7884
x-response-time: 134
surrogate-key: card_img card_img/bucket/0 card_img/1232768320639766528
last-modified: Wed, 26 Feb 2020 20:42:06 GMT
server: ECS (fcn/41AB)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: d4b6f5a7a3b1102daababe2a0341418d
accept-ranges: bytes

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 7B87 42 B
115 B 16ms
16ms Image
image/gif 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstehwV_fDbJfxaZKVm7KG0scKX9hoDd8gmWpgKsrmOB6ZboCPhCmq3fTQ7m_soASr5QZfT-e3onNMbCGzNc9HzHLIEeOUhYwkJotBWy5D4&sig=Cg0ArKJSzD0JlN5QkjgrEAE&adk=4220632109&tt=-1&bs=1585%2C1200&mtos=969,969,1070,1070,1070&tos=969,0,101,0,0&p=1054,952,1305,1253&gcm=1&lcs=1&mcvt=1070&rs=0&ht=0&tfs=141&tls=1211&mc=1&lte=0&bas=0&bac=0&met=mue&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1583774706947&dlt&rpt=394&isd=0&msd=0&ext&xdi=0&msp=1&ps=1585%2C6014&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-10-4-9-9-0-0-0&tvt=1208&is=301%2C251&invis=1&iframe_loc=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&r=v&id=osdim&vs=4&uc=10&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=301x251&itpl=3&v=20200306

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Z_TSE_7a
pbs.twimg.com/card_img/1234894042019835904/ Frame BF87 5 KB
5 KB 7ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1234894042019835904/Z_TSE_7a?format=jpg&name=144x144_2

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/41AB) /

Resource Hash

49dcb28156fbd6c88489ceae8a96eab5e121f1d6d91c82276532d62645aa760b

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
age: 456694
x-cache: HIT
status: 200
content-length: 4795
x-response-time: 131
surrogate-key: card_img card_img/bucket/6 card_img/1234894042019835904
last-modified: Tue, 03 Mar 2020 17:28:57 GMT
server: ECS (fcn/41AB)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 3cccc15d9cc517f244b9c5bbd30e8860
accept-ranges: bytes

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 6830 42 B
110 B 22ms
22ms Image
image/gif 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv58Docf8mq2bJ70cRXFgcndI9JrILrAZG1VMrkKc9TkAbb3kUKt42w1QhvMPTP9mPJT0XWYpRbpiBJ5WEYsMIT4TnPskJLbN9fsBNsN5Q&sig=Cg0ArKJSzAmUSKWCJxcQEAE&adk=2332965166&tt=-1&bs=1585%2C1200&mtos=0,0,1065,1065,1065&tos=0,0,1065,0,0&p=358,293,360,294&gcm=1&lcs=1&mcvt=1065&rs=0&ht=0&tfs=420&tls=1485&mc=0.5&lte=0&bas=0&bac=0&met=ce&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1583774706848&dlt&rpt=331&isd=0&msd=0&ext&xdi=0&msp=1&ps=1585%2C6014&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-11-2-10-10-0-0-0&tvt=1484&is=1%2C2&invis=1&iframe_loc=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&r=v&id=osdim&vs=4&uc=11&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200306

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 99D2 42 B
110 B 22ms
22ms Image
image/gif 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssc2YcT4MwLsroDMHKEpZLP2b3bEY-6x7BU7SXWAqYsuOs8T5zHvf6UAP5CoIFntQpojH4rEX1VATMedb2geXAeHvfo-RrkbiAajwyn09M&sig=Cg0ArKJSzDgPbd_EdsbfEAE&adk=2966194094&tt=-1&bs=1585%2C1200&mtos=1080,1080,1080,1080,1080&tos=1080,0,0,0,0&p=96,428,186,1156&gcm=1&lcs=1&mcvt=1080&rs=0&ht=0&tfs=409&tls=1489&mc=1&lte=0&bas=0&bac=0&met=mue&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1583774706852&dlt&rpt=365&isd=0&msd=0&ext&xdi=0&msp=1&ps=1585%2C6014&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-11-3-10-10-0-0-0&tvt=1488&is=728%2C90&invis=1&iframe_loc=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&r=v&id=osdim&vs=4&uc=11&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=728x90&itpl=3&v=20200306

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 6DC8 42 B
110 B 16ms
16ms Image
image/gif 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv1C06JrMBX0LFO_wCO-IsYizjFbDkHkZpWkNZZvFvdI2Pn1rnthCMekRUb627H_iTg0wLGK7Wae2OtZTmgUkKpQQfjYDzbv_p1HWuuWPY&sig=Cg0ArKJSzChB6WROy-63EAE&adk=1417865500&tt=-1&bs=1585%2C1200&mtos=1074,1074,1074,1074,1074&tos=1074,0,0,0,0&p=0,0,1200,1585&gcm=1&lcs=1&mcvt=1074&rs=0&ht=0&tfs=445&tls=1519&mc=1&lte=0&bas=0&bac=0&met=ce&la=1&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1583774706840&dlt&rpt=524&isd=0&msd=0&ext&xdi=0&msp=1&ps=1585%2C6014&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-10-5-9-9-0-0-0&tvt=1516&is=1585%2C1200&iframe_loc=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&r=v&id=osdim&vs=4&uc=10&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200306

Requested by

Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=251&w=301&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707264&de=467916279984&cu=1583774707264&m=1310&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=58&vx=58%3A58%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1303&an=1101&gf=989&gg=989&ix=989&ic=989&ez=1&ck=1101&kw=879&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1303&bx=1101&ci=1101&jz=879&dj=1&aa=1&ad=1188&cn=986&gk=874&gl=874&ik=874&co=1188&cp=1103&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1103&cd=879&ah=1103&am=879&rf=0&re=1&ft=1188&fv=986&fw=986&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301433147&bo=27868836&bp=43863396&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=44409154&cs=0
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
6 KB 35ms
17ms XHR
application/json 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020030501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19374fcc7ff52aa97571eee92f23c9a4752348be26b19650f39e2054f7c46ee5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Origin: https://www.darkreading.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Mar 2020 17:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5182
x-xss-protection: 0

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 34 KB
11 KB 25ms
7ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2e8482bdd64c06f5dad92fc1e1efa5815f58f5664578a65a9b9ec783dacc9726

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: zw3gDafwdfmkA1kq9nPAA6cid7KliPGC
Content-Encoding: gzip
x-amz-request-id: A1D8A1BE2D8F78B7
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Mon, 09 Mar 2020 17:25:08 GMT
Connection: keep-alive
Content-Length: 10763
x-amz-id-2: dB4dxFXlpsk8WvLkQ+D92TJ6BRSdWDrpbll9UR/b1+vrCsaH+wR5kMbk7UiYsLOxI27Ul+OE2d4=
Last-Modified: Thu, 27 Feb 2020 16:21:23 GMT
Server: AmazonS3
ETag: "6cffbe2b1eafeaff85a7f1d4ea035464"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/TQSV74R4GVCSJITSZC2MCP/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

7ms
7ms

Script
application/javascript

23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: FcaZ9fQuufI0j2Jlie4e0Qn7iovsdj20
Content-Encoding: gzip
x-amz-request-id: 542B649F8C2045B8
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Mon, 09 Mar 2020 17:25:08 GMT
Connection: keep-alive
Content-Length: 48
x-amz-id-2: DOsr0QsmEs8inv5xEbtEM99LkzZmxHReydDBEYgZgMrqXcmRtZRZrRkYhwMOKl9cQcRMfOeMSqY=
Last-Modified: Fri, 21 Feb 2020 18:14:11 GMT
Server: AmazonS3
ETag: "5816cced8568d223aa09d889f300692b"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Mon, 09 Mar 2020 17:25:08 GMT
Server: AkamaiGHost
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/ 1 KB
1 KB 25ms
11ms Script
text/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: OqleEvyRQNRjikPBXIhMStxNIrqn0wNU
Content-Encoding: gzip
x-amz-request-id: BF61584C87F3A3AA
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Mon, 09 Mar 2020 17:25:08 GMT
Connection: keep-alive
Content-Length: 635
x-amz-id-2: OeaIOTOwv/KZt2AJ13ebYaar+bO7dbHBEliIMV+K1CzU4zr4A1yblooV1PNwkRyKCLIT5utS+yc=
Last-Modified: Sun, 08 Mar 2020 16:52:31 GMT
Server: AmazonS3
ETag: "3996d65282dd996ee0d7d4c90c139158"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/TQSV74R4GVCSJITSZC2MCP?_s=e49f839811b65b461156b3cff09f35dd&_b=2
https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=e49f839811b65b461156b3cff09f35dd&_b=2

106 B
198 B

35ms
34ms

Script
application/javascript

54.171.23.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=e49f839811b65b461156b3cff09f35dd&_b=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.23.184 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-23-184.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 4b17f65b9c3e956c423712d1f6fad95924947f4ea247683ff9f4174886052532

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Mon, 09 Mar 2020 17:25:08 GMT
server: nginx/1.16.1
content-length: 106
content-type: application/javascript

Redirect headers

status: 302
date: Mon, 09 Mar 2020 17:25:08 GMT
server: nginx/1.16.1
content-length: 105
location: https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=e49f839811b65b461156b3cff09f35dd&_b=2

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 09 Mar 2020 17:25:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame ACD1 0
0 6ms
6ms Document
text/html 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Mon, 09 Mar 2020 17:03:12 GMT
expires: Tue, 09 Mar 2021 17:03:12 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1316
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=13&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=480&w=640&fy=472.5&gp=358&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707104&de=800992366892&cu=1583774707104&m=1669&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=358&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1084&an=17&gi=1&gf=1084&gg=17&ix=1084&ic=1084&ez=1&ck=1084&kw=900&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1084&bx=17&ci=1084&jz=900&dj=1&aa=0&ad=954&cn=0&gk=954&gl=0&ik=954&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=900&cd=34&ah=900&am=34&rf=0&re=0&wb=1&cl=0&at=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&bo=27868836&bp=43863396&bd=welcome&zMoatPS=welcome&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1954367754&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 11ms
11ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=13&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=480&w=640&fy=472.5&gp=358&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707104&de=800992366892&cu=1583774707104&m=1671&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=358&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1084&an=1084&gi=1&gf=1084&gg=1084&ix=1084&ic=1084&ez=1&ck=1084&kw=900&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1084&bx=1084&ci=1084&jz=900&dj=1&aa=0&ad=954&cn=954&gk=954&gl=954&ik=954&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=900&cd=900&ah=900&am=900&rf=0&re=0&wb=1&cl=0&at=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&bo=27868836&bp=43863396&bd=welcome&zMoatPS=welcome&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=436689020&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 14ms
14ms Image
image/gif 2a00:1450:4001:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020030501&jk=1141506495506630&bg=!6Oul6_NYVWeJwBhPoGwCAAAAN1IAAAALmQFfUqtDEXnycW8Q8B9HdTag4RqD5q4uKAXhW2FYbZL7AiXZMyV_T6CIu5ESYvYlVA15lTpi6NHr4ODuvIJY0XdKX0XwAXvKgt7-DcqJAk3lMzsuaN6ykUMzGcetoqHzeKKDSfFhy8MVkntj4ttuLUrbgWlnmKM5ESqLJuBr2sdglDkEFZt-bUcIvtOeiOl1IBrB5mqNgFMPocITxfOQ87Izxfhx7lHwEJG1hkUjJTbxWsGEN4s5jn2I1rIKXN8z7PtW_NmNTYVhocuNbzQP5_0CNc0ciG4UpRfKQRoxJeFsSM1xvjKBk22qG3aiZejrHeupn4ueR0Xv37H_gzSXwQ1RyFZI_Rl3DYjUwQ3f5vtIa_imIokNxNBzfMblyREnAZg26TzylXdEAgvn29GUkZN4BrLu7ZSf3GhRLIKzSJPlFseBwJkllclJ-q8HR9tmDT_aeZ4Ipp8CBgFa0d6bi--6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=13&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=480&w=640&fy=472.5&gp=358&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707104&de=800992366892&cu=1583774707104&m=1672&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=358&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1084&an=1084&gi=1&gf=1084&gg=1084&ix=1084&ic=1084&ez=1&ck=1084&kw=900&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1084&bx=1084&ci=1084&jz=900&dj=1&aa=0&ad=954&cn=954&gk=954&gl=954&ik=954&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=900&cd=900&ah=900&am=900&rf=0&re=0&wb=1&cl=0&at=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&bo=27868836&bp=43863396&bd=welcome&zMoatPS=welcome&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=445127868&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H/1.1 200
OK consent.js Show response
s.adroll.com/j/ 243 KB
33 KB 20ms
19ms Script
application/javascript 23.210.248.216
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.216 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-216.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f82c9f099656346f543c66ba009bd5f18010c7b41ad43d47a7f762121ad4496d

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: W7pJTDq0578OcjyRZxtRH_BjDuWCGgRc
Content-Encoding: gzip
x-amz-request-id: C5CB11FA2891D5FB
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Mon, 09 Mar 2020 17:25:08 GMT
Connection: keep-alive
Content-Length: 33195
x-amz-id-2: xvDuzhmafYXOulMfcltPByepfW69qHQWdG5Ym3MZlL+9sl8jZLq//WEZRkSp6xPBek9wYUVR3VI=
Last-Modified: Tue, 19 Nov 2019 20:42:26 GMT
Server: AmazonS3
ETag: "2f9f76c2d377be42af05cdf34c632618"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 hod
d.adroll.com/consent/ 42 B
180 B 35ms
35ms Image
image/gif 54.171.23.184
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/consent/hod?_e=view_banner&_s=e49f839811b65b461156b3cff09f35dd&_b=2.1&_a=TQSV74R4GVCSJITSZC2MCP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.23.184 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-23-184.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 200
date: Mon, 09 Mar 2020 17:25:08 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.16.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vb=13&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=480&w=640&fy=472.5&gp=358&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707104&de=800992366892&cu=1583774707104&m=1874&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=358&lb=6014&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1289&an=1084&gi=1&gf=1289&gg=1084&ix=1289&ic=1289&ez=1&ck=1084&kw=900&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1289&bx=1084&ci=1084&jz=900&dj=1&aa=1&ad=1159&cn=954&gn=1&gk=1159&gl=954&ik=1159&co=1159&cp=1101&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1101&cd=900&ah=1101&am=900&rf=0&re=0&wb=1&cl=0&at=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&bo=27868836&bp=43863396&bd=welcome&zMoatPS=welcome&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1497925319&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:08 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:08 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 102ms
102ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjgsImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwOS4xODgsIm5hbWUiOiJ2aWV3YWJsZTUwMSIsImNyaXRlcmlvbiI6eyJuYW1lIjoiNTAvMSIsInJhdGlvIjowLjUsInRpbWUiOjEwMDB9fV19?crc32c=1148317462
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:09 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 100ms
100ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjksImNsaWVudFRpbWVzdGFtcCI6MTU4Mzc3NDcwOS4yMDUsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNTgzNzc0NzA4LjE3NCwidG8iOjE1ODM3NzQ3MDkuMjA0fV19?crc32c=1825648434
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:09 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1

200
OK

jot.html
platform.twitter.com/ Frame 8B13
Redirect Chain

https://syndication.twitter.com/i/jot
https://platform.twitter.com/jot.html

0
0

6ms
6ms

Document
text/html

2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/jot.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40D0) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
Origin: https://www.darkreading.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 326475
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 09 Mar 2020 17:25:09 GMT
Etag: "d9592a6c704736fa4da218d4357976dd"
Last-Modified: Thu, 05 Mar 2020 00:06:35 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40D0)
X-Cache: HIT
Content-Length: 80

Redirect headers

status: 302 302 Found
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
content-type: text/html;charset=utf-8
date: Mon, 09 Mar 2020 17:25:09 GMT
expires: Tue, 31 Mar 1981 05:00:00 GMT
last-modified: Mon, 09 Mar 2020 17:25:09 GMT
location: https://platform.twitter.com/jot.html
pragma: no-cache
server: tsa_o
strict-transport-security: max-age=631138519
x-connection-hash: 4483d13387e4c26a29f996681f47b427
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 122
x-transaction: 009b67eb002e6664
x-tsa-request-body-time: 8
x-twitter-response-tags: BouncerCompliant
x-xss-protection: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=2104&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1007&an=13&gi=1&gf=1007&gg=13&ix=1007&ic=1007&ez=1&ck=1007&kw=820&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1007&bx=13&ci=1007&jz=820&dj=1&aa=0&ad=905&cn=0&gk=905&gl=0&ik=905&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=820&cd=26&ah=820&am=26&rf=0&re=0&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=253932940&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:09 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=2106&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1007&an=1007&gi=1&gf=1007&gg=1007&ix=1007&ic=1007&ez=1&ck=1007&kw=820&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1007&bx=1007&ci=1007&jz=820&dj=1&aa=0&ad=905&cn=905&gk=905&gl=905&ik=905&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=820&cd=820&ah=820&am=820&rf=0&re=0&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1918115616&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:09 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=2106&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1007&an=1007&gi=1&gf=1007&gg=1007&ix=1007&ic=1007&ez=1&ck=1007&kw=820&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1007&bx=1007&ci=1007&jz=820&dj=1&aa=0&ad=905&cn=905&gk=905&gl=905&ik=905&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=820&cd=820&ah=820&am=820&rf=0&re=0&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=2077219713&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:09 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 9ms
9ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=2308&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=1211&an=1007&gi=1&gf=1211&gg=1007&ix=1211&ic=1211&ez=1&ck=1007&kw=820&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1211&bx=1007&ci=1007&jz=820&dj=1&aa=1&ad=1109&cn=905&gn=1&gk=1109&gl=905&ik=1109&co=1109&cp=1020&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1020&cd=820&ah=1020&am=820&rf=0&re=0&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=281141582&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:09 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 101ms
100ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjEwLCJjbGllbnRUaW1lc3RhbXAiOjE1ODM3NzQ3MTAuMjIyLCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU4Mzc3NDcwOS4yMDQsInRvIjoxNTgzNzc0NzEwLjIwNn1dfQ==?crc32c=2550427660
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:10 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ Frame 6DC8 531 B
1 KB 34ms
33ms Script
application/javascript 52.215.103.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=62439&ct=js&pi=&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&pv=1583774707393_i2gj0w2m8&bl=en-us&cb=2190165&return=&ht=&d=&dc=&si=1583774707393_i2gj0w2m8&cid=&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?922020
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.103.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-103-126.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 0c79b980bfb9fc0bd91096cfd7e48c7e582111e8b79af437e49b1406d6d189ec

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:09 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 426
Expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ Frame 6DC8 20 B
481 B 493ms
187ms Script
application/javascript 34.196.252.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=922020
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?922020
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.252.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-252-78.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 09 Mar 2020 17:25:09 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public
Connection: keep-alive
Content-Length: 138
Expires: Tue, 10 Mar 2020 17:25:10 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 6DC8
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3608741126981812256
https://ml314.com/csync.ashx?fp=ba9934ec1fecbe5d526d9c07f72158b2bd8b36bc4a9bdf3f7e606211ff80e59cf4cb09cee1a4f8eb&person_id=3608741126981812256&eid=50082

43 B
312 B

65ms
29ms

Image
image/gif

52.49.96.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=ba9934ec1fecbe5d526d9c07f72158b2bd8b36bc4a9bdf3f7e606211ff80e59cf4cb09cee1a4f8eb&person_id=3608741126981812256&eid=50082
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.96.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-49-96-126.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Mar 2020 17:25:09 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 10 Mar 2020 13:25:10 GMT

Redirect headers

date: Mon, 09 Mar 2020 17:25:10 GMT
via: 1.1 google
location: https://ml314.com/csync.ashx?fp=ba9934ec1fecbe5d526d9c07f72158b2bd8b36bc4a9bdf3f7e606211ff80e59cf4cb09cee1a4f8eb&person_id=3608741126981812256&eid=50082
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
status: 307
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 6DC8
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=6cb18a0f-41f1-4264-b710-1b1a57f0bd93
https://ml314.com/csync.ashx?fp=6cb18a0f-41f1-4264-b710-1b1a57f0bd93&person_id=3608741126981812256&eid=53819

43 B
312 B

63ms
31ms

Image
image/gif

52.215.103.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=6cb18a0f-41f1-4264-b710-1b1a57f0bd93&person_id=3608741126981812256&eid=53819
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.103.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-103-126.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Mar 2020 17:25:09 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 10 Mar 2020 13:25:10 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:10 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Location: https://ml314.com/csync.ashx?fp=6cb18a0f-41f1-4264-b710-1b1a57f0bd93&person_id=3608741126981812256&eid=53819
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0,Tue, 10 Mar 2020 13:25:10 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/ Frame 6DC8
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3608741126981812256
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3608741126981812256
https://ml314.com/csync.ashx?fp=85947e48c022abdd7c9de4bd0e43733c&eid=50146&person_id=3608741126981812256

43 B
312 B

35ms
29ms

Image
image/gif

52.49.96.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=85947e48c022abdd7c9de4bd0e43733c&eid=50146&person_id=3608741126981812256
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.96.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-49-96-126.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Mar 2020 17:25:09 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 10 Mar 2020 13:25:10 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:10 GMT
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location: https://ml314.com/csync.ashx?fp=85947e48c022abdd7c9de4bd0e43733c&eid=50146&person_id=3608741126981812256
Cache-Control: no-cache
X-Server: 10.45.3.34
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame 6DC8
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=27k9imymVZhrvQ77Vlw-VX70X83nA67UkBa-Egy5JhFE&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
https://ml314.com/csync.ashx?fp=27k9imymVZhrvQ77Vlw-VX70X83nA67UkBa-Egy5JhFE&person_id=3608741126981812256&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

70 B
440 B

10ms
10ms

Image
image/gif

3.125.70.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.125.70.222 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Mar 2020 17:25:10 GMT
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Content-Length: 70
Content-Type: image/gif

Redirect headers

Date: Mon, 09 Mar 2020 17:25:09 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control: private
Connection: keep-alive
Content-Length: 168
Expires: Tue, 10 Mar 2020 13:25:10 GMT

GET
H/1.1 200
OK svrGP Show response
s2150.t.eloqua.com/visitor/v200/ 0
404 B 161ms
160ms Script
application/javascript 209.167.231.17
NETDYNAMICS

General

Check archive.org

Show headers Download Go to

Full URL

https://s2150.t.eloqua.com/visitor/v200/svrGP?pps=50&siteid=2150&DLKey=f09b5473ef7642a085c28ad29c30c1d2&DLLookup=&ms=826&firstPartyCookieDomain=trk.darkreading.com

Requested by

Host: img.en25.com
URL: https://img.en25.com/i/elqCfg.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

209.167.231.17 , United States, ASN7160 (NETDYNAMICS, US),

Reverse DNS

e017.en25.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 09 Mar 2020 17:25:11 GMT
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: private,no-cache, no-store
Content-Type: application/javascript
Content-Length: 20
Expires: -1

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 103ms
102ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjExLCJjbGllbnRUaW1lc3RhbXAiOjE1ODM3NzQ3MTEuMjM4LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU4Mzc3NDcxMC4yMDYsInRvIjoxNTgzNzc0NzExLjIyMn1dfQ==?crc32c=2104645393
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:11 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707196&de=701337247319&cu=1583774707196&m=5179&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=5172&an=1135&gi=1&gf=5172&gg=1135&ix=5172&ic=5172&ez=1&ck=1135&kw=932&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5172&bx=1135&ci=1135&jz=932&dj=1&aa=1&ad=5046&cn=1009&gn=1&gk=5046&gl=1009&ik=5046&co=1009&cp=932&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4973&cd=932&ah=4973&am=932&rf=0&re=1&ft=4946&fv=1009&fw=1009&wb=2&cl=0&at=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&bo=27868836&bp=43863396&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=574847693&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707196&de=701337247319&cu=1583774707196&m=5181&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=5172&an=5172&gi=1&gf=5172&gg=5172&ix=5172&ic=5172&ez=1&ck=1135&kw=932&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5172&bx=5172&ci=1135&jz=932&dj=1&aa=1&ad=5046&cn=5046&gn=1&gk=5046&gl=5046&ik=5046&co=1009&cp=932&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5174&cd=4973&ah=5174&am=4973&rf=0&re=1&ft=4946&fv=4946&fw=1009&wb=2&cl=0&at=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&bo=27868836&bp=43863396&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=2054913463&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=251&w=301&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707264&de=467916279984&cu=1583774707264&m=5142&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=58&vx=58%3A58%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=5135&an=1303&gf=989&gg=989&ix=989&ic=989&ez=1&ck=1101&kw=879&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5135&bx=1303&ci=1101&jz=879&dj=1&aa=1&ad=5020&cn=1188&gk=874&gl=874&ik=874&co=1188&cp=1103&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4936&cd=1103&ah=4936&am=1103&rf=0&re=1&ft=5020&fv=1188&fw=986&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301433147&bo=27868836&bp=43863396&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=450653380&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 22ms
22ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=251&w=301&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707264&de=467916279984&cu=1583774707264&m=5143&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=58&vx=58%3A58%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=5135&an=5135&gf=989&gg=989&ix=989&ic=989&ez=1&ck=1101&kw=879&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5135&bx=5135&ci=1101&jz=879&dj=1&aa=1&ad=5020&cn=5020&gk=874&gl=874&ik=874&co=1188&cp=1103&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5137&cd=4936&ah=5137&am=4936&rf=0&re=1&ft=5020&fv=5020&fw=986&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301433147&bo=27868836&bp=43863396&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=753585690&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707424&de=191007637240&cu=1583774707424&m=5144&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5137&cd=5&ah=5137&am=5&rf=0&re=1&wb=1&cl=0&at=0&d=21887076%3A2672868198%3A5314204047%3A138305844955&bo=27868836&bp=43863396&bd=rec2&zMoatPS=rec2&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1680668818&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 12ms
12ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=5322&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=4225&an=1211&gi=1&gf=4225&gg=1211&ix=4225&ic=4225&ez=1&ck=1007&kw=820&aj=1&pg=100&pf=100&ib=0&cc=1&bw=4225&bx=1211&ci=1007&jz=820&dj=1&aa=1&ad=4123&cn=1109&gn=1&gk=4123&gl=1109&ik=4123&co=1109&cp=1020&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4238&cd=1020&ah=4238&am=1020&rf=0&re=0&wb=2&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1072461397&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 11ms
10ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707424&de=191007637240&cu=1583774707424&m=5347&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5137&cd=5137&ah=5137&am=5137&rf=0&re=1&wb=1&cl=0&at=0&d=21887076%3A2672868198%3A5314204047%3A138305844955&bo=27868836&bp=43863396&bd=rec2&zMoatPS=rec2&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1367836919&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=13&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=480&w=640&fy=472.5&gp=358&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707104&de=800992366892&cu=1583774707104&m=5702&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=358&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=5117&an=1289&gi=1&gf=5117&gg=1289&ix=5117&ic=5117&ez=1&ck=1084&kw=900&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5117&bx=1289&ci=1084&jz=900&dj=1&aa=1&ad=4987&cn=1159&gn=1&gk=4987&gl=1159&ik=4987&co=1159&cp=1101&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4933&cd=1101&ah=4933&am=1101&rf=0&re=0&wb=2&cl=0&at=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&bo=27868836&bp=43863396&bd=welcome&zMoatPS=welcome&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=50592026&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:12 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:12 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 100ms
100ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjEyLCJjbGllbnRUaW1lc3RhbXAiOjE1ODM3NzQ3MTMuMjU1LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU4Mzc3NDcxMS4yMjIsInRvIjoxNTgzNzc0NzEzLjIzOX1dfQ==?crc32c=388384702
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 11ms
10ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=6126&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=5030&an=4225&gi=1&gf=5030&gg=4225&ix=5030&ic=5030&ez=1&ck=1007&kw=820&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5030&bx=4225&ci=1007&jz=820&dj=1&aa=1&ad=4928&cn=4123&gn=1&gk=4928&gl=4123&ik=4928&co=1109&cp=1020&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4842&cd=4238&ah=4842&am=4238&rf=0&re=0&wb=2&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1559016684&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:13 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:13 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 100ms
100ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjEzLCJjbGllbnRUaW1lc3RhbXAiOjE1ODM3NzQ3MTUuMjcyLCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU4Mzc3NDcxMy4yMzksInRvIjoxNTgzNzc0NzE1LjI1NX1dfQ==?crc32c=4290094554
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=11&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1583774707173&de=340090255465&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=32&cb=0&ym=0&cu=1583774707173&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20049636%3A2624997803%3A5223470855%3A138303914748&zMoatPS=wallpaper&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=wallpaper&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1925438974&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:17 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 11ms
11ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F6330518418272117337&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707196&de=701337247319&cu=1583774707196&m=10007&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=10001&an=5172&gi=1&gf=10001&gg=5172&ix=10001&ic=10001&ez=1&ck=1135&kw=932&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10001&bx=5172&ci=1135&jz=932&dj=1&aa=1&ad=9875&cn=5046&gn=1&gk=9875&gl=5046&ik=9875&co=1009&cp=932&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9803&cd=5174&ah=9803&am=5174&rf=0&re=1&ft=4946&fv=4946&fw=1009&wb=2&cl=0&at=0&d=21887076%3A2593515745%3A5239214548%3A138296534672&bo=27868836&bp=43863396&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1550512653&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:17 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=11&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1583774707239&de=720726408576&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=33&cb=0&ym=0&cu=1583774707239&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4743426211%3A2649638154%3A5305207436%3A138305361674&zMoatPS=native&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=native&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A0&fs=177454&na=1642501014&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:17 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 100ms
99ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjE0LCJjbGllbnRUaW1lc3RhbXAiOjE1ODM3NzQ3MTcuMjg4LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU4Mzc3NDcxNS4yNTUsInRvIjoxNTgzNzc0NzE3LjI3Mn1dfQ==?crc32c=2666675630
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F12369806259566731077&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=251&w=301&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707264&de=467916279984&cu=1583774707264&m=10189&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=58&vx=58%3A58%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=10182&an=5135&gf=989&gg=989&ix=989&ic=989&ez=1&ck=1101&kw=879&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10182&bx=5135&ci=1101&jz=879&dj=1&aa=1&ad=10067&cn=5020&gk=874&gl=874&ik=874&co=1188&cp=1103&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9984&cd=5137&ah=9984&am=5137&rf=0&re=1&ft=5122&fv=5020&fw=986&wb=1&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301433147&bo=27868836&bp=43863396&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=949175179&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:17 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 7ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=11&i=PENTONMEDIA1&hp=1&wf=1&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1583774707622&de=142259656182&m=0&ar=b63606d9a9-clean&iw=e4a6545&q=34&cb=0&ym=0&cu=1583774707622&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=17527716%3A193997916%3A42403476%3A138212589663&zMoatPS=video&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&bo=27868836&bp=43863396&bd=video&dfp=0%2C1&la=43863396&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1298%3A1334%3A0%3A2164&fs=177454&na=323953689&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:17 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
8ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F12233897056553615782&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707424&de=191007637240&cu=1583774707424&m=10375&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10166&cd=5137&ah=10166&am=5137&rf=0&re=1&wb=1&cl=0&at=0&d=21887076%3A2672868198%3A5314204047%3A138305844955&bo=27868836&bp=43863396&bd=rec2&zMoatPS=rec2&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1331382642&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:17 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&vb=13&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=480&w=640&fy=472.5&gp=358&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707104&de=800992366892&cu=1583774707104&m=10738&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=358&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=10153&an=5117&gi=1&gf=10153&gg=5117&ix=10153&ic=10153&ez=1&ck=1084&kw=900&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10153&bx=5117&ci=1084&jz=900&dj=1&aa=1&ad=10023&cn=4987&gn=1&gk=10023&gl=4987&ik=10023&co=1159&cp=1101&cq=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9970&cd=4933&ah=9970&am=4933&rf=0&re=0&wb=2&cl=0&at=0&d=20049636%3A2624997803%3A5225689428%3A138303944225&bo=27868836&bp=43863396&bd=welcome&zMoatPS=welcome&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1224384311&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:17 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
253 B 8ms
7ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=25&q=2&hp=1&wf=1&vb=13&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Fwww.darkreading.com%2F%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F-&i=PENTONMEDIA1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGH%3Ch%2Cqkc!p!ny%7BiY81%22ASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN%7CDoD%3DhA&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fnew-ransomware-variant-developed-entirely-as-shellcode%2Fd%2Fd-id%2F1337260&id=1&f=0&j=&t=1583774707254&de=856187413122&cu=1583774707254&m=11157&ar=b63606d9a9-clean&iw=e4a6545&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5999&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A1298%3A1334%3A0%3A0&as=1&ag=10060&an=5030&gi=1&gf=10060&gg=5030&ix=10060&ic=10060&ez=1&ck=1007&kw=820&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10060&bx=5030&ci=1007&jz=820&dj=1&aa=1&ad=9958&cn=4928&gn=1&gk=9958&gl=4928&ik=9958&co=1109&cp=1020&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9867&cd=4842&ah=9867&am=4842&rf=0&re=0&wb=2&cl=0&at=0&d=30729156%3A2652522375%3A5271825262%3A138301772089&bo=27868836&bp=43863396&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=27868836&zMoatOrigSlicer2=43863396&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=43863396&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=177454&na=1123872786&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 09 Mar 2020 17:25:18 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Mon, 09 Mar 2020 17:25:18 GMT

GET
H/1.1 200
OK eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiO...
track.celtra.com/json/ 35 B
242 B 100ms
99ms Image
image/gif 52.204.255.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNTgzNzc0NzA3eDczYjhmNjNlZmMwZmQ4eDUxNjA1ODc0IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIzOTI3NDAxODI5NDM3Njc4IiwiaW5kZXgiOjE1LCJjbGllbnRUaW1lc3RhbXAiOjE1ODM3NzQ3MTkuMzA1LCJuYW1lIjoidmlld2FibGVUaW1lIiwiZnJvbSI6MTU4Mzc3NDcxNy4yNzIsInRvIjoxNTgzNzc0NzE5LjI4OX1dfQ==?crc32c=3911074992
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.255.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-255-228.compute-1.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Mon, 09 Mar 2020 17:25:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.adsnative.com
URL: https://static.adsnative.com/static/js/render.v1.js

Verdicts & Comments Add Verdict or Comment

432 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://i.cmpnet.com/s_code/at.js(Line 9) Message: AT: Adobe Target content delivery is disabled. Update your DOCTYPE to support Standards mode.
console-api	log	URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260(Line 497) Message: lpage==>notblocked
console-api	log	(Line 2) Message: step 1
console-api	log	(Line 4) Message: step 2
console-api	log	(Line 6) Message: step 3
console-api	log	(Line 8) Message: step 4
console-api	log	(Line 10) Message: step 5
console-api	log	(Line 12) Message: step 6
console-api	log	(Line 14) Message: step 7
console-api	log	URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260(Line 505) Message: interstitial unit found
console-api	log	URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260(Line 510) Message: not empty Interstitial
console-api	log	URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260(Line 91) Message: in welcomeAD img
console-api	info	URL: https://platform.twitter.com/widgets.js(Line 1) Message: You may have been affected by an update to settings in embedded timelines. See https://twittercommunity.com/t/deprecating-widget-settings/102295. [object HTMLAnchorElement]
console-api	log	URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260(Line 500) Message: 5 second timeout
console-api	log	URL: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260(Line 519) Message: unhide main content

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6600d6d98e534115970f9529a45f3195.js.ubembed.com
a.teads.tv
ads.celtra.com
adservice.google.de
assets.informa.com
assets.ubembed.com
bat.bing.com
cache-ssl.celtra.com
cdn.flipboard.com
cdn.syndication.twimg.com
cf-images.us-east-1.prod.boltdns.net
cm.everesttech.net
code.jquery.com
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dpm.demdex.net
dsimg.ubm-us.net
fonts.googleapis.com
fonts.gstatic.com
fpn.flipboard.com
geo.moatads.com
googleads.g.doubleclick.net
i.cmpnet.com
i.ubm-us.net
idsync.rlcdn.com
img.deusm.com
img.en25.com
img.lightreading.com
in.ml314.com
ins.techweb.com
match.adsrvr.org
maxcdn.bootstrapcdn.com
ml314.com
ng.techweb.com
pagead2.googlesyndication.com
pbs.twimg.com
ping.chartbeat.net
platform.linkedin.com
platform.twitter.com
ps.eyeota.net
px.moatads.com
r20.rs6.net
s.adroll.com
s.ytimg.com
s2150.t.eloqua.com
s657486201.t.eloqua.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
static.adsnative.com
static.chartbeat.com
stats.g.doubleclick.net
sync.crwdcntrl.net
sync.teads.tv
syndication.twitter.com
t.teads.tv
ton.twimg.com
tpc.googlesyndication.com
track.celtra.com
twimgs.com
u.heatmap.it
ubm.demdex.net
ubmtech.d3.sc.omtrdc.net
www.darkreading.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.youtube.com
z.moatads.com
static.adsnative.com
104.244.42.136
108.128.171.217
13.227.156.100
142.0.160.13
143.204.212.151
15.188.31.119
151.101.113.131
172.217.23.130
172.217.23.98
2.18.232.7
2001:4de0:ac19::1:b:3a
2001:4de0:ac19::1:b:3b
208.75.122.11
209.167.231.17
23.11.238.95
23.210.248.216
23.210.250.213
23.45.108.93
23.58.216.7
23.62.118.225
2600:9000:2057:6e00:14:85db:2b40:93a1
2600:9000:2057:7800:e:5a70:ca47:86e1
2600:9000:2057:7a00:18:1fcd:349:ca21
2606:2800:133:7403:4a68:7eff:710b:1ddf
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2606:4700:3031::681f:459e
2606:4700:3032::681b:9174
2606:4700:3035::6812:28f2
2606:4700:3035::6818:7875
2606:4700:3036::681c:3e5
2606:4700::6811:7963
2620:103::192:155:48:119
2620:1ec:c11::200
2a00:1450:4001:800::2003
2a00:1450:4001:814::2003
2a00:1450:4001:819::2001
2a00:1450:4001:819::200a
2a00:1450:4001:81a::200e
2a00:1450:4001:81b::2002
2a00:1450:4001:81b::2003
2a00:1450:4001:81e::2002
2a00:1450:4001:81f::2004
2a00:1450:4001:820::200e
2a00:1450:4001:821::2008
2a00:1450:4001:821::200e
2a00:1450:400c:c00::9c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.120.242.149
3.125.70.222
34.196.252.78
35.177.85.121
35.190.72.21
46.105.202.39
52.204.255.228
52.214.152.253
52.215.103.126
52.222.149.68
52.31.188.35
52.31.92.58
52.45.19.11
52.49.96.126
52.6.46.73
54.171.23.184
66.117.28.86
99.86.3.13
0128cd161adbfcff922002fefc5a391c4996ddb28a690f5063c620359c0f62f1
01b4ebef3b601f246d0adbff5259fabbe7c8e0311f1169b495f0bb2b862db981
020d8d4a55a5f088527c3c75c3ac4920b8f190393f841071d6f3d00807e07abc
05fb3aec19b88f9bfe8d138014f7333eace881236b39f8270e02d12705a1fa6b
0615fb751c4db849533b1e432f05428e307591466902876f8ab30d7873b7f38b
06a65aae752e354adc66b935cb0fade25c9d8a058817ea4905777409ad6d4ba7
08b9930656cc11228e9fff356f686957aaae564864fd833f682d8a7cf9b2568f
0a4f12795a11d0957a7e476cdd2516967e3e00f54841456fbd8c0dd607984d92
0b6f5ef9a0c4b8bdc17d9f04174cf25472ee3e519abe18e5edfe46a736ec86bc
0c79b980bfb9fc0bd91096cfd7e48c7e582111e8b79af437e49b1406d6d189ec
0c7fe4b707e153435add875b62934624b6714a03ae370b26af724eef1eb01f9b
0c9111d9514a49ad97e7c6d5fd97a00f3232b73537e9155726f32f123eb69b5a
0f762bf1a58c917c1ad50006bfcd192ab55b2d01a857b7c08b6c40e3af878695
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12bf529a0f4d0a3f10d003a07d5b91e40579a3da18022a9896a9ccd9e5dc1b33
190f689e0f479324a217a5ea88c1acc132b66d24b16559052d59b892ff5dcba2
19374fcc7ff52aa97571eee92f23c9a4752348be26b19650f39e2054f7c46ee5
1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e
1ae4b8548f250831a2443bd449af625f6331b7c72e1f408789642a3050596d45
20cbcc1c3a0b7c92033adbeb8f6f8b0cb03067db48a19f7116b40e8f2fbf8b3a
22c53eeed2c33c21657590793b89fed83648ee555686c0e9ff90b39c1dab406f
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2542142bdc331698a291e4bc03d74becf379dbb3b08d39c4c3f70602c4ed1034
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
25b438de3e944547e69c6de98e403f46a9aa4fb98e6d1bb34954fd30ebc19b56
2d1a1e169b7a4da51417cc2f5d7383985686e3f8a9393b60378218ecb421bed8
2e6d76ec41c1baf73290dd70b2a10a26051d77980e34d048527b6445e7d403dd
2e8482bdd64c06f5dad92fc1e1efa5815f58f5664578a65a9b9ec783dacc9726
2e8c15ba0e22d227940fcc5ae790599e1b32a636d9b28e174e864a4884ee7e48
2e9b6fed568a85ee88f1eb2aa1d51cb2073d907cbb0109a5dd703f0b1e5651d6
2ec7b8d3c38a996f67dd4e580c975ece3e9d936d4267167d12604a59a5ff2c87
300da6e41a56c8946f29a6094e4addf4320ea4451e2e1dd8826c919f6c79f639
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96
32821e69d091e71a62b9dbefcd09516c2133b50c50a3f8d597207d9cab5d59b8
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32dcd73ca3788f4f757d371d426005ae1a99cbbc4969f6aaa2ed503474925d08
32df070de698280624a56831ba45ed7d81aca91656449c995bc27b7ecc8c0d39
33194e1b282eaf349b01b68de4fee20452ff6877b4b82605d5c68c5132444f96
39b400a9f636b03c497e9f79bb638536984d3619774d1a01993a46df9a1be610
3a08be5766c0e198ba8171f7decd09065c08a5c850276325cc1792f25e7b356e
3b10a4f01914d6d1d67b68554e556679bbdc63005698cdd7bfc6b44cb69da4b2
3bb72e5a3bd7858a708f629dfc7e2f2aa9d87ee8a43b1c22b300e49cd59b09d7
3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407
3eea91bd1f33507891a2909689d21be3a6e0fb1b688037c2a7d59c042503d910
42842c4928fd167ff3cb57a681061cc609ff70b25f836395da313a26456e1820
42eb48be2f9f6fc91fcda10af9802cb6aa0733e2dd007c224570ae6ece3dac33
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4472e0ceca33180067aafdf870091d23fb1a0164e80c07ec1c2bc48db842be73
44fc0a3d10c47ae5aa6c77c76b4b8f81aa08022ca464ef235005ddd86570eb5b
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
46e1109b1a9dc991584ac42539c30d102c54689b011168c0c0d12af0ab4c4efb
47b3c860615f2e891107d75ab26407dc9029a16ee7bb76f7510c50a70688b2ef
48d211ee8f54e0f314ee98a2b63e6e470b33fb1de29d326c742be16125bda71a
49dcb28156fbd6c88489ceae8a96eab5e121f1d6d91c82276532d62645aa760b
4b17f65b9c3e956c423712d1f6fad95924947f4ea247683ff9f4174886052532
4bbed2de83df27dc8130644101bce3dd9ddd1c178815e42bcb49118b4a73593c
4c611336fd66dfb1fe52805debfb7dc11fd1b7f1ef2eee5906e694b2e971cce1
4e19e8f9902a8b9ec4840aaf54110d6f502c5fb500303dc605f8776c40f7fb67
4f65ccd30d1c95588b51035a804dd49090d7fbe6c2829a576a31d1b6a3e0f86b
4f89a03faa36f0b6eeb92b9a8f0b8d2f9d3e564ba8bf13bb169bf05b126ca81e
4fcf5bed75a5547edeb07af473406d2dac2f503d5619ccfe1292f0c6ebabbb88
50152a4756f38eac1830111c706d04740b68ddb53d97aa94c68de6026235b18e
523296d1a2c9a67ee707b5e0bc582f488e5786ec9b343c7b3da58a0d162d643b
53f83e776d713dd6b76e98420c835c52e590dad99052a334b4944469786b08b8
549f49487512850a6147e411ca138deb4d69f5b370e636147619992b45c77c2c
550c6a88ee405b6fb7ccc8f8c678267cbf9ea9e84943e40666e351236caf13e8
58b80e76b2b6651b65aff604f3bd10c953b6e166eb3346c138f920ddc1ad8273
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5ae735414fe2497e924391ed5121dacd3c6d564121a8413972be632935fc6c73
5c0f79d0286f1fd3db48e1b689358017b302c0f4babde540329e8c644cf119c7
61494fd1b573b217034bef7e22044bda91962797d68efada6726910d32bb995b
63484bd691450c081b848e5159315bfcd02720741d3f72a69717643d6630e578
6414656f939f73a463499bd2c5a8f75793658adf6e05d0e4cd61d1ba36636b94
66a92244de497ebea9b54ea4b9ccd71b8737cda6cc1fb99c6a5eb7e7ee809053
6b32273d502be4ac793cba3d1e1524fcfe423a433c822ab529b1f77af0b8d60b
6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae
6bc989074a638723131c3bc22eead89716e09dc81f6c58ea823899ca45928cf6
6d67581d18a9d2df5fb620752a03f947d9559a384b0702b51edf8db94006e9d1
6dd394ad8df7d5e2ed0f220ff18451f281ccc907cae0d25d233c51533ad8887f
6e504d72d0b8fe63b71774d746594a7d13607ee5313241cc546a1bcd47909677
6e796da2a1b9bbbdc24bf2e2dc1b8f960f531bfe1033c0f073a4bbfe73e54a84
71c805ad1e5135a1d4dd9fccaa913bbdaf94cc3608d9619e5b546c1b865a2c16
7259b4d8e7ac33a579f3a8df3b0eb3fa9c0818ae203fb58b45564cf4d2057ca4
726209d3c6b425ecf1d7595ddac0381cb5d63daf5d53b62eb29c50b130075c62
72945876902af2cd35e37c7dc27c9a1ece0e3f3185100c36f5e55e468182467a
731e7bf0e3b7c8fb1978a6c04ba3940b77ce5166bd55dcc2c710baa011c517c6
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b02cdb496b954e874c4b87d48eb1ea16f088258786ed0d2f0771acc3d01649e
7b5688f8b168e06251901442c4f2f72b30c4477cb472833cde7979a8dca0a862
7bb0d75d42e3ccf1a9d1a055bcddfbc23003ed3ab75bb0eb49c05ba747bce8c9
7dae52f46383dc9d6ae308dc581ec1e932e36b95b017cbd0fcb7d0b22630b190
7e2a850bdefa6b9bb2075030d39bcc5dd8f9beb4be4042e772b00657e527c9cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8420f59cd348cf0e10e05482724523ad6b83f88467bbfacf6826eaadd3a03985
85825dee492b21f4730c29f8be895a878ef69e5780d87b57659341626d337193
87cdbacb358e421a482bc1a52dc9cfc04a9f6d8dfe86c7c6c66bcde013792850
89b531e78902333807b825faf77cd11cc927fe364ea2ba9307f65365f7e811f7
89c196ec658af676f972dba9c07c0da79d2c6434e38c01698187488db700197d
8b2fd43985ac7b6217a7cbe64e46baf5485f32751a97b4ff2b630bd3f1e2924e
8c792dc2527753d5f758a812c5de2225dba619ecd83b05713ce68b0db858fa28
8e2a7a86808b4525f0ec38407f1546fd1402a11a801419b3d16bb278448ec5da
8e7ad8de87781f6ad65b36a7d3243b44d80dc182df6af076484a2bec85051550
8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55
8fafe784f7e1f13fccc7782f6c524a6f340b0b487b65c45aac414d09e6daded8
90c13e25698f5e3841a21a599c8330237de9d9b719984f51c5dc8939f22330f5
9182e8a1e20a5437d2f311b096b2a98a33d54e94d4d9d6d01c5db3861460d04e
91b999073494a3ced432cb47d480d8402966c7c01f43a25439695c73b7c7dcf6
924b3a471d549de6251aea0e74fe6eb136141d3f0a8bf001906fff933dec45d4
9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39
95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8
96299ace5c463e8afc087fa1d03051487f1692c42264f5221ea4ad973273b88b
973ccce3f58b175a9e021c76978726083cc7e5cbed75cd0ff09ff83919934d15
976aabc512994a6ecc5981a85c489d1bb242ba6734b746a964d69db615f72875
984cd1fa5dd20c2b1b8fd77b6bb876a3a211cdf14aaaed6bc1481e3c98027544
986a9a68846891187a526dae3ba212d577c71244ee1a61550098d867c07e8b03
98fb88ec226feae902fb7f98528a41db7abd7de155a6d7b65658c6ab7f2b95f4
999023ff259a0e58ef0053e6b5b512af582f7f032d11a79a1a212ec2be8e27df
9a33c7d20bf573e9d3e0f86ccad6c36bf6fe8e5094768e4fe01e33fe3cd183d5
9bb134ceb966cd6cbccfec7ab7dcb2fede6b0a5705e991030c0c248670d99168
9c6af299685617864c257472040f437ef951afec994720a24781931cc3527017
9e0e2ad3a93ec78d016efee0993b5856ba9b4acafcee3aa4d6f7162f039fcce4
9f61400081191bf755c967c186a8fd356b02010fac3412f84cf83d5dfe10dd5d
a0761aa1289035f3d20430d55e475043a8fa40deff221715e31068905d561753
a0a556e0975784e00d56bb4b5ccea4ca10e03f6bc1ff88ad56e903c937689db9
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a290ede885635a3f7bb2b8e630bf795f15dde146fea32520b775bee1b2926ff3
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
a6595372db2688a9dfb0991bc6cea16343042dd3caa33483b393d21a77d1c4be
a78175dbd179decf574f642359a7023ec93803a7860733da37387c298e1047f8
a782f5c6312b15a57bc5cd6516c26c08bea8ebe5f27cf1062d08ed933c1e37a6
a78d1a014ffb73ea1788d562070f9de9145793b25ebfb1d9e44b1ae3eb843b7a
a8041ba3d02102bd99dcead4dcc9882c484902362927cfd598e389e930f68ceb
a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2
a8f4fa7376444ffe05d0f7b296439401fb9729bdee84d760ee6286e7b663c753
a8fc74838ba253a4076b8eb46aeed79c10341380609dcfe11bed40d974d1fd10
aa92b44ae441805b86a9603ffea3890a8df348fb2269d716c557b6970c11e9f4
abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adaa73d536a85fc4e5194a0644aac1a330ad70dab0445b4f6770b98d3576b593
aefbf827e3559e0744dc70139d33206a03d5edeb74b3f54cea1ff86b2928bd7c
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b19f14d674857362b6e10d0dcb1703b149d9dda6f350d1737562fc36e4e67a81
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b309c9c4a6c27c7cfc64ab2bc7f545e8d7b41a795c46202ab2a9c633f7128287
b4cf7d6d50b6a36f070f6c49e975198a9a8930838695b64e480bf1f6199f0572
b5c543f59d71e1e4f6b51c896febf86975206dcf9e34757f475b125d64d16ea6
b5dfc0d97e0734652638fc54c6174755ae124537eaecf8df5df3f37ce857bd9e
b79f5c38e0f42108b7a0a64434e881acb07f31b1a36d67fba9502b39ed827df4
b8b7d1f10441c7349e88ed2a168e0635836f6724999f91ea8d15ecd4811dad38
b90279154254e108748dc80dd226eab336e2c320e4a40569952b46dc5d785536
bdde153c2225a8ece83bee8df43f9f677bba41681f9be21e450a95efce937c59
bf298157a19ff06a7b27a36eb4a3be2994016452a5f9c1ad6b480aa7ce3799ff
bfc1797e85a0565d0cfba1621eac801dc5ebd78a02f45e0ab8de5c6c2eb3f987
c670b28572ed7804386b274eb1ddafbc0253a1aff515b0d15805c57c26bcee64
c7124f8ff86138008f3386c9fafd3c17a6e5e6c739e6edcf5d47e750f46c1aff
c77f42aea4f02906b5e36f9f9024db87b1e1b37c818be2126a3e24d158ac4c02
c7d1ee4f5a608fa05b8f9c6cbd47e3eab7516facc3380d704b7332805877afff
cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d
ccb577fe731d9954057d10cd6d941eef90e15af6d1b0e4b1469f0ad3af3e84e4
cddbf405266cd4b3e66229592e63666012dbceaaad02635af5da9d303bfd3ed1
cef013ba053c40f6bfa36baf6b11dca3426b1697bb52bec0902a4746f5f7d169
cf167be72549318f78f8c03d0d93b923f8e8e290acec47b870a1cede920e859b
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf7bdb0487590885c13a3cc0a2a1450b3ac649a465de267af12f552be8bcb5fe
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2
d2bfca2ce599253f607327986a937c70382e124c8ebda7e307a16de5456e7616
d2cb9c5d8afc8f538bea2f545024ae5d6040d9a580d3bfc235189dd9953132af
d61987a91f9b986e18af273a5aee45ec1256c64df947a156efa81dd96dce56df
d6df7d1f2b9c65c06c5ae1e798650b6c388f26f6852b8814f942557d712b9745
d8b7ea5cc75abc79d502a95c5ccac8f97aa82fd8c13acc74c84c754eb86cc4c3
dafb72bcf008c9b9754482b88e8ba8b8e854f1a69483f0753b1c3f12101c1a9f
de309132f417ea1f43ee235841b11e40081e1ea204cbbf29b9c896dc3350dd64
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df25786bc3951d78d0f763a2a75a1f33b01b8ae2a5157831d2cf4d0348c2ede7
e06370b8e243c8fe64fd3ada669f839977615a5e24a06809d8131521c2d7aaf5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5741553501e4a93f4f52316c8cbfe332cac5f3fa6a09b07221abb05694b1894
e5cc2027e2da5b3d553fba6a4d2d7276aafa604001e9b0321e18d1fd62b03b3f
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
eb12eaa9c690d06187a7099545a6bf52318a2364411fc9c4ec73e7fa4ecbb0f9
eb2994e47a5c04ad9deb84c59d0b7fc3bd9d97d7e830047ea980c2e757577600
ebe3a0272a317857bf566a0deec42181bf0e89d280bb3143bba14da1ae1ddb10
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f
f30d5c0433d74c8224a2343a3c6c08468015909c22315b8693f9bdee33f48217
f3bd482cd3ec17583f25ad0819d1ccbcd0cdcb0fe26f8d87b7f30fd61b3dc640
f3c29694754d2b8fd7c310f93f42217d6a01acefe0606f5778d4f804c4eb895a
f5932acd6c5f2796f354dedc5e8dfe30e206787365186bbf0f9789d083472a75
f598a8748bf3e022bb3b431e6a0ad2b735d99b41288d56361dc9ce63b4e4d285
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f6bef375bb199a0575c58918203cef98c4f346fd1684f9fc6b8425017fc09822
f82c9f099656346f543c66ba009bd5f18010c7b41ad43d47a7f762121ad4496d
f851a9c6eb2bc09da1f51b84e5d218efa514d76c6fa53e803f22ad7dca9f93cf
fb295c2a72d39784b18a1d2d5b0c9976807f7cf010fe730b86d43bc55b0ae251
fbb475f48d03815474a554d3c16599917c2fabf811e3fe2772aeabeee474aa8f
fc937ce1b8ba00973e0ae5a18c30dada07a271d1e3f86f6a3b38aa28944924e1
fd2f3015d1e62a6f24420652afa85f8dbce31636ea8ee86781dc794c243dec68
fdb0066a030a45bd44f17d459c6369901b3fa648c94de3afa0f824d87dfd1527
ffcaeef328a1e67717f714997426aaf936e4b9d378a5fbe1bd2a063dfeb50750
ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc
ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

www.darkreading.com Open in urlscan Pro 2606:4700::6811:7963 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

340 Requests

99 %HTTPS

47 %IPv6

52 Domains

74 Subdomains

64 IPs

8 Countries

4742 kBTransfer

10759 kBSize

0 Cookies

54 Outgoing links

Page URL History

Redirected requests

340 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.darkreading.com Open in urlscan Pro
2606:4700::6811:7963 Public Scan

Screenshot
Live screenshot

Full Image

340
Requests

99 %
HTTPS

47 %
IPv6

52
Domains

74
Subdomains

64
IPs

8
Countries

4742 kB
Transfer

10759 kB
Size

0
Cookies

340 HTTP transactions
11 data transactions