minerva-labs.com Open in urlscan Pro
67.205.167.225 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Submission: On February 14 via api (February 14th 2023, 8:06:54 pm UTC) from US — Scanned from DE

Summary HTTP 72 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 19 IPs in 6 countries across 14 domains to perform 72 HTTP transactions. The main IP is 67.205.167.225, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is minerva-labs.com. The Cisco Umbrella rank of the primary domain is 73064.
TLS certificate: Issued by R3 on December 21st 2022. Valid for: 3 months.

This is the only time minerva-labs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	67.205.167.225 67.205.167.225	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
41	185.94.190.147 185.94.190.147	9009 (M247) (M247)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
5	2a02:6ea0:cb0... 2a02:6ea0:cb00::2	60068 (CDN77 ^_^) (CDN77 ^_^)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:400d:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80c::200e	15169 (GOOGLE) (GOOGLE)
1	13.32.23.71 13.32.23.71	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:925b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a852	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.210.48.242 34.210.48.242	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:915b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	44.241.155.87 44.241.155.87	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:402... 2a00:1450:4025:401::9a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::ac40:9197	13335 (CLOUDFLAR...) (CLOUDFLARENET)
72	19

7 67.205.167.225 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: 753902.cloudwaysapps.com

minerva-labs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 185.94.190.147 (Budapest, Hungary)

ASN9009 (M247, RO)
PTR: adglpg147.smuniz.pw

586202317.r.cdnsun.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6ea0:cb00::2 (United Kingdom)

ASN60068 (CDN77 ^_^, GB)

cdn.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:808::2002 (Ireland)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80c::200e (Ireland)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.23.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-23-71.fra56.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:925b (United States)

ASN13335 (CLOUDFLARENET, US)

diffuser-cdn.app-us1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.210.48.242 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-210-48-242.us-west-2.compute.amazonaws.com

api.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:915b (United States)

ASN13335 (CLOUDFLARENET, US)

prism.app-us1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.241.155.87 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-241-155-87.us-west-2.compute.amazonaws.com

api.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4025:401::9a (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9197 (United States)

ASN13335 (CLOUDFLARENET, US)

trackcmp.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	cdnsun.net 586202317.r.cdnsun.net	469 KB
7	minerva-labs.com minerva-labs.com — Cisco Umbrella Rank: 73064	33 KB
6	userway.org cdn.userway.org — Cisco Umbrella Rank: 5166 api.userway.org — Cisco Umbrella Rank: 5219	44 KB
2	google.de www.google.de — Cisco Umbrella Rank: 5268	562 B
2	google.com www.google.com — Cisco Umbrella Rank: 2	562 B
2	app-us1.com diffuser-cdn.app-us1.com — Cisco Umbrella Rank: 8145 prism.app-us1.com — Cisco Umbrella Rank: 8181	6 KB
2	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 3173 api.amplitude.com — Cisco Umbrella Rank: 1465	22 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 41	20 KB
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 43 stats.g.doubleclick.net — Cisco Umbrella Rank: 95	2 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 228	38 KB
1	trackcmp.net trackcmp.net — Cisco Umbrella Rank: 8241	315 B
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 5407	2 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1967	2 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 66	79 KB
72	14

	Domain	Requested by
41	586202317.r.cdnsun.net	minerva-labs.com 586202317.r.cdnsun.net
7	minerva-labs.com	minerva-labs.com 586202317.r.cdnsun.net
5	cdn.userway.org	minerva-labs.com cdn.userway.org
2	www.google.de	minerva-labs.com
2	www.google.com	minerva-labs.com
2	www.google-analytics.com	www.googletagmanager.com minerva-labs.com
2	cdnjs.cloudflare.com	minerva-labs.com
1	trackcmp.net	diffuser-cdn.app-us1.com
1	stats.g.doubleclick.net	minerva-labs.com
1	api.userway.org	minerva-labs.com
1	prism.app-us1.com	diffuser-cdn.app-us1.com
1	api.amplitude.com	minerva-labs.com
1	ws.zoominfo.com	minerva-labs.com
1	diffuser-cdn.app-us1.com	minerva-labs.com
1	cdn.amplitude.com	minerva-labs.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	secure.gravatar.com	minerva-labs.com
1	www.googletagmanager.com	minerva-labs.com
72	18

This site contains links to these domains. Also see Links.

Domain
cookiedatabase.org
586202317.r.cdnsun.net
scorpiosoftware.net
anti-debug.checkpoint.com
en.wikipedia.org
learn.microsoft.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com

Subject Issuer	Validity	Valid
*.minerva-labs.com R3	`2022-12-21` - `2023-03-21`	3 months	crt.sh
*.r.cdnsun.net R3	`2023-01-23` - `2023-04-23`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
1667503734.rsc.cdn77.org R3	`2023-01-02` - `2023-04-02`	3 months	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
cdn.amplitude.com Amazon RSA 2048 M01	`2023-01-12` - `2024-02-11`	a year	crt.sh
diffuser-cdn.app-us1.com E1	`2023-02-10` - `2023-05-11`	3 months	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2022-04-21` - `2023-04-21`	a year	crt.sh
*.amplitude.com COMODO RSA Domain Validation Secure Server CA	`2022-01-28` - `2023-02-28`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
prism.app-us1.com E1	`2023-01-31` - `2023-05-01`	3 months	crt.sh
api.userway.org Amazon RSA 2048 M02	`2023-02-09` - `2023-10-31`	9 months	crt.sh

This page contains 1 frames:

Primary Page: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Frame ID: CA7027452C9E628AB7F0BDA6C1621B57
Requests: 73 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Beepin' Out of the Sandbox: Analyzing a New, Extremely Evasive Malware

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css
owl\.carousel.*\.js

UserWay (Accessibility) Expand

Overall confidence: 100%
Detected patterns

cdn\.userway\.org/widget.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

72
Requests

100 %
HTTPS

72 %
IPv6

14
Domains

18
Subdomains

19
IPs

6
Countries

719 kB
Transfer

1657 kB
Size

11
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://cookiedatabase.org/tcf/purposes/
Title: Read more about these purposes

Search URL Search Domain Scan URL

URL: https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/f1-VT.png
Title: <img alt="" width="1299" height="808" data-breeze="https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/f1-VT.png" src="data:image/svg+xml;utf8,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%201299%20808'%3E%3C/svg%3E" class="aligncenter wp-image-3901 size-full br-lazy" data-brsrcset="https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/f1-VT.png 1299w, https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/f1-VT-322x200.png 322w, https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/f1-VT-622x387.png 622w, https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/f1-VT-768x478.png 768w" data-brsizes="(max-width: 1299px) 100vw, 1299px">

Search URL Search Domain Scan URL

URL: https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/F2-created-task.png
Title: <img alt="" width="641" height="27" data-breeze="https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/F2-created-task.png" src="data:image/svg+xml;utf8,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%20641%2027'%3E%3C/svg%3E" class="aligncenter wp-image-3899 size-full br-lazy" data-brsrcset="https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/F2-created-task.png 641w, https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/F2-created-task-380x16.png 380w" data-brsizes="(max-width: 641px) 100vw, 641px">

Search URL Search Domain Scan URL

URL: https://scorpiosoftware.net/2021/01/10/parent-process-vs-creator-process/
Title: here

Search URL Search Domain Scan URL

URL: https://anti-debug.checkpoint.com/techniques/debug-flags.html#manual-checks-ntglobalflag
Title: here

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Trap_flag
Title: Trap Flag

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/api/utilapiset/nf-utilapiset-beep
Title: Beep Windows API function

Search URL Search Domain Scan URL

URL: https://anti-debug.checkpoint.com/techniques/misc.html#getwritewatch
Title: here

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Title: 

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCgOUWVWpa9tWtp6b9-9ZkOg
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/minervalabs
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/minerva-labs/
Title: 

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

72 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/ 129 KB
23 KB 435ms
210ms Document
text/html 67.205.167.225
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.167.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 753902.cloudwaysapps.com
Software: nginx /
Resource Hash: 4f9327d88bbc6affd14e962e6001950a706d7a9e7105f141c790aa845f5cc101

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 9960
cache-control: max-age=0
cache-provider: CLOUDWAYS-CACHE-DE
content-encoding: gzip
content-length: 23280
content-type: text/html; charset=utf-8
date: Tue, 14 Feb 2023 20:06:47 GMT
expires: Tue, 14 Feb 2023 17:20:47 GMT
last-modified: Tue, 14 Feb 2023 13:20:31 GMT
server: nginx
vary: Accept-Encoding
x-cache: HIT

GET
H2 200 owl.carousel.min.css
586202317.r.cdnsun.net/wp-includes/css/ 4 KB
2 KB 330ms
88ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-includes/css/owl.carousel.min.css
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: aa08607bf345854d6f1947653166c745a55caca237c2900cf6502248b258dda5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Tue, 27 Dec 2022 13:39:43 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"63aaf59f-1067"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 4075346
x-storage: 3004124:8001

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ 85 KB
27 KB 74ms
27ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3423376
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27433
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-1538f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bnaAD4CB0z5OEAzS%2F8MGLAZDdOE97LKSRYFBRT%2FMfcaicRl8krWKiq3zdIjvBaBHeg8L0uW56xiwXaU9JHROb7WHcH9bhrRfp1jI%2FnacDblV62tMNwSbsPKMYRFQyDtid2N6ZGYM6sJ0gUMQgtLdV68a"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 79986d25a8ff900c-FRA
expires: Sun, 04 Feb 2024 20:06:47 GMT

GET
H2 200 owl.carousel.min.js Show response
cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.3.4/ 43 KB
10 KB 27ms
26ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.3.4/owl.carousel.min.js

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 439337
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10158
last-modified: Mon, 04 May 2020 16:04:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf0-ad36"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8S2ooWZih0%2F06XPfFgyEiNbFbjX%2FRPK2Ou1k1MujduTrJYD7TsudmM0PV9jGdYuz0NBGlLuPuXGjo9c%2BNFNUGgarO%2BTAATHgWHNXFdYf5QVvlEsYF1lTC%2ByYOwRqMJWJbG3dx0W8oHw4bSjNOOod2yV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 79986d281bc6900c-FRA
expires: Sun, 04 Feb 2024 20:06:48 GMT

GET
H2 200 style.min.css
586202317.r.cdnsun.net/wp-includes/css/dist/block-library/ 87 KB
12 KB 340ms
99ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:41:34 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6cfe-15b64"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 style-index.css
586202317.r.cdnsun.net/wp-content/plugins/activecampaign-subscription-forms/activecampaign-form-block/build/ 70 B
352 B 335ms
93ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/activecampaign-subscription-forms/activecampaign-form-block/build/style-index.css?ver=1659530494
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 55bd442d45ef481e3f0eb795894dd94f1a5e38f2a4847c2f49371010e1e013c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:41:34 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6cfe-46"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 styles.css
586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 331ms
89ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6.3
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Mon, 05 Sep 2022 06:17:26 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"63159476-aab"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 cookieblocker.min.css
586202317.r.cdnsun.net/wp-content/plugins/complianz-gdpr/assets/css/ 3 KB
1000 B 335ms
94ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=6.3.5
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: e13d3a18aa784b8c80d6f2e2416b289eed0b3cadbd2db46562045bab4c45126c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 23 Nov 2022 11:37:20 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"637e05f0-aa3"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 swiper-bundle.min.css
586202317.r.cdnsun.net/wp-content/themes/minerva/js/swiper/ 16 KB
5 KB 333ms
92ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/js/swiper/swiper-bundle.min.css?ver=6.0.2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: d519e904f38d7cf39624a5d9277264b13151dce88586aa8c10763fd29235c220

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Fri, 09 Dec 2022 10:41:53 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"639310f1-4052"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 site-variables.css
586202317.r.cdnsun.net/wp-content/themes/minerva/css/ 266 B
465 B 333ms
93ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site-variables.css?ver=6.0.2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 7bb348d8535f98bb86d86734f61c6260afbbc82026e0ab49de6e7e14ad0301d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:41:02 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6cde-10a"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 site.css
586202317.r.cdnsun.net/wp-content/themes/minerva/css/ 138 KB
24 KB 350ms
109ms Stylesheet
text/css 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site.css?ver=6.0.2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 5a382fb66bab8aad4ff931715bdb7d74f7049da881fa7d61282c2163c6521880

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Thu, 08 Dec 2022 10:23:09 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"6391bb0d-22754"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 swiper-bundle.min.js Show response
586202317.r.cdnsun.net/wp-content/themes/minerva/js/swiper/ 140 KB
39 KB 428ms
188ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/js/swiper/swiper-bundle.min.js?ver=1
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Fri, 09 Dec 2022 10:41:54 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"639310f2-22ede"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573971
x-storage: 3004124:8001

GET
H2 200 lib.js Show response
586202317.r.cdnsun.net/wp-content/themes/minerva/js/ 971 B
753 B 420ms
180ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/js/lib.js?ver=1
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 8eeacc8e6a49f1e75130b6f5e6f5c26bfd87b8eb9228e7412fb182894da4e8c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Fri, 09 Dec 2022 10:41:47 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"639310eb-3cb"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573971
x-storage: 3004124:8001

GET
H2 200 site_tracking.js Show response
586202317.r.cdnsun.net/wp-content/plugins/activecampaign-subscription-forms/ 1 KB
928 B 412ms
172ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/activecampaign-subscription-forms/site_tracking.js?ver=6.0.2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 9a19938485ca7f6c582d3f78d17d9e443d26b260cac24c9dd9499f70b5d28390

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:41:32 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6cfc-57b"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573971
x-storage: 3004124:8001

GET
H2 200 index.js Show response
586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/swv/js/ 9 KB
3 KB 413ms
173ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.6.3
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 29e8de26576208c07ba0845f604e65c9273b93f9f4d1d66214eb4c586f9938c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Mon, 05 Sep 2022 06:17:26 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"63159476-25d0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573970
x-storage: 3004124:8001

GET
H2 200 index.js Show response
586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/js/ 12 KB
4 KB 414ms
175ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.3
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 985fdd42398281348ca133a44750a56fe4909a806b9c075c9443a5d0bd6d2e51

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Mon, 05 Sep 2022 06:17:26 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"63159476-2fb3"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573970
x-storage: 3004124:8001

GET
H2 200 custom.js Show response
586202317.r.cdnsun.net/wp-content/themes/minerva/js/ 17 KB
4 KB 420ms
180ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/js/custom.js?ver=1
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: d106f3a248ddb3ef5d2287fdfcaa7d404a55f75ca05132be1fc9eb5aebc28bdb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Fri, 09 Dec 2022 10:54:55 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"639313ff-4481"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573969
x-storage: 3004124:8001

GET
H2 200 ajaxposts.js Show response
586202317.r.cdnsun.net/wp-content/themes/minerva/js/ 3 KB
1 KB 418ms
178ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/js/ajaxposts.js?ver=6.0.2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: b3309b42777eae75311a8fbeffcd7f3eae2fc042d0992ccdbcb62bfb5b3a6451

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Fri, 09 Dec 2022 12:42:30 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"63932d36-a0e"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573969
x-storage: 3004124:8001

GET
H2 200 breeze-lazy-load.min.js Show response
586202317.r.cdnsun.net/wp-content/plugins/breeze/assets/js/js-front-end/ 7 KB
4 KB 417ms
177ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/breeze/assets/js/js-front-end/breeze-lazy-load.min.js?ver=2.0.10
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 3abb2e59349a3cd1748f36a0e00771d600b22fb1ee8e2a3086dba9d359786217

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2022 14:16:03 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"6357efa3-1c89"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 1222210
x-storage: 3004124:8001

GET
H2 200 smush-lazy-load.min.js Show response
586202317.r.cdnsun.net/wp-content/plugins/wp-smushit/app/assets/js/ 8 KB
4 KB 430ms
191ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.12.4
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Sun, 27 Nov 2022 10:11:26 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"638337ce-1ef2"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573969
x-storage: 3004124:8001

GET
H2 200 complianz.min.js Show response
586202317.r.cdnsun.net/wp-content/plugins/complianz-gdpr/cookiebanner/js/ 47 KB
11 KB 94ms
94ms Script
application/javascript 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=6.3.5
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 667cf079e0c4ea0eac896d368aacf29aa7b4a53f1a1685e14748840ed70a67b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 23 Nov 2022 11:37:20 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"637e05f0-bde8"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573968
x-storage: 3004124:8001

GET
H2 200 wp-emoji-release.min.js Show response
minerva-labs.com/wp-includes/js/ 18 KB
5 KB 104ms
104ms Script
application/javascript 67.205.167.225
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://minerva-labs.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.167.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 753902.cloudwaysapps.com
Software: nginx /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:41:33 GMT
server: nginx
etag: W/"62ea6cfd-48b9"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 227 KB
79 KB 106ms
50ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WJ4TZK

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5edb65e763e5713dbbb787dea6ead0e9716e4490fc7dddcfce4cfa588e7322a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80642
x-xss-protection: 0
last-modified: Tue, 14 Feb 2023 18:22:47 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Feb 2023 20:06:48 GMT

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 arr-submenu.png
586202317.r.cdnsun.net/wp-content/uploads/2022/06/ 152 B
422 B 90ms
90ms Image
image/png 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/06/arr-submenu.png
Requested by: Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site.css?ver=6.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 4d5c848c1426167c78f19dfe0712f224efd0e641799819b6f5d7b7c40c72bf5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site.css?ver=6.0.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Sun, 27 Nov 2022 10:18:54 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "6383398e-98"
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598424
accept-ranges: bytes
content-length: 152
x-storage: 3004124:8001

GET
H2 200 plus-jakarta-sans-v2-latin-500.woff2
586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/ 11 KB
11 KB 253ms
89ms Font
application/font-woff2 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/plus-jakarta-sans-v2-latin-500.woff2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: a3ddfd67a9a445b14261ba2d72e58584be48af882792d27abaf159f96d0045d3

Request headers

Referer: https://minerva-labs.com/
Origin: https://minerva-labs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 03 Aug 2022 12:40:08 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "62ea6ca8-2a3c"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573966
accept-ranges: bytes
content-length: 10812
x-storage: 3004124:8001

GET
H2 200 plus-jakarta-sans-v2-latin-700.woff2
586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/ 11 KB
11 KB 264ms
101ms Font
application/font-woff2 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/plus-jakarta-sans-v2-latin-700.woff2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: ff11e55bfe10389758e1bf9193b8b72df0fcfffc93d285b84ec620313d5c253f

Request headers

Referer: https://minerva-labs.com/
Origin: https://minerva-labs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 03 Aug 2022 12:41:15 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "62ea6ceb-2a38"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573966
accept-ranges: bytes
content-length: 10808
x-storage: 3004124:8001

GET
H2 200 plus-jakarta-sans-v2-latin-regular.woff2
586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/ 10 KB
10 KB 259ms
97ms Font
application/font-woff2 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/plus-jakarta-sans-v2-latin-regular.woff2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: deeb6f39525157ea35bd78f27177c7d5f62e42b20a48b96788c063a150dbe932

Request headers

Referer: https://minerva-labs.com/
Origin: https://minerva-labs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 03 Aug 2022 12:39:55 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "62ea6c9b-28b0"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573966
accept-ranges: bytes
content-length: 10416
x-storage: 3004124:8001

GET
H2 200 widget.js Show response
cdn.userway.org/ 1 KB
1 KB 261ms
37ms Script
application/javascript 2a02:6ea0:cb00::2
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widget.js
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:cb00::2 , United Kingdom, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: b1932b90bf81755c4d47f2f65671488c5263891f04ec3096fb483e33d9e23e95

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

x-77-pop: viennaAT
date: Tue, 14 Feb 2023 20:06:48 GMT
via: 1.1 ba761cfda8bfa6cbda2b6c433d6201f6.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: VIE50-C2
age: 1070
x-amz-server-side-encryption: AES256
x-cache: HIT
x-77-cache: HIT
x-age: 2861
x-77-nzt: Abm0DAb4oU7/LQsAAA
x-accel-expires: @1676405947
last-modified: Tue, 14 Feb 2023 10:59:33 GMT
server: CDN77-Turbo
etag: W/"0b6e64b198945a1bfba2dcc404c1648c"
x-77-nzt-ray: fefc880d40f9a5d3d8e9eb639cc85f23
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=3600, public
vary: Accept-Encoding
x-amz-cf-id: t5_zd_LhfcN-euhCpr_wK8KaP7Ng6XScWqvBwNClWRE8F6A_xXM0DQ==

GET
H2 200 Mask-Group-7256-4.jpg
586202317.r.cdnsun.net/wp-content/uploads/2022/06/ 54 KB
54 KB 95ms
94ms Image
image/jpeg 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/06/Mask-Group-7256-4.jpg
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 11568d9e1e534bc0832025072adf5e454ebf4d54e6db15c3489c4784b703b9b6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 19 Oct 2022 11:31:02 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "634fdff6-d78b"
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
accept-ranges: bytes
content-length: 55179
x-storage: 3004124:8001

GET
H2 200 Beep-malware-2-1.webp
586202317.r.cdnsun.net/wp-content/uploads/2023/02/ 62 KB
62 KB 123ms
123ms Image
image/webp 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/Beep-malware-2-1.webp
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: ae53371d0523e6bf7b50eea545dd42865f39fce2ef4c8d7766941212e8045b9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Tue, 14 Feb 2023 06:57:21 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63eb30d1-f69c"
x-cache: HIT
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 46515
accept-ranges: bytes
content-length: 63132
x-storage: 3004124:8001

GET
H2 200 baroncapital-featureimage-1-149x83.webp
586202317.r.cdnsun.net/wp-content/uploads/2023/01/ 2 KB
2 KB 142ms
140ms Image
image/webp 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2023/01/baroncapital-featureimage-1-149x83.webp
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 6f77f72e501eb5686f2d1352bd5bddb84635a5484e84d981016d60c20816c10a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Mon, 09 Jan 2023 09:20:18 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63bbdc52-86a"
x-cache: HIT
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 3135376
accept-ranges: bytes
content-length: 2154
x-storage: 3004124:8001

GET
H2 200 November-Ransomware-Simulation-Webinar-688x387-1-149x83.webp
586202317.r.cdnsun.net/wp-content/uploads/2022/12/ 3 KB
3 KB 144ms
141ms Image
image/webp 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/12/November-Ransomware-Simulation-Webinar-688x387-1-149x83.webp
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 828c25b87e1df68fee2f3fbb9d03982a877fb156245a5555646583216559e1f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Thu, 15 Dec 2022 08:20:53 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "639ad8e5-a5e"
x-cache: HIT
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 4927694
accept-ranges: bytes
content-length: 2654
x-storage: 3004124:8001

GET
H2 200 Screenshot-from-2022-11-14-11-11-25-1-149x83.png
586202317.r.cdnsun.net/wp-content/uploads/2022/11/ 9 KB
9 KB 149ms
146ms Image
image/png 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/11/Screenshot-from-2022-11-14-11-11-25-1-149x83.png
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 2d2a99b0b8750e8552dd63e014275fbd774e22cbe30bb6bb0dbff570eecab1aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 16 Nov 2022 14:16:22 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "6374f0b6-239b"
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 4267144
accept-ranges: bytes
content-length: 9115
x-storage: 3004124:8001

GET
H2 200 What-mkes-ransomware-different-149x83.jpg
586202317.r.cdnsun.net/wp-content/uploads/2022/09/ 4 KB
4 KB 151ms
149ms Image
image/jpeg 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/09/What-mkes-ransomware-different-149x83.jpg
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 7aa88f3ab4a5bd424ee9d4bd527f72b5dfe6d67f9f60c8653fec6271b835dd6c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Sun, 27 Nov 2022 10:12:37 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63833815-ec7"
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598425
accept-ranges: bytes
content-length: 3783
x-storage: 3004124:8001

GET
H2 200 Extending-Security-Services-for-MSPs-149x83.jpg
586202317.r.cdnsun.net/wp-content/uploads/2022/09/ 4 KB
4 KB 153ms
151ms Image
image/jpeg 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/09/Extending-Security-Services-for-MSPs-149x83.jpg
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 4b7fe27fba9c4d04f48014b8fce2bda8996a98e2705f7e7486b1ecbe5326b46c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Sun, 27 Nov 2022 10:12:37 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63833815-e90"
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598425
accept-ranges: bytes
content-length: 3728
x-storage: 3004124:8001

GET
H2 200 layers2.svg
586202317.r.cdnsun.net/wp-content/uploads/2022/06/ 1 KB
822 B 153ms
151ms Image
image/svg+xml 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/06/layers2.svg
Requested by: Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site.css?ver=6.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: d4bb794b6f4a942d580862682a2b38bd936af34aca7b9e251ffb862ed2f9dc40

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site.css?ver=6.0.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:39:38 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6c8a-5b4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598424
x-storage: 3004124:8001

GET
H2 200 baroncapital-featureimage-1-356x200.webp
586202317.r.cdnsun.net/wp-content/uploads/2023/01/ 7 KB
8 KB 158ms
156ms Image
image/webp 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2023/01/baroncapital-featureimage-1-356x200.webp
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: c11188885efc21828629246836601198cfade31f4d188b29e032b8c23efe0230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Mon, 09 Jan 2023 09:20:18 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63bbdc52-1dd0"
x-cache: HIT
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 3135376
accept-ranges: bytes
content-length: 7632
x-storage: 3004124:8001

GET
H2 200 November-Ransomware-Simulation-Webinar-688x387-1-356x200.webp
586202317.r.cdnsun.net/wp-content/uploads/2022/12/ 8 KB
8 KB 160ms
158ms Image
image/webp 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/12/November-Ransomware-Simulation-Webinar-688x387-1-356x200.webp
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: aecd8ddeef60ad753e993b2ef30e51dfbb611bc5092221fba5ed96bc88ac9efb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Thu, 15 Dec 2022 08:20:53 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "639ad8e5-1f10"
x-cache: HIT
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 4927694
accept-ranges: bytes
content-length: 7952
x-storage: 3004124:8001

GET
H2 200 Screenshot-from-2022-11-14-11-11-25-1-356x200.png
586202317.r.cdnsun.net/wp-content/uploads/2022/11/ 36 KB
36 KB 168ms
166ms Image
image/png 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/11/Screenshot-from-2022-11-14-11-11-25-1-356x200.png
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 4a5afb1264385e9d1162afc81dbe2cdb2b878a2f15379e18d1b3fdf01b362ae7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 16 Nov 2022 14:16:22 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "6374f0b6-8f85"
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 4267144
accept-ranges: bytes
content-length: 36741
x-storage: 3004124:8001

GET
H2 200 Group-7138.jpg
586202317.r.cdnsun.net/wp-content/uploads/2022/05/ 8 KB
8 KB 183ms
182ms Image
image/jpeg 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/05/Group-7138.jpg
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 8632a04df4ec1317069cced587c07b002ce3ef789a936e36fd325f3840dd8f34

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 04 Jan 2023 07:02:23 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63b5247f-1f2b"
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 3587288
accept-ranges: bytes
content-length: 7979
x-storage: 3004124:8001

GET
H2 200 dots3.svg
586202317.r.cdnsun.net/wp-content/uploads/2022/06/ 10 KB
888 B 179ms
178ms Image
image/svg+xml 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/06/dots3.svg
Requested by: Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site.css?ver=6.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: e0d5aea0bfb73c9e25d43b15a6edf70da339348da785231c3cb305776b98d0c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/site.css?ver=6.0.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:40:51 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6cd3-28a7"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598424
x-storage: 3004124:8001

GET
H2 200 footer.jpg
586202317.r.cdnsun.net/wp-content/uploads/2022/06/ 15 KB
15 KB 186ms
185ms Image
image/jpeg 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/06/footer.jpg
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 8e1db6e8030861d1e6f48d2442d883cde8823e6f9fb7cc31da05cc30a9e2c502

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 04 Jan 2023 07:01:32 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63b5244c-3b47"
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 3587288
accept-ranges: bytes
content-length: 15175
x-storage: 3004124:8001

GET
H2 200 fontello.woff
586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/ 4 KB
4 KB 234ms
91ms Font
application/font-woff 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/fontello.woff?87723384
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: b297e01b93876ce7cea52e65499304d5e23cd129d60b740c3a60d8901d26b06b

Request headers

Referer: https://minerva-labs.com/
Origin: https://minerva-labs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Thu, 04 Aug 2022 08:42:08 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "62eb8660-100c"
x-cache: HIT
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573965
accept-ranges: bytes
content-length: 4108
x-storage: 3004124:8001

GET
H2 200 plus-jakarta-sans-v2-latin-800.woff2
586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/ 10 KB
11 KB 253ms
110ms Font
application/font-woff2 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://586202317.r.cdnsun.net/wp-content/themes/minerva/css/fonts/plus-jakarta-sans-v2-latin-800.woff2
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: 83b0bc1b393f33f405a3c5b9452a32730637225f0e3831b7814d9bbe698c4d9f

Request headers

Referer: https://minerva-labs.com/
Origin: https://minerva-labs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 03 Aug 2022 12:39:50 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "62ea6c96-2928"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5573966
accept-ranges: bytes
content-length: 10536
x-storage: 3004124:8001

GET
H2 200 Minerva-labs-logo-white.svg
586202317.r.cdnsun.net/wp-content/uploads/2022/08/ 11 KB
6 KB 139ms
136ms Image
image/svg+xml 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/08/Minerva-labs-logo-white.svg
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: b21a185d1b81e14f7dfebdaf3ca1b7d67bb7936ca3a9c06ead25f4ec7445b236

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:40:21 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6cb5-2c50"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 Group-6741.svg
586202317.r.cdnsun.net/wp-content/uploads/2022/05/ 466 B
568 B 138ms
136ms Image
image/svg+xml 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2022/05/Group-6741.svg
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: d71e61ebf9f3e861f81ec181200d6cbde66a14942d508b2e019b4f956bf7e1b4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Wed, 03 Aug 2022 12:39:59 GMT
server: nginx
x-edge-location: Budapest, HU
etag: W/"62ea6c9f-1d2"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 5598426
x-storage: 3004124:8001

GET
H2 200 93bb2a2a4de79e71a8453800bc85ff74
secure.gravatar.com/avatar/ 1 KB
2 KB 84ms
21ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/93bb2a2a4de79e71a8453800bc85ff74?s=96&d=mm&r=g
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="93bb2a2a4de79e71a8453800bc85ff74.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/93bb2a2a4de79e71a8453800bc85ff74?s=96&d=mm&r=g>; rel="canonical"
content-length: 1528
expires: Tue, 14 Feb 2023 20:11:48 GMT

GET
H2 200 banner-1-optin.css
minerva-labs.com/wp-content/uploads/complianz/css/ 15 KB
3 KB 105ms
104ms Stylesheet
text/css 67.205.167.225
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://minerva-labs.com/wp-content/uploads/complianz/css/banner-1-optin.css?v=22
Requested by: Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=6.3.5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.167.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 753902.cloudwaysapps.com
Software: nginx /
Resource Hash: 403b5c0dd4679c9a7a7b497331648a738770d054eedf11d38afb1b039fc4cd1b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
last-modified: Tue, 13 Dec 2022 16:05:44 GMT
server: nginx
etag: W/"6398a2d8-3c86"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 schema Show response
minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2766/feedback/ 232 B
617 B 217ms
217ms Fetch
application/json 67.205.167.225
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2766/feedback/schema

Requested by

Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

67.205.167.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

753902.cloudwaysapps.com

Software

nginx /

Resource Hash

90c0e9d9581fc922ac72bcac3ba7062af9257cf7161471a06ef5d0b7212c3b13

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
allow: GET
vary: Origin,Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: no-cache, max-age=0
x-robots-tag: noindex
link: <https://minerva-labs.com/wp-json/>; rel="https://api.w.org/"
content-length: 168
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
expires: Tue, 14 Feb 2023 20:06:48 GMT

GET
H2 200 schema Show response
minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2835/feedback/ 232 B
617 B 245ms
244ms Fetch
application/json 67.205.167.225
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2835/feedback/schema

Requested by

Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

67.205.167.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

753902.cloudwaysapps.com

Software

nginx /

Resource Hash

90c0e9d9581fc922ac72bcac3ba7062af9257cf7161471a06ef5d0b7212c3b13

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
allow: GET
vary: Origin,Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: no-cache, max-age=0
x-robots-tag: noindex
link: <https://minerva-labs.com/wp-json/>; rel="https://api.w.org/"
content-length: 168
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
expires: Tue, 14 Feb 2023 20:06:48 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/645485640/ 2 KB
1 KB 152ms
61ms Script
text/javascript 2a00:1450:400d:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/645485640/?random=1676405208559&cv=11&fst=1676405208559&bg=ffffff&guid=ON&async=1&gtm=45He32d0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fminerva-labs.com%2Fblog%2Fbeepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware%2F&tiba=Beepin%27%20Out%20of%20the%20Sandbox%3A%20Analyzing%20a%20New%2C%20Extremely%20Evasive%20Malware&auid=1058734997.1676405209&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ4TZK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:808::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39328a0dd22743a442023c37c17b481f03ce9b002e08394d4d857b68ec1cbef9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 957
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 141ms
36ms Script
text/javascript 2a00:1450:400d:80c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ4TZK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 14 Feb 2023 19:12:06 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 3282
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Tue, 14 Feb 2023 21:12:06 GMT

GET
H2 200 amplitude-8.5.0-min.gz.js Show response
cdn.amplitude.com/libs/ 68 KB
22 KB 106ms
24ms Script
application/javascript 13.32.23.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-71.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

Referer: https://minerva-labs.com/
Origin: https://minerva-labs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 02:51:55 GMT
content-encoding: gzip
via: 1.1 08b9c2fd11813ffdb8fa03129d0a465c.cloudfront.net (CloudFront)
x-amz-version-id: NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
x-amz-cf-pop: FRA56-C2
age: 1876494
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 22154
last-modified: Fri, 13 Aug 2021 22:37:42 GMT
server: AmazonS3
etag: "660c3b546f2a131de50b69b91f26c636"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: oUFphZX-dK7Ix97_isWahKQjTAvQ6G1XgSwfhkM-CSK0GC-k5lZDvw==

GET
H2 200 diffuser.js Show response
diffuser-cdn.app-us1.com/diffuser/ 24 KB
6 KB 102ms
32ms Script
application/javascript 2606:4700::6811:925b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:925b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15eb202865d1d835fae2eff61bb922fa91fb4064a1fb850ebadab1f190782648

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
via: 1.1 753f415578c1ca010e51a83aef192330.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: FRA56-C2
age: 203
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 21 Oct 2021 17:42:06 GMT
server: cloudflare
etag: W/"4d482a43613d3966f353ec9d97452e0c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=300
cf-ray: 79986d2a185d2c1b-FRA
x-amz-cf-id: wszRWSB9zAFNWeKf3xy2pmbp3GPEFNS6yVXWGCh2UHKOpqGzrEG3qQ==

GET
H2 200 jtzQQ0sIQBy7PU3724A6 Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 242ms
187ms Script
text/javascript 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jtzQQ0sIQBy7PU3724A6

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

f34d6cac3a6c0e6d2123f734983c9c2d4e2d30440bfb67dc927ad464b5f38c64

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 79986d2a0dbd911e-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 widget_app_base_1676372168179.js Show response
cdn.userway.org/widgetapp/2023-02-14/ 130 KB
38 KB 58ms
58ms Script
application/javascript 2a02:6ea0:cb00::2
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2023-02-14/widget_app_base_1676372168179.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:cb00::2 , United Kingdom, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 8699d3fec2aeb61fe955906cf00acec8911893a64ceac5ded485f3cbba80b746

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

x-77-pop: viennaAT
date: Tue, 14 Feb 2023 20:06:48 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: VIE50-C2
age: 582
x-amz-server-side-encryption: AES256
x-cache: HIT
x-77-cache: HIT
x-age: 32156
x-77-nzt: Abm0DAaW8vP/nH0AAA
x-accel-expires: @1702293052
last-modified: Tue, 14 Feb 2023 10:59:30 GMT
server: CDN77-Turbo
etag: W/"59c063b0b91659bbcb179718b0c69259"
x-77-nzt-ray: fefc880d40f9a5d3d8e9eb63d0e0d32c
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
vary: Accept-Encoding
x-amz-cf-id: VFbherBMsv1B9b_65laX7o9sZh57qP1UM0zP7LCVWT7UK5BMFtQOgQ==

POST
H2 200 / Show response
api.amplitude.com/ 7 B
206 B 600ms
194ms XHR
text/html 34.210.48.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.210.48.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-210-48-242.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://minerva-labs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 14 Feb 2023 20:06:49 GMT
strict-transport-security: max-age=15768000
trace-id: Root=1-63ebe9d9-19f2a4db680532186eaefdb7
content-length: 7
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
209 B 56ms
56ms XHR
text/plain 2a00:1450:400d:80c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=136007610&t=pageview&_s=1&dl=https%3A%2F%2Fminerva-labs.com%2Fblog%2Fbeepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware%2F&ul=en-us&de=UTF-8&dt=Beepin%27%20Out%20of%20the%20Sandbox%3A%20Analyzing%20a%20New%2C%20Extremely%20Evasive%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=2097753779&gjid=782311863&cid=1973403627.1676405209&tid=UA-78700336-1&_gid=559070154.1676405209&_r=1&_slc=1&gtm=45He32d0n71WJ4TZK&z=627967464

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://minerva-labs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 14 Feb 2023 20:06:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://minerva-labs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/645485640/ 42 B
455 B 82ms
32ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/645485640/?random=1676405208559&cv=11&fst=1676404800000&bg=ffffff&guid=ON&async=1&gtm=45He32d0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fminerva-labs.com%2Fblog%2Fbeepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware%2F&tiba=Beepin%27%20Out%20of%20the%20Sandbox%3A%20Analyzing%20a%20New%2C%20Extremely%20Evasive%20Malware&fmt=3&is_vtc=1&random=2206748574&rmt_tld=0&ipr=y

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Feb 2023 20:06:48 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/645485640/ 42 B
455 B 83ms
33ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/645485640/?random=1676405208559&cv=11&fst=1676404800000&bg=ffffff&guid=ON&async=1&gtm=45He32d0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fminerva-labs.com%2Fblog%2Fbeepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware%2F&tiba=Beepin%27%20Out%20of%20the%20Sandbox%3A%20Analyzing%20a%20New%2C%20Extremely%20Evasive%20Malware&fmt=3&is_vtc=1&random=2206748574&rmt_tld=1&ipr=y

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Feb 2023 20:06:48 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
prism.app-us1.com/ 248 B
463 B 297ms
234ms Script
application/javascript 2606:4700::6811:915b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prism.app-us1.com/?a=612108196&u=https%3A%2F%2Fminerva-labs.com%2Fblog%2Fbeepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware%2F
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:915b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 1114fba2d6531f1e934f40ed32ba484eca8612c69fd28eef41f7e6b37adb7769

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:49 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/7.4.33
content-type: application/javascript
cache-control: no-cache, private
x-envoy-upstream-service-time: 110
cf-ray: 79986d2b5aad3609-FRA

GET
H2 200 f1-VT.png
586202317.r.cdnsun.net/wp-content/uploads/2023/02/ 82 KB
82 KB 82ms
81ms Image
image/png 185.94.190.147
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://586202317.r.cdnsun.net/wp-content/uploads/2023/02/f1-VT.png
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.94.190.147 Budapest, Hungary, ASN9009 (M247, RO),
Reverse DNS: adglpg147.smuniz.pw
Software: nginx /
Resource Hash: ae8d5d1ac38e97860c3509bc71ad690409699fd989c1ae2992eaf488f81536c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:48 GMT
last-modified: Mon, 13 Feb 2023 15:00:23 GMT
server: nginx
x-edge-location: Budapest, HU
etag: "63ea5087-1475e"
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-edge-ip: 185.94.190.147
x-age: 46513
accept-ranges: bytes
content-length: 83806
x-storage: 3004124:8001

POST
H2 200 VyjhXhC44a Show response
api.userway.org/api/tunings/ 985 B
1 KB 871ms
184ms XHR
application/json 44.241.155.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.userway.org/api/tunings/VyjhXhC44a
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.241.155.87 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-241-155-87.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 95f218bad933add25817b6635aed65272ee67b24d9ba2cb72829bd25cf1d379d

Request headers

Referer: https://minerva-labs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 14 Feb 2023 20:06:49 GMT
etag: W/"3d9-TwY9PwVPuk0eVmP0s8BEVangS/Y"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-service-request-id: usre2789c4063d84f8
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-allow-headers: *
content-length: 985
x-service-version: uw-pr

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
349 B 93ms
36ms XHR
text/plain 2a00:1450:4025:401::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-78700336-1&cid=1973403627.1676405209&jid=2097753779&gjid=782311863&_gid=559070154.1676405209&_u=YEBAAEAAAAAAACAAI~&z=1419908877

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4025:401::9a Den Helder, Netherlands, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://minerva-labs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 14 Feb 2023 20:06:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://minerva-labs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 45ms
44ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-78700336-1&cid=1973403627.1676405209&jid=2097753779&_u=YEBAAEAAAAAAACAAI~&z=415443397

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Feb 2023 20:06:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 47ms
47ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-78700336-1&cid=1973403627.1676405209&jid=2097753779&_u=YEBAAEAAAAAAACAAI~&z=415443397

Requested by

Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Feb 2023 20:06:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 t_prism_sitemessages.php Show response
trackcmp.net/ 0
315 B 484ms
426ms Script
text/javascript 2606:4700:4400::ac40:9197
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trackcmp.net/t_prism_sitemessages.php?trackid=612108196&prismid=7240a3bd-4768-4dfd-8fd9-420e0c615006&url=https%3A%2F%2Fminerva-labs.com%2Fblog%2Fbeepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware%2F
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9197 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.1.15
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:49 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/8.1.15
p3p: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
content-type: text/javascript;charset=UTF-8
cache-control: no-cache, private
x-envoy-upstream-service-time: 46
x-privacy-policy: You can find our privacy policy here: https://www.activecampaign.com/help/privacy-policy/
cf-ray: 79986d2d381b6901-FRA
content-length: 0

GET
H2 200 refill Show response
minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2766/ 2 B
452 B 212ms
211ms Fetch
application/json 67.205.167.225
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2766/refill

Requested by

Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

67.205.167.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

753902.cloudwaysapps.com

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
allow: GET
vary: Origin,Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=0
x-robots-tag: noindex
link: <https://minerva-labs.com/wp-json/>; rel="https://api.w.org/"
content-length: 22
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
expires: Tue, 14 Feb 2023 20:06:49 GMT

GET
H2 200 refill Show response
minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2835/ 2 B
452 B 214ms
214ms Fetch
application/json 67.205.167.225
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://minerva-labs.com/wp-json/contact-form-7/v1/contact-forms/2835/refill

Requested by

Host: 586202317.r.cdnsun.net
URL: https://586202317.r.cdnsun.net/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

67.205.167.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

753902.cloudwaysapps.com

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date: Tue, 14 Feb 2023 20:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
allow: GET
vary: Origin,Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=0
x-robots-tag: noindex
link: <https://minerva-labs.com/wp-json/>; rel="https://api.w.org/"
content-length: 22
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
expires: Tue, 14 Feb 2023 20:06:49 GMT

GET
H2 200 en-US.json Show response
cdn.userway.org/widgetapp/2023-02-14/locales/ 433 B
856 B 122ms
40ms XHR
application/json 2a02:6ea0:cb00::2
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2023-02-14/locales/en-US.json
Requested by: Host: minerva-labs.com
URL: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:cb00::2 , United Kingdom, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 695918800576ee63a085fc0121165a8725777162e76eec8740e67355358f6e89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

x-77-pop: viennaAT
date: Tue, 14 Feb 2023 20:06:49 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: VIE50-C2
age: 586
x-amz-server-side-encryption: AES256
x-cache: HIT
x-77-cache: HIT
x-age: 32150
x-77-nzt: Abm0DAYHptj/ln0AAA
x-accel-expires: @1702293059
last-modified: Tue, 14 Feb 2023 10:59:30 GMT
server: CDN77-Turbo
etag: W/"0c4b53012957584c54e80867ff489590"
x-77-nzt-ray: fefc880d1a176be3d9e9eb6366fd5630
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
x-amz-cf-id: m9f3W-hqgAX2y-wVih08w-Ac4xE4Bf4JkTKjwWcgnbRtPUSSQ8bCRw==

GET
H2 200 body_wh.svg
cdn.userway.org/widgetapp/images/ 931 B
1 KB 42ms
41ms Image
image/svg+xml 2a02:6ea0:cb00::2
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/body_wh.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:cb00::2 , United Kingdom, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 986a5e9be63017ce84536f6792ea984e6251a15af61d5cc20ff4f8b1737c80ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

x-77-pop: viennaAT
date: Tue, 14 Feb 2023 20:06:50 GMT
via: 1.1 4fcd504c9be280bceae32e94ae54e04e.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: VIE50-C2
age: 68
x-cache: HIT
x-77-cache: HIT
x-age: 2795902
x-77-nzt: Abm0DAbXr+r/fqkqAA
x-accel-expires: @1699529308
last-modified: Fri, 13 Jan 2023 11:00:14 GMT
server: CDN77-Turbo
etag: W/"2ec2767a3bb93656fb9b75c893d7be75"
x-77-nzt-ray: fefc880d40f9a5d3dae9eb63aac9410f
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
x-amz-cf-id: KQg2VpgomOGgq6QGJfuKjSdyaawXNJ_txVdWGazZ4Xlu_aImDsdokg==

GET
H2 200 spin_wh.svg
cdn.userway.org/widgetapp/images/ 2 KB
1 KB 43ms
42ms Image
image/svg+xml 2a02:6ea0:cb00::2
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/spin_wh.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:cb00::2 , United Kingdom, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: c45f637f905e1ea01ba81aa39e8da62ee7e7f8703c3da4c3bba55f6192e5834c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://minerva-labs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

x-77-pop: viennaAT
date: Tue, 14 Feb 2023 20:06:50 GMT
via: 1.1 19cd9c9f4eb51e9e5c75add1d4b6f304.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: VIE50-C2
age: 68
x-cache: HIT
x-77-cache: HIT
x-age: 2795902
x-77-nzt: Abm0DAY011f/fqkqAA
x-accel-expires: @1699529308
last-modified: Fri, 13 Jan 2023 11:00:14 GMT
server: CDN77-Turbo
etag: W/"8e0a35946bf39d10f46a1f1653366a0a"
x-77-nzt-ray: fefc880d40f9a5d3dae9eb63b965480f
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
vary: Accept-Encoding
x-amz-cf-id: axT43vFqdGcGJXednCEI6yCC18pH5P4wnC-qukQxu9WJ04XZNFYA3A==

Verdicts & Comments Add Verdict or Comment

128 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.minerva-labs.com/	1970-01-20 11:49:41	Name: _gcl_au Value: 1.1.1058734997.1676405209
.doubleclick.net/	1970-01-20 09:40:06	Name: test_cookie Value: CheckForPermission
.minerva-labs.com/	1970-01-20 18:25:41	Name: amp_26b8f3 Value: IPURwkRElnM3KXINWfBdZz...1gp8oitlp.1gp8oitlr.1.0.1
.minerva-labs.com/	1970-01-20 19:16:05	Name: _ga Value: GA1.2.1973403627.1676405209
.minerva-labs.com/	1970-01-20 09:41:31	Name: _gid Value: GA1.2.559070154.1676405209
.minerva-labs.com/	1970-01-20 09:40:05	Name: _gat_UA-78700336-1 Value: 1
.ws.zoominfo.com/	1970-01-20 18:25:41	Name: visitorId Value: 8b8b922e3560d642cb1af83ff89f9f5071c5499e388a7264d2f4eefd707b36df
.zoominfo.com/	1970-01-20 09:40:07	Name: __cf_bm Value: corpQmld6eub.lAViFrF7oT2D6yP1BUX1R3fY6yUZew-1676405208-0-AeD8LkplCdmzaKHgWryX3dioldOytIJ4kkvVg8cNCi8cgdGj0awIepWv34V/2WMV7xwDgXPKoMTHrHMU79PY4Qg=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: HpFx9r1LFGdmQwj6zvksylidbwWgOUPtoyQWEEJUwzM-1676405208807-0-604800000
prism.app-us1.com/	1970-01-20 10:23:17	Name: prism_612108196 Value: 7240a3bd-4768-4dfd-8fd9-420e0c615006
.minerva-labs.com/	1970-01-20 10:23:17	Name: prism_612108196 Value: 7240a3bd-4768-4dfd-8fd9-420e0c615006

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

586202317.r.cdnsun.net
api.amplitude.com
api.userway.org
cdn.amplitude.com
cdn.userway.org
cdnjs.cloudflare.com
diffuser-cdn.app-us1.com
googleads.g.doubleclick.net
minerva-labs.com
prism.app-us1.com
secure.gravatar.com
stats.g.doubleclick.net
trackcmp.net
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
13.32.23.71
185.94.190.147
2606:4700:4400::ac40:9197
2606:4700::6810:a852
2606:4700::6811:190e
2606:4700::6811:915b
2606:4700::6811:925b
2a00:1450:4001:80f::2008
2a00:1450:4001:810::2004
2a00:1450:4001:827::2003
2a00:1450:400d:808::2002
2a00:1450:400d:80c::200e
2a00:1450:4025:401::9a
2a02:6ea0:cb00::2
2a04:fa87:fffe::c000:4902
34.210.48.242
44.241.155.87
67.205.167.225
1114fba2d6531f1e934f40ed32ba484eca8612c69fd28eef41f7e6b37adb7769
11568d9e1e534bc0832025072adf5e454ebf4d54e6db15c3489c4784b703b9b6
15eb202865d1d835fae2eff61bb922fa91fb4064a1fb850ebadab1f190782648
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
29e8de26576208c07ba0845f604e65c9273b93f9f4d1d66214eb4c586f9938c4
2d2a99b0b8750e8552dd63e014275fbd774e22cbe30bb6bb0dbff570eecab1aa
39328a0dd22743a442023c37c17b481f03ce9b002e08394d4d857b68ec1cbef9
3abb2e59349a3cd1748f36a0e00771d600b22fb1ee8e2a3086dba9d359786217
403b5c0dd4679c9a7a7b497331648a738770d054eedf11d38afb1b039fc4cd1b
4a5afb1264385e9d1162afc81dbe2cdb2b878a2f15379e18d1b3fdf01b362ae7
4b7fe27fba9c4d04f48014b8fce2bda8996a98e2705f7e7486b1ecbe5326b46c
4d5c848c1426167c78f19dfe0712f224efd0e641799819b6f5d7b7c40c72bf5c
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f9327d88bbc6affd14e962e6001950a706d7a9e7105f141c790aa845f5cc101
55bd442d45ef481e3f0eb795894dd94f1a5e38f2a4847c2f49371010e1e013c2
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a382fb66bab8aad4ff931715bdb7d74f7049da881fa7d61282c2163c6521880
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5edb65e763e5713dbbb787dea6ead0e9716e4490fc7dddcfce4cfa588e7322a4
667cf079e0c4ea0eac896d368aacf29aa7b4a53f1a1685e14748840ed70a67b0
67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7
695918800576ee63a085fc0121165a8725777162e76eec8740e67355358f6e89
6f77f72e501eb5686f2d1352bd5bddb84635a5484e84d981016d60c20816c10a
7aa88f3ab4a5bd424ee9d4bd527f72b5dfe6d67f9f60c8653fec6271b835dd6c
7bb348d8535f98bb86d86734f61c6260afbbc82026e0ab49de6e7e14ad0301d9
828c25b87e1df68fee2f3fbb9d03982a877fb156245a5555646583216559e1f6
83b0bc1b393f33f405a3c5b9452a32730637225f0e3831b7814d9bbe698c4d9f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8632a04df4ec1317069cced587c07b002ce3ef789a936e36fd325f3840dd8f34
8699d3fec2aeb61fe955906cf00acec8911893a64ceac5ded485f3cbba80b746
8e1db6e8030861d1e6f48d2442d883cde8823e6f9fb7cc31da05cc30a9e2c502
8eeacc8e6a49f1e75130b6f5e6f5c26bfd87b8eb9228e7412fb182894da4e8c7
90c0e9d9581fc922ac72bcac3ba7062af9257cf7161471a06ef5d0b7212c3b13
95f218bad933add25817b6635aed65272ee67b24d9ba2cb72829bd25cf1d379d
985fdd42398281348ca133a44750a56fe4909a806b9c075c9443a5d0bd6d2e51
986a5e9be63017ce84536f6792ea984e6251a15af61d5cc20ff4f8b1737c80ad
9a19938485ca7f6c582d3f78d17d9e443d26b260cac24c9dd9499f70b5d28390
a3ddfd67a9a445b14261ba2d72e58584be48af882792d27abaf159f96d0045d3
a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d
aa08607bf345854d6f1947653166c745a55caca237c2900cf6502248b258dda5
ae53371d0523e6bf7b50eea545dd42865f39fce2ef4c8d7766941212e8045b9e
ae8d5d1ac38e97860c3509bc71ad690409699fd989c1ae2992eaf488f81536c0
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aecd8ddeef60ad753e993b2ef30e51dfbb611bc5092221fba5ed96bc88ac9efb
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b1932b90bf81755c4d47f2f65671488c5263891f04ec3096fb483e33d9e23e95
b21a185d1b81e14f7dfebdaf3ca1b7d67bb7936ca3a9c06ead25f4ec7445b236
b297e01b93876ce7cea52e65499304d5e23cd129d60b740c3a60d8901d26b06b
b3309b42777eae75311a8fbeffcd7f3eae2fc042d0992ccdbcb62bfb5b3a6451
b624e1e378abe009ef0de69a698b0a3e734af47efcdbd6816d5fcb8fc64c8bfe
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c11188885efc21828629246836601198cfade31f4d188b29e032b8c23efe0230
c45f637f905e1ea01ba81aa39e8da62ee7e7f8703c3da4c3bba55f6192e5834c
d106f3a248ddb3ef5d2287fdfcaa7d404a55f75ca05132be1fc9eb5aebc28bdb
d4bb794b6f4a942d580862682a2b38bd936af34aca7b9e251ffb862ed2f9dc40
d519e904f38d7cf39624a5d9277264b13151dce88586aa8c10763fd29235c220
d71e61ebf9f3e861f81ec181200d6cbde66a14942d508b2e019b4f956bf7e1b4
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
deeb6f39525157ea35bd78f27177c7d5f62e42b20a48b96788c063a150dbe932
e0d5aea0bfb73c9e25d43b15a6edf70da339348da785231c3cb305776b98d0c8
e13d3a18aa784b8c80d6f2e2416b289eed0b3cadbd2db46562045bab4c45126c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f34d6cac3a6c0e6d2123f734983c9c2d4e2d30440bfb67dc927ad464b5f38c64
f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce
ff11e55bfe10389758e1bf9193b8b72df0fcfffc93d285b84ec620313d5c253f

minerva-labs.com Open in urlscan Pro 67.205.167.225 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

72 Requests

100 %HTTPS

72 %IPv6

14 Domains

18 Subdomains

19 IPs

6 Countries

719 kBTransfer

1657 kBSize

11 Cookies

14 Outgoing links

Redirected requests

72 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

minerva-labs.com Open in urlscan Pro
67.205.167.225 Public Scan

Screenshot
Live screenshot

Full Image

72
Requests

100 %
HTTPS

72 %
IPv6

14
Domains

18
Subdomains

19
IPs

6
Countries

719 kB
Transfer

1657 kB
Size

11
Cookies

72 HTTP transactions
1 data transactions