Submitted URL: https://s1.ai/bb-fin7
Effective URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Submission: On November 06 via api from CA — Scanned from CA

Summary

This website contacted 42 IPs in 3 countries across 31 domains to perform 102 HTTP transactions. The main IP is 104.26.3.18, located in and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 186213.
TLS certificate: Issued by E5 on October 30th 2024. Valid for: 3 months.
This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 52.72.49.79 14618 (AMAZON-AES)
3 27 104.26.3.18 13335 (CLOUDFLAR...)
3 34.49.80.229 396982 (GOOGLE-CL...)
1 2607:f8b0:400... 15169 (GOOGLE)
7 104.17.71.206 13335 (CLOUDFLAR...)
4 2607:f8b0:400... 15169 (GOOGLE)
3 104.17.111.223 13335 (CLOUDFLAR...)
2 2607:f8b0:400... 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
1 142.251.167.94 15169 (GOOGLE)
10 2606:4700::68... 13335 (CLOUDFLAR...)
1 142.251.179.104 15169 (GOOGLE)
2 23.13.172.203 16625 (AKAMAI-AS)
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2600:1408:c40... 20940 (AKAMAI-ASN1)
1 18.160.10.55 16509 (AMAZON-02)
2 2620:1ec:29:1... 8075 (MICROSOFT...)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 2 68.67.179.87 29990 (ASN-APPNEX)
1 2600:9000:27c... 16509 (AMAZON-02)
1 52.44.251.75 14618 (AMAZON-AES)
3 104.16.160.145 13335 (CLOUDFLAR...)
1 2 142.251.163.149 15169 (GOOGLE)
1 172.253.63.148 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 34.96.71.22 396982 (GOOGLE-CL...)
2 2 35.244.154.8 396982 (GOOGLE-CL...)
1 99.84.191.47 16509 (AMAZON-02)
1 13.249.39.126 16509 (AMAZON-02)
1 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 172.67.213.149 13335 (CLOUDFLAR...)
1 192.28.144.124 15224 (OMNITURE)
1 2600:9000:200... 16509 (AMAZON-02)
2 4.153.129.168 8075 (MICROSOFT...)
1 34.246.141.114 16509 (AMAZON-02)
1 2602:816:5001... 54113 (FASTLY)
3 172.64.150.44 13335 (CLOUDFLAR...)
1 2 20.110.205.119 8075 (MICROSOFT...)
1 1 2620:1ec:c11:... 8068 (MICROSOFT...)
1 162.247.243.29 54113 (FASTLY)
4 104.16.118.43 13335 (CLOUDFLAR...)
1 104.16.117.43 13335 (CLOUDFLAR...)
102 42
Apex Domain
Subdomains
Transfer
34 sentinelone.com
www.sentinelone.com — Cisco Umbrella Rank: 186213
go.sentinelone.com — Cisco Umbrella Rank: 315182
820 KB
10 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 326
192 KB
6 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 634
b.clarity.ms — Cisco Umbrella Rank: 15923
c.clarity.ms — Cisco Umbrella Rank: 1236
29 KB
6 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 136
td.doubleclick.net — Cisco Umbrella Rank: 192
13115870.fls.doubleclick.net — Cisco Umbrella Rank: 706357
ad.doubleclick.net — Cisco Umbrella Rank: 150
1 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 5396
onesignal.com — Cisco Umbrella Rank: 1637
img.onesignal.com — Cisco Umbrella Rank: 9324
90 KB
5 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 4482
ws-assets.zoominfo.com — Cisco Umbrella Rank: 11155
17 KB
5 knock-ai.com
js.knock-ai.com — Cisco Umbrella Rank: 395209
ca.knock-ai.com — Cisco Umbrella Rank: 416223
10 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 321
px4.ads.linkedin.com — Cisco Umbrella Rank: 6828
3 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
333 KB
3 zi-scripts.com
js.zi-scripts.com — Cisco Umbrella Rank: 5671
4 KB
3 company-target.com
s.company-target.com — Cisco Umbrella Rank: 1520
segments.company-target.com — Cisco Umbrella Rank: 1534
api.company-target.com — Cisco Umbrella Rank: 4087
1 KB
3 calibermind.com
cdn.calibermind.com — Cisco Umbrella Rank: 58783
e.calibermind.com — Cisco Umbrella Rank: 57571
63 KB
2 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 812
774 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 479
2 KB
2 demandbase.com
tag.demandbase.com — Cisco Umbrella Rank: 5931
tag-logger.demandbase.com — Cisco Umbrella Rank: 5266
18 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3657
6 KB
2 google.com
analytics.google.com — Cisco Umbrella Rank: 147
www.google.com — Cisco Umbrella Rank: 3
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 77
12 KB
1 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 245
634 B
1 bing.com
c.bing.com — Cisco Umbrella Rank: 190
773 B
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 592
17 KB
1 tvsquared.com
collector-5527.tvsquared.com — Cisco Umbrella Rank: 771792
190 B
1 mktoresp.com
327-mnm-087.mktoresp.com — Cisco Umbrella Rank: 689213
318 B
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 498
295 B
1 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2579
928 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 18180
281 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 16506
284 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 784
14 KB
1 google.ca
www.google.ca — Cisco Umbrella Rank: 12143
63 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 412
30 KB
1 s1.ai
s1.ai
280 B
102 31
Domain Requested by
27 www.sentinelone.com 3 redirects www.sentinelone.com
10 cdn.cookielaw.org www.googletagmanager.com
cdn.cookielaw.org
www.sentinelone.com
7 go.sentinelone.com www.sentinelone.com
go.sentinelone.com
4 ws.zoominfo.com js.zi-scripts.com
ws-assets.zoominfo.com
4 www.googletagmanager.com www.sentinelone.com
www.googletagmanager.com
3 js.zi-scripts.com www.sentinelone.com
js.zi-scripts.com
3 px.ads.linkedin.com 1 redirects snap.licdn.com
3 onesignal.com cdn.onesignal.com
3 js.knock-ai.com www.sentinelone.com
js.knock-ai.com
2 c.clarity.ms 1 redirects
2 b.clarity.ms www.clarity.ms
2 id.rlcdn.com 2 redirects
2 13115870.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 secure.adnxs.com 2 redirects
2 www.clarity.ms www.sentinelone.com
www.clarity.ms
2 cdn.calibermind.com www.sentinelone.com
www.googletagmanager.com
2 munchkin.marketo.net www.sentinelone.com
munchkin.marketo.net
2 td.doubleclick.net www.googletagmanager.com
2 www.youtube.com www.sentinelone.com
www.youtube.com
2 ca.knock-ai.com js.knock-ai.com
2 cdn.onesignal.com www.sentinelone.com
cdn.onesignal.com
1 ws-assets.zoominfo.com js.zi-scripts.com
1 bam.nr-data.net js-agent.newrelic.com
1 c.bing.com 1 redirects
1 js-agent.newrelic.com www.sentinelone.com
1 img.onesignal.com www.sentinelone.com
1 collector-5527.tvsquared.com www.sentinelone.com
1 tag-logger.demandbase.com tag.demandbase.com
1 327-mnm-087.mktoresp.com munchkin.marketo.net
1 e.calibermind.com cdn.calibermind.com
1 px4.ads.linkedin.com www.sentinelone.com
1 api.company-target.com tag.demandbase.com
1 segments.company-target.com www.sentinelone.com
1 s.company-target.com tag.demandbase.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 ad.doubleclick.net www.sentinelone.com
1 tags.srv.stackadapt.com www.sentinelone.com
1 attr.ml-api.io www.sentinelone.com
1 s.ml-attr.com 1 redirects
1 tag.demandbase.com www.sentinelone.com
1 snap.licdn.com www.sentinelone.com
1 www.google.com www.googletagmanager.com
1 www.google.ca www.sentinelone.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 analytics.google.com www.googletagmanager.com
1 ajax.googleapis.com www.sentinelone.com
1 s1.ai 1 redirects
102 47
Subject Issuer Validity Valid
sentinelone.com
E5
2024-10-30 -
2025-01-28
3 months crt.sh
js.knock-ai.com
WR3
2024-11-03 -
2025-02-01
3 months crt.sh
upload.video.google.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
go.sentinelone.com
E6
2024-09-15 -
2024-12-14
3 months crt.sh
*.google-analytics.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
*.onesignal.com
WE1
2024-10-31 -
2025-01-29
3 months crt.sh
ca.knock-ai.com
WR3
2024-09-14 -
2024-12-13
3 months crt.sh
*.google.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
*.g.doubleclick.net
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
*.doubleclick.net
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
*.google.ca
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
cookielaw.org
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2024-10-22 -
2025-10-24
a year crt.sh
calibermind.com
WE1
2024-10-10 -
2025-01-08
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2
2024-08-27 -
2025-09-28
a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2024-09-04 -
2025-09-04
a year crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M03
2024-08-09 -
2025-09-06
a year crt.sh
onesignal.com
WE1
2024-10-31 -
2025-01-29
3 months crt.sh
geolocation.onetrust.com
WE1
2024-10-11 -
2025-01-09
3 months crt.sh
*.company-target.com
R10
2024-10-14 -
2025-01-12
3 months crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2
2024-08-13 -
2025-09-14
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-10-14 -
2025-04-14
6 months crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-08-15 -
2025-09-15
a year crt.sh
*.demandbase.com
Amazon RSA 2048 M02
2024-06-10 -
2025-07-08
a year crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08
2024-06-23 -
2025-06-18
a year crt.sh
*.tvsquared.com
Amazon RSA 2048 M03
2024-06-01 -
2025-06-30
a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1
2024-03-21 -
2025-04-22
a year crt.sh
zi-scripts.com
WE1
2024-09-22 -
2024-12-21
3 months crt.sh
*.nr-data.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-12 -
2025-08-12
a year crt.sh
zoominfo.com
E5
2024-10-12 -
2025-01-10
3 months crt.sh

This page contains 7 frames:

Primary Page: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Frame ID: 361BAFCCCA6DDB21AB6704890D8BA0AA
Requests: 96 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-KJPGLC9EVP&gacid=859586636.1730931567&gtm=45je4au0v889850326za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101925629&z=500027914
Frame ID: C58746911D6A4486407F784C9A85C9F4
Requests: 1 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: FFE159AB57EE950118B9BA41184783F9
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.sentinelone.com
Frame ID: 6AC1C557F668D653B9CE53F139C2EFFE
Requests: 1 HTTP requests in this frame

Frame: https://13115870.fls.doubleclick.net/activityi;dc_pre=CJHd4sneyIkDFV6lWgUdmjY9mg;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F
Frame ID: FF7562CD96A66D094E2149BA3AA58309
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F
Frame ID: 76D6889BA53A7C93E9A647AAC9CED200
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: 96B590C3D05A8B782B8721640F34A075
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor - SentinelOne

Page URL History Show full URLs

  1. https://s1.ai/bb-fin7 HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-... HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

102
Requests

93 %
HTTPS

37 %
IPv6

31
Domains

47
Subdomains

42
IPs

3
Countries

1651 kB
Transfer

4467 kB
Size

54
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s1.ai/bb-fin7 HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor HTTP 301
    https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg; HTTP 301
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Request Chain 32
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg; HTTP 301
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Request Chain 57
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.sentinelone.com&pId=4188232049878062920
Request Chain 63
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F HTTP 302
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CJHd4sneyIkDFV6lWgUdmjY9mg;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F
Request Chain 69
  • https://id.rlcdn.com/464526.gif HTTP 307
  • https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCO_Wr7kGEgUI6AcQAEIASgA HTTP 307
  • https://segments.company-target.com/log?vendor=liveramp&user_id=Xc12979SXm8M0aKYWX9hgK4e2zMHAHCjnhwxHhuVqCI_NipRI
Request Chain 72
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5427652%2C5500618&time=1730931567626&li_adsId=920d45bb-b5c0-4d52-b656-a35f17f55eb1&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5427652%2C5500618&time=1730931567626&li_adsId=920d45bb-b5c0-4d52-b656-a35f17f55eb1&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&e_ipv6=AQKdsG7mN_Gh5AAAAZMDj6y5PBypJnZAWB1ZwicQYHVsvlLUomrcXc_iTDgI1u2Z_Vxqv-P82g
Request Chain 94
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=33D3E73234144A37BCC81704E8DB5AD4&RedC=c.clarity.ms&MXFR=1D0584C2446A634B273491ED406A6DCE HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=33D3E73234144A37BCC81704E8DB5AD4&MUID=31144A33CC846DD730475F1CCD526C11

102 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Redirect Chain
  • https://s1.ai/bb-fin7
  • https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor
  • https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
320 KB
105 KB
Document
General
Full URL
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0e0b123a376224e1c89fdcfa3e52fef35ea4aeb81aa9242259d96cda0fc5357
Security Headers
Name Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/ https://pagead2.googlesyndication.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control
max-age=60
cf-cache-status
EXPIRED
cf-ray
8de87713afab5401-YYZ
content-encoding
br
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/ https://pagead2.googlesyndication.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
content-type
text/html; charset=UTF-8
date
Wed, 06 Nov 2024 22:19:26 GMT
last-modified
Wed, 06 Nov 2024 22:19:26 GMT
link
<https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/labs/72977>; rel="alternate"; title="JSON"; type="application/json", <https://www.sentinelone.com/?p=72977>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1N5Zl%2Ffj4s0QqkjVKdGoaiAb6EDeJSq6hsus%2Bw9dBTJToDB4XlvSElg3DtoyzI%2BCxwzT7PY7%2F66NPOge8xYA%2B5tJGmO0oAESB9IGmdecPE0%2B577YR%2BgVaH8Uk0JbFq67p%2F6v3gc%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=22163&sent=13&recv=18&lost=0&retrans=0&sent_bytes=8345&recv_bytes=2571&delivery_rate=354159&cwnd=255&unsent_bytes=0&cid=80e19d55626cbabb&ts=352&x=0"
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding, Cookie, Cookie
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
HIT, HIT, MISS, MISS
x-cache-hits
9, 0, 0, 0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-jkrtv
x-served-by
cache-chi-kigq8000103-CHI, cache-yyz4542-YYZ, cache-yyz4570-YYZ, cache-yyz4570-YYZ
x-styx-req-id
c88f3410-9ba3-11ef-bd00-9232e87249ea
x-timer
S1730931567.686620,VS0,VE9
x-xss-protection
1; mode=block

Redirect headers

cache-control
max-age=60
cf-cache-status
EXPIRED
cf-ray
8de87711ede55401-YYZ
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/ https://pagead2.googlesyndication.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
content-type
text/html; charset=UTF-8
date
Wed, 06 Nov 2024 22:19:26 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
location
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sKSDyQ89wkYWYW%2BTsEv7W33YsGsoHW27lkW9ymqV83g2zt2EDG4yRYKM3UnMo3AbsOg6rez5k5bUnZL7XuE4Sajx2hIaod1Uxu5CzehzmMOQhwSTLg8RkURuDdXy7RiOeT%2Flb3g%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=22119&sent=7&recv=11&lost=0&retrans=0&sent_bytes=4183&recv_bytes=2454&delivery_rate=179926&cwnd=251&unsent_bytes=0&cid=80e19d55626cbabb&ts=291&x=0"
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Cookie, Cookie, Accept-Encoding
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
MISS, MISS, MISS, MISS
x-cache-hits
0, 0, 0, 0
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com, app.scalyr.com, app.eu.scalyr.com, localhost, https://bam.nr-data.net/, https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/, epsilon-globalaccelerator.6sense.com/, cdn.abrankings.com/, https://na-ab14.marketodesigner.com/
x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-4wffj
x-redirect-by
WordPress
x-served-by
cache-chi-klot8100163-CHI, cache-yyz4544-YYZ, cache-yyz4580-YYZ, cache-yyz4580-YYZ
x-styx-req-id
2efc16bd-9c8d-11ef-943b-f2b03c6e3d3f
x-timer
S1730931566.412247,VS0,VE224
x-xss-protection
1; mode=block
97ee7348-9176-4a4b-9af2-40711264546b.js
js.knock-ai.com/
33 KB
9 KB
Script
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
6b1d18a296f4611913546e212081fc56b9f159e3c32cab3be4d61c986e25b742

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Type
content-encoding
gzip
x-goog-hash
crc32c=zHJZaA==, md5=1M4/U8M0nBVt855MnCrUzQ==
etag
"d4ce3f53c3349c156df39e4c9c2ad4cd"
age
482
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
9018
date
Wed, 06 Nov 2024 22:11:24 GMT
last-modified
Tue, 05 Nov 2024 10:08:08 GMT
content-type
application/javascript
vary
Accept-Encoding
x-guploader-uploadid
AHmUCY3xf99AcqE3Sil3pkgtP1O3nYV2mOdo1dm9ohDB9B9JrRss7DsvpUei5E_r_1kFbwzwSo8
access-control-allow-headers
*
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1730801288340815
content-length
9018
server
UploadServer
style-labs.min.css
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/
269 KB
43 KB
Stylesheet
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70d8757cbcd44c70eba77893311cae6e68e09ae1ed511f92de25eab17de837e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-jkrtv
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-435a7"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=beiZYqxhcQWftnbAyyDTptlca8unFIFas7keqf6ike5ScpULJlGAWykdbXwIoPxYCq%2FJ6I7aGU1UIzyX%2BC08Pc00IpM9VBKuCORGwCixxV3p97pGy%2BYtbIolLOueQRLTiKgNMKg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:05:15 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22267&sent=145&recv=120&lost=0&retrans=0&sent_bytes=118056&recv_bytes=3281&delivery_rate=5444838&cwnd=310&unsent_bytes=0&cid=80e19d55626cbabb&ts=437&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:26 GMT
content-type
text/css
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-kigq8000122-CHI, cache-yyz4542-YYZ, cache-yyz4547-YYZ, cache-yyz4547-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.774923,VS0,VE8
x-styx-req-id
82343a9e-9ba0-11ef-bd00-9232e87249ea
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771438245401-YYZ
accept-ranges
bytes
content-length
43649
server
cloudflare
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.0/
85 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.7.0/jquery.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
age
377697
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Sun, 02 Nov 2025 13:24:29 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 02 Nov 2024 13:24:29 GMT
last-modified
Wed, 17 May 2023 18:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30433
x-xss-protection
0
server
sffe
forms2.min.js
go.sentinelone.com/js/forms2/js/
199 KB
67 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f144e3bc13095ce7d1b638b1b2cc50b52cd12312cba1323706f6e71e8ded1e2c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"1521a79-31b91-625a9127dc9e3"
age
4380
x-content-type-options
nosniff
cf-ray
8de877152e2aaaeb-YYZ
expires
Thu, 07 Nov 2024 02:19:26 GMT
date
Wed, 06 Nov 2024 22:19:26 GMT
content-type
application/x-javascript
last-modified
Wed, 30 Oct 2024 03:12:30 GMT
vary
Accept-Encoding
server
cloudflare
js
www.googletagmanager.com/gtag/
403 KB
129 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f4dad8bf6c29fb933217ee639b0d17fb9434ac6616f18ecb69b830e6c72c511c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Wed, 06 Nov 2024 22:19:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
131279
x-xss-protection
0
server
Google Tag Manager
BlackBasta_FIN7_4.jpg
www.sentinelone.com/wp-content/uploads/2022/11/
50 KB
50 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_4.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8242b675ce39cfb1121740543c6e812490465c7c63858f7c77bcf217fcd4433
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-bppnx
fastly-io-info
ifsz=106806 idim=767x462 ifmt=jpeg ofsz=50912 odim=767x462 ofmt=webp
cf-cache-status
MISS
etag
"U8f1Rt6myf9cb6LSROkWvPUXpNc98veuRGWmZ1X55xI"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xwbwdivN906G9AHivipV8wYOzxVmUZhn2qkOaF444lfFxtcV84WfHaOKSH1tPBsv9upDi9EV75keMTvDWYK4l6RcUubNKOEvSSdcOUYqtTHrKr3%2FidYnI%2BRTfb%2FxSW2fGr%2BPnwY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 22 Oct 2025 12:55:55 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=29162&sent=519&recv=385&lost=0&retrans=0&sent_bytes=550799&recv_bytes=5566&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=855&x=0"
x-cache
HIT, MISS, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-klot8100130-CHI, cache-yyz4532-YYZ, cache-yyz4568-YYZ, cache-yyz4568-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.768636,VS0,VE432
x-styx-req-id
cf8c653b-8fab-11ef-8cb6-5a2086cc0437
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771438265401-YYZ
accept-ranges
bytes
content-length
50912
fastly-io-served-by
vpop-kiad7010215
server
cloudflare
BlackBasta_FIN7_6.jpg
www.sentinelone.com/wp-content/uploads/2022/11/
49 KB
50 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_6.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7612cda562abb7a2e8ba8ff60d66230e02077e218980f4293422ce4c8e0369c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-jkrtv
fastly-io-info
ifsz=102954 idim=745x499 ifmt=jpeg ofsz=50682 odim=745x499 ofmt=webp
cf-cache-status
MISS
etag
"w44JQDHml0HXk7MFGSiPyMStDFV4lUM9YvhIYAbRWo8"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=unDv3HOHySlQYq1zi0Xc71jMbGbOZV4LYdjKHjAvMfopSSJB3VUmfFlMPiK9Nfg%2BGrsKNsHLMjLW04G%2BKY7eybSWkiBVegUY62GAs1I7c2oWBA%2FdWQ%2FpE3k82HAsmuAyCv5hX4U%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 23 Oct 2025 19:39:43 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22540&sent=436&recv=324&lost=0&retrans=0&sent_bytes=467781&recv_bytes=5297&delivery_rate=8721551&cwnd=474&unsent_bytes=0&cid=80e19d55626cbabb&ts=721&x=0"
x-cache
HIT, MISS, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-klot8100044-CHI, cache-yyz4535-YYZ, cache-yyz4574-YYZ, cache-yyz4574-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.772579,VS0,VE292
x-styx-req-id
62e22955-90ad-11ef-b22e-9232e87249ea
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771438285401-YYZ
accept-ranges
bytes
content-length
50682
fastly-io-served-by
vpop-kiad7010251
server
cloudflare
BlackBasta_FIN7_1.jpg
www.sentinelone.com/wp-content/uploads/2022/11/
12 KB
13 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/uploads/2022/11/BlackBasta_FIN7_1.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f97c33a0d47b04256842d5e0fe975b4d6a6dd91ad35de032f9df63d0dbef1816
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-l45c8
fastly-io-info
ifsz=26171 idim=744x79 ifmt=jpeg ofsz=12782 odim=744x79 ofmt=webp
cf-cache-status
MISS
etag
"oweOqeutlVHfRi5ebUnctAJJlqkjC6/vuGozw2bad9A"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VdPSbHIgSETlo5Pm7K%2F1Ls9TavWoosYNzl%2FVgpGh4tvreDSeFyjljprsuWW%2FFiNAjTK8IXJOVx1uond%2BM3cmTzw8ddt%2FgfHrrd8hqFOTA0MEMzqBIeT1ceivctkdmYRvV10RHDc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Mon, 27 Oct 2025 08:58:18 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=23196&sent=506&recv=367&lost=0&retrans=0&sent_bytes=537073&recv_bytes=5369&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=757&x=0"
x-cache
HIT, MISS, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-kigq8000033-CHI, cache-yyz4522-YYZ, cache-yyz4578-YYZ, cache-yyz4578-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.774681,VS0,VE329
x-styx-req-id
7170c234-9378-11ef-9793-c2826556d9e4
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87714382b5401-YYZ
accept-ranges
bytes
content-length
12782
fastly-io-served-by
img01-us-east4
server
cloudflare
email-decode.min.js
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=172800, public
content-encoding
gzip
etag
W/"672528e6-4d7"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nIsyxt2e6Zr6xhQZaU1SXc3HQBf34%2FPS18t4w1O8bx8vbzZJWXfKc0SIFZAUgX%2FqylMypO3C6pHy%2BZahh2YachBxLAL%2F4OOcbuNALmxAP5Z4ChFFhP8SJ02xeOXCQmEKODQ0opg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8de87715c9925401-YYZ
expires
Fri, 08 Nov 2024 22:19:27 GMT
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript
last-modified
Fri, 01 Nov 2024 19:15:50 GMT
vary
Accept-Encoding
server
cloudflare
x-frame-options
DENY
clipboard.min.js
www.sentinelone.com/wp-includes/js/
9 KB
4 KB
Script
General
Full URL
https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-9ln5j
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b3-2331"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m4mgOoskFsS0wn63x6Zbzxx9621MEER15idHb%2BKXoeapw32xb54lBY6cFbZvdBk%2FOaIc8Ux0w5w3b%2BaW31UGCWGnbFy6d%2FMW243qLOt9gIa%2BuDmzuHvNq4jUiFyaDxnPfQcvgQw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:49 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=23189&sent=379&recv=285&lost=0&retrans=0&sent_bytes=412684&recv_bytes=4194&delivery_rate=8721551&cwnd=435&unsent_bytes=0&cid=80e19d55626cbabb&ts=683&x=0"
x-cache
MISS, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/x-javascript
last-modified
Tue, 05 Nov 2024 17:41:07 GMT
vary
Accept-Encoding
x-cache-hits
0, 200, 0, 0
x-served-by
cache-chi-kigq8000137-CHI, cache-yyz4521-YYZ, cache-yyz4565-YYZ, cache-yyz4565-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.021944,VS0,VE6
x-styx-req-id
72aada40-9ba0-11ef-bdbb-26f55946c583
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87715c9935401-YYZ
accept-ranges
bytes
content-length
3466
server
cloudflare
global.min.js
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
29 KB
11 KB
Script
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1730828465
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-6q4ll
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-739c"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PQ4jEVu%2BGu3P5Qsa5XK0iAzpGd9TdRA1iPECvevUnfnkFM62bE1zU8KMMuh6YCcHwqrfTiMSCt6pUoCTWVT6FvEPS8bbCxDukeoNRiPxJY17P49LLedaaddRXdHoksLevLhzI%2FI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:41 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=23189&sent=422&recv=293&lost=0&retrans=0&sent_bytes=456325&recv_bytes=4869&delivery_rate=8721551&cwnd=435&unsent_bytes=0&cid=80e19d55626cbabb&ts=702&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/x-javascript
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
12, 247, 0, 0
x-served-by
cache-chi-klot8100153-CHI, cache-yyz4565-YYZ, cache-yyz4532-YYZ, cache-yyz4532-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.034795,VS0,VE8
x-styx-req-id
6de93bb1-9ba0-11ef-8331-7e5f30ed31b8
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87715c9955401-YYZ
accept-ranges
bytes
content-length
10668
server
cloudflare
OneSignalSDK.js
cdn.onesignal.com/sdks/
9 KB
3 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=259200
content-encoding
br
cf-cache-status
HIT
etag
W/"09282956186c8515ef0d208902803581"
age
3179
via
1.1 google
cf-ray
8de877163948a1f9-YYZ
expires
Sat, 09 Nov 2024 22:19:27 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
ABCWhytePlusVariable.woff2
www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/
242 KB
243 KB
Font
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/assets/fonts/whyte/ABCWhytePlusVariable.woff2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.sentinelone.com
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-cfng6
cf-cache-status
EXPIRED
etag
"672a58b1-3c6a4"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6tKiPUnH0cukfgsCQeGJqCIuNhFd%2B9Sv8gSb9IddAsiypWwftpcU%2BLTy%2FCwV4xdfYulo3u6treeGQYZEGj6i%2BrEVxV8y%2BBiJsHEZUOetQDHyVvYNamViYtGsC03CTiIRM4jOh%2Fw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:39 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22226&sent=181&recv=142&lost=0&retrans=0&sent_bytes=162646&recv_bytes=3281&delivery_rate=5444838&cwnd=346&unsent_bytes=0&cid=80e19d55626cbabb&ts=463&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:26 GMT
content-type
font/woff2
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
14, 0, 0, 0
x-served-by
cache-chi-klot8100054-CHI, cache-yyz4528-YYZ, cache-yyz4555-YYZ, cache-yyz4555-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.802086,VS0,VE7
x-styx-req-id
6cb48d58-9ba0-11ef-b62b-1e69badfc695
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771468605401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
247460
server
cloudflare
97ee7348-9176-4a4b-9af2-40711264546b.json
js.knock-ai.com/
326 B
229 B
Fetch
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding
gzip
x-goog-hash
crc32c=uhxSig==, md5=XQTCayw0uJPhFpszoEnnIg==
etag
"5d04c26b2c34b893e1169b33a049e722"
age
215
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
196
date
Wed, 06 Nov 2024 22:15:51 GMT
last-modified
Tue, 01 Oct 2024 09:16:16 GMT
content-type
application/json
vary
Accept-Encoding
x-guploader-uploadid
AHmUCY1N9lb4St17ypVeDpJy3-fucAKIIOsaZwkJ4iuaOjsVkozYSvV3SK4oCr9gtL6dgdwVY2I_j0uAyA
access-control-allow-headers
*
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1727774176677479
content-length
196
server
UploadServer
97ee7348-9176-4a4b-9af2-40711264546b.json
js.knock-ai.com/ Frame
0
0
Preflight
General
Full URL
https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.json
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.49.80.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.80.49.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
DELETE,GET,HEAD,POST,PUT
access-control-allow-origin
*
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
date
Wed, 06 Nov 2024 22:19:26 GMT
expires
Wed, 06 Nov 2024 22:19:26 GMT
server
UploadServer
via
1.1 google
x-guploader-uploadid
AHmUCY0XqlU4ncXND8wGhniiwZmlpnoQc2HhFkvK1L2ploiXgx48JCcCn-pnk-DojKtt3mQBGzRxCk7FJw
uid
ca.knock-ai.com/client/an/v1/
50 B
387 B
Fetch
General
Full URL
https://ca.knock-ai.com/client/an/v1/uid
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::79 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash
8685640e0a4781c6e2e1951484111c44c980b88b795c5e29baa8dbd471f76448
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
x-request-id
8ba316f0-e555-4f9e-98d2-882592f6bc8d
cache-control
private, max-age=31536000, immutable
etag
43b2758a186ff15ec90f6fd9d7b1a16c
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
50
date
Wed, 06 Nov 2024 22:19:27 GMT
x-cloud-trace-context
28c9058d5cf3412e2b0e33e3b43d5f23/5471410298750046401;o=1
x-powered-by
Express
server
Google Frontend
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
gtm.js
www.googletagmanager.com/
378 KB
123 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fb99553fb6be234b2b6a0ac32f16922f5a3b746578f4879b81c1c3bf861db4f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires
Wed, 06 Nov 2024 22:19:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Wed, 06 Nov 2024 21:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
125966
x-xss-protection
0
server
Google Tag Manager
truncated
/
115 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
115 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
117 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7bfd314ec46e5dc42fbf2037344e20bb95068e0f972aaf26707a4afaaaea6da0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
truncated
/
118 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
labs-bg-light.png
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
34 KB
35 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/labs-bg-light.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34e435ba7c6172be5ab366a13b6df04fec9078cf076dadd56aac48b54463efff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-9ln5j
fastly-io-info
ifsz=77240 idim=700x951 ifmt=png ofsz=35196 odim=700x951 ofmt=webp
cf-cache-status
REVALIDATED
etag
"7BFksq8xo9eP/64Th905/zC34utiEyPMz7xERifVFYY"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3DIub7N5PKAZ7LSypXRhTmdCt8XJdod3JwRKOr2e8YAhZyqQjAJWOzZ9psQARcqoItnfOX1Jg6kk%2B3R1vFhMd11EM6OO%2FKn2TzTp8D2w5I8qlbr3xYR%2FKiCEL66XuXzlgB9BbxY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 29 Oct 2025 07:38:50 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=23189&sent=384&recv=285&lost=0&retrans=0&sent_bytes=416957&recv_bytes=4194&delivery_rate=8721551&cwnd=435&unsent_bytes=0&cid=80e19d55626cbabb&ts=683&x=0"
x-cache
MISS, MISS, HIT, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-klot8100147-CHI, cache-yyz4559-YYZ, cache-yyz4523-YYZ, cache-yyz4523-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730489915.570379,VS0,VE5
x-styx-req-id
ac8e9e78-94ff-11ef-856f-26f55946c583
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87715c9a25401-YYZ
accept-ranges
bytes
content-length
35196
fastly-io-served-by
vpop-kiad7010247
server
cloudflare
user-icon.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
1 KB
1 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/user-icon.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-5dxdh
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-556"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0CBGjLN4XSAJBKTbL%2B5q9uI%2BElNU9p5znV%2F1lMB4TY4Q8kudco02okFht%2BTuONuCLETKz%2FvMPiNZmoxHQuSN1YAq%2FlK1m3AKHclmgTkbji6bOccy8yEC3%2FZJ5ArtmXAfrhY1VYQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=23189&sent=418&recv=291&lost=0&retrans=0&sent_bytes=454830&recv_bytes=4664&delivery_rate=8721551&cwnd=435&unsent_bytes=0&cid=80e19d55626cbabb&ts=694&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
25, 0, 0, 0
x-served-by
cache-chi-klot8100147-CHI, cache-yyz4556-YYZ, cache-yyz4522-YYZ, cache-yyz4522-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.027430,VS0,VE9
x-styx-req-id
76bb356f-9ba0-11ef-a576-c25dfe06738a
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87715c9a65401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
775
server
cloudflare
calendar-icon.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
2 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-prs6f
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-7ae"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5mX2kXeUav1TOyn4es3fu6joCnLf%2FT%2Fom5NYNnNseEe0ucdBTZX7TZ%2Bt%2BB%2Fof%2FHjhDfZ5%2FqxsFYezxPg5ShAnbf6EDRkJUF31KhaY%2BIkalwzRJxn2tF8X5aMvb7fMe%2BDyBB3cIE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=23189&sent=415&recv=290&lost=0&retrans=0&sent_bytes=453169&recv_bytes=4563&delivery_rate=8721551&cwnd=435&unsent_bytes=0&cid=80e19d55626cbabb&ts=693&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
10, 0, 0, 0
x-served-by
cache-chi-kigq8000108-CHI, cache-yyz4542-YYZ, cache-yyz4568-YYZ, cache-yyz4568-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.026432,VS0,VE11
x-styx-req-id
76bda5b6-9ba0-11ef-a4b2-865bfe08344e
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87715c9a75401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
847
server
cloudflare
truncated
/
117 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03a716d58d312f56961da36cf9e9bd2694ba3d0fa9b18c5ebe271d7021b82953

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Type
image/svg+xml
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&callback=jQuery371020390213452632944_1730931566962&_=1730931566963
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57548881a0adbea15099a997653dbe9d9858f4d290dc3ee1c2142d583564b908

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cf-ray
8de87715ff1caaeb-YYZ
cached
true
content-encoding
gzip
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
cloudflare
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2673&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&callback=jQuery371020390213452632944_1730931566964&_=1730931566965
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b81f8a05f7c0bd15d528cf8fded1822a4b5237dee76a330bba8d4fc76de0acf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cf-ray
8de87715ff25aaeb-YYZ
cached
true
content-encoding
gzip
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
cloudflare
arrow-left-dark.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
835 B
1 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/arrow-left-dark.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-x7p54
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-343"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1sNKJiRkIaD0YOdDowqmi1uAfq6CwclaMg5btMWzlz0V12XrKDkmpZJ71b6NvS2wWKXFi3CLlz%2FXonGohRTdxLXPT9TrZ9sjfI%2BLhYoSaw%2BFgKjWGlbpxZwMzQFfixwbC9alct4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22824&sent=481&recv=331&lost=0&retrans=0&sent_bytes=521170&recv_bytes=5297&delivery_rate=8721551&cwnd=485&unsent_bytes=0&cid=80e19d55626cbabb&ts=728&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-kigq8000126-CHI, cache-yyz4542-YYZ, cache-yyz4576-YYZ, cache-yyz4576-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.064480,VS0,VE10
x-styx-req-id
76d67503-9ba0-11ef-8acf-1e568ca11146
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771609d65401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
489
server
cloudflare
arrow-right-dark.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
920 B
1 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/arrow-right-dark.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
444c83e95470e69f7355fcdb3a370c872025ae298b139090ff9f194ce28dea5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-4ddpx
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-398"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zHGB1rjCjJzPptE8WnIn1mNe2odIeA9qDWzLUPCIOkX4GFVo4Ac8BQkaMAl5dJ%2BdKZLML2dL%2FMkH7CsMeYbXhm6Vs%2BCjhM9e2%2BY5f20PdhKgkvO8RlMmGMecFeiUNAyUEknrqe4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22824&sent=487&recv=331&lost=0&retrans=0&sent_bytes=523494&recv_bytes=5297&delivery_rate=8721551&cwnd=485&unsent_bytes=0&cid=80e19d55626cbabb&ts=732&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
16, 0, 0, 0
x-served-by
cache-chi-klot8100092-CHI, cache-yyz4565-YYZ, cache-yyz4552-YYZ, cache-yyz4552-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.070402,VS0,VE8
x-styx-req-id
76d96010-9ba0-11ef-b89e-1af01b70491e
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771609d95401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
513
server
cloudflare
search-icon-white.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
681 B
1 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-prs6f
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-2a9"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ei5gjEdGb5z5AmuTPOQq50uH8RIruP5Jy03Zg6o0%2BvQe9TS%2BsTHPL0SRdQAGJe5ws0nXpIB76Vpfg3xFY48dqZc1bYXO%2BtTlBwUdIwYpVkmXfcpR08hWb87UzeriG25%2BHKZNxFk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:32 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22824&sent=484&recv=331&lost=0&retrans=0&sent_bytes=522385&recv_bytes=5297&delivery_rate=8721551&cwnd=485&unsent_bytes=0&cid=80e19d55626cbabb&ts=729&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
26, 113, 0, 0
x-served-by
cache-chi-kigq8000141-CHI, cache-yyz4581-YYZ, cache-yyz4535-YYZ, cache-yyz4535-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.068248,VS0,VE6
x-styx-req-id
688fe512-9ba0-11ef-a4b2-865bfe08344e
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771609dc5401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
385
server
cloudflare
calendar-icon-light.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
2 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon-light.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-bppnx
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-798"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZXkvyvR9lWVGdB%2FeVWf9EdRI1O5SxbhTLret4HwyZ6wNNRxrWRoEtzDXZ0SpMRHYy2YWPALx5uEgwL9%2FCx4DZq%2BHpjlBYhF4Z84twAn911VGccgaFf28q7RmrFPZ0WEoS9UpIE4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22824&sent=478&recv=331&lost=0&retrans=0&sent_bytes=519505&recv_bytes=5297&delivery_rate=8721551&cwnd=485&unsent_bytes=0&cid=80e19d55626cbabb&ts=726&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
11, 0, 0, 0
x-served-by
cache-chi-klot8100087-CHI, cache-yyz4521-YYZ, cache-yyz4553-YYZ, cache-yyz4553-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.064298,VS0,VE8
x-styx-req-id
76f17e61-9ba0-11ef-986e-5a2086cc0437
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771609de5401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
842
server
cloudflare
social-twitter-white.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg;
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
2 KB
2 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-9ln5j
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b2-7e1"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H2hMGp6d3eZ0iCjRnH6vz1w2zxXt2TfnYYHi0RISV1lpf02f%2FqNPonrcM4FAyfkZ2FuFCuB4JT7sW2ayafb1VcCi%2B7TbGcExFiZ6KBiYAqIFrOn7zgo43UuJ6iB9fTLzw8B%2FStQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=24960&sent=697&recv=514&lost=0&retrans=0&sent_bytes=768495&recv_bytes=6303&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=1895&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:06 GMT
vary
Accept-Encoding
x-cache-hits
14, 0, 0, 0
x-served-by
cache-chi-kigq8000133-CHI, cache-yyz4551-YYZ, cache-yyz4573-YYZ, cache-yyz4573-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931568.232567,VS0,VE9
x-styx-req-id
771de0a8-9ba0-11ef-bdbb-26f55946c583
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771d58c85401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
1036
server
cloudflare

Redirect headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-rm7m4
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OXdvMnWmmFHtl8jXxHXEn0qw8A59eWxSGhbvThAqyNDRJnwCcy78%2FwkKEAOUwiLDQExvojxLJVsJBWJ7vg0xk6bxWGv%2FaQTckj064XXfKkG9p7CL94R2L8d0HFVF43MC%2F2Ysyn4%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 11 Jan 1984 05:00:00 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=27634&sent=692&recv=508&lost=0&retrans=0&sent_bytes=764487&recv_bytes=5760&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=1836&x=0"
x-cache
MISS, MISS, MISS, MISS
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
text/html; charset=UTF-8
vary
Cookie, Cookie, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com, app.scalyr.com, app.eu.scalyr.com, localhost, https://bam.nr-data.net/, https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/, epsilon-globalaccelerator.6sense.com/, cdn.abrankings.com/, https://na-ab14.marketodesigner.com/
x-redirect-by
WordPress
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-served-by
cache-chi-kigq8000031-CHI, cache-yyz4537-YYZ, cache-yyz4572-YYZ, cache-yyz4572-YYZ
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/ https://pagead2.googlesyndication.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
cache-control
max-age=60
location
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.069692,VS0,VE1110
x-styx-req-id
2f6022d1-9c8d-11ef-953b-26381e4c950b
referrer-policy
origin-when-cross-origin
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771609e05401-YYZ
x-xss-protection
1; mode=block
server
cloudflare
social-linkedin-white.svg
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg;
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
2 KB
2 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465
Protocol
H2
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style-labs.min.css?ver=1730828465

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-4ddpx
content-encoding
gzip
cf-cache-status
EXPIRED
etag
W/"672a58b1-90f"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2jW6gyl8fdgiqnXCd8OrQSNOB5ed6RToaezERYegISihVXr1Lmhg0ZzUeQSmdlNMBnsOcNVuE6q776ggU%2BZ86hwvkQmxG2JnMllv3QQZcWfnu%2F1B6MDX%2FSqOl6P6EXWNxLo1bcE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22340&sent=689&recv=436&lost=0&retrans=0&sent_bytes=762703&recv_bytes=5760&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=1123&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
32, 0, 0, 0
x-served-by
cache-chi-kigq8000086-CHI, cache-yyz4581-YYZ, cache-yyz4538-YYZ, cache-yyz4538-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.459447,VS0,VE9
x-styx-req-id
773e193e-9ba0-11ef-b89e-1af01b70491e
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de877187c495401-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
993
server
cloudflare

Redirect headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-vvrfc
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pUTDmycwyysADz1IqNXPPaloyv0CWSNVZ8mHTeIEcWgWgBwp1y%2BfFtu5DxAvsfdusQvEnroh1ri0g62mqQy6Ond0qCe1FUoqKKeZmvjXxHITUZ1Q%2BtYSO2c9XT058OU5V0vZ1vM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 11 Jan 1984 05:00:00 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22447&sent=565&recv=431&lost=0&retrans=0&sent_bytes=605906&recv_bytes=5566&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=1052&x=0"
x-cache
MISS, MISS, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/html; charset=UTF-8
vary
Cookie, Cookie, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com, app.scalyr.com, app.eu.scalyr.com, localhost, https://bam.nr-data.net/, https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/, epsilon-globalaccelerator.6sense.com/, cdn.abrankings.com/, https://na-ab14.marketodesigner.com/
x-redirect-by
WordPress
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-served-by
cache-chi-klot8100027-CHI, cache-yyz4535-YYZ, cache-yyz4529-YYZ, cache-yyz4529-YYZ
content-security-policy
object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/ https://pagead2.googlesyndication.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
cache-control
max-age=60
location
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931567.065429,VS0,VE332
x-styx-req-id
2f5f67af-9c8d-11ef-a3a0-2ea2d7878a92
referrer-policy
origin-when-cross-origin
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771609e15401-YYZ
x-xss-protection
1; mode=block
server
cloudflare
Cloud-Workshop-blue-ftr-150x150.jpg
www.sentinelone.com/wp-content/uploads/2024/10/
2 KB
3 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/uploads/2024/10/Cloud-Workshop-blue-ftr-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7bd60efabec86bdf29c93ed75d715855ba70b44e2142b07f55810e6f82f009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-x7p54
fastly-io-info
ifsz=2936 idim=150x150 ifmt=jpeg ofsz=1810 odim=150x150 ofmt=webp
cf-cache-status
REVALIDATED
etag
"Et1KSVl5y70hHVcIDfoLPMO9h1VXColRSUQVvKi/Iik"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VGFqXku7pFFMTkF0JxRlnfweL089%2B1U3FAdD4%2FnudOJW9R0OlcKWr7RNZSjaIkKhuaQd6zP%2FCcYgDrvAmzGiF2opbTxqbAg94GXCoKIfGL2qlDhEzQC2XCc0vtUR6%2F22x7ZbAck%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Mon, 27 Oct 2025 22:41:04 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22824&sent=490&recv=331&lost=0&retrans=0&sent_bytes=524842&recv_bytes=5297&delivery_rate=8721551&cwnd=485&unsent_bytes=0&cid=80e19d55626cbabb&ts=738&x=0"
x-cache
HIT, MISS, HIT, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-klot8100085-CHI, cache-yyz4543-YYZ, cache-yyz4528-YYZ, cache-yyz4528-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730859819.093410,VS0,VE5
x-styx-req-id
620a3f5d-93eb-11ef-bf95-1e568ca11146
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771619ed5401-YYZ
accept-ranges
bytes
content-length
1810
fastly-io-served-by
vpop-kiad7010250
server
cloudflare
china-influence-feature-150x150.jpg
www.sentinelone.com/wp-content/uploads/2024/10/
850 B
2 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/uploads/2024/10/china-influence-feature-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49840572633a54f7cdd62fda23341a36ab335e287e7a3222ef752647eb62ff4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-c22gl
fastly-io-info
ifsz=1785 idim=150x150 ifmt=jpeg ofsz=850 odim=150x150 ofmt=webp
cf-cache-status
REVALIDATED
etag
"z+KGxWAHaOzHJF5j4NtQeBOpuAzprWTAOjMkz0loJdA"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=76VNHmQMyXK3VXvIjWvq4bgIGnA2DBH%2BkODOWAmv3jB54rjHUjePg84dLUiMhMjrGAIE5nmbgY%2BVj8zC432xo5SSxIwQrXgZjN%2FSUFFDPbXHc0C4QRvPp7JUEEJg06LLavOJDLw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sun, 19 Oct 2025 08:29:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=23352&sent=503&recv=364&lost=0&retrans=0&sent_bytes=535387&recv_bytes=5369&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=749&x=0"
x-cache
HIT, HIT, HIT, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-kigq8000061-CHI, cache-yyz4537-YYZ, cache-yyz4549-YYZ, cache-yyz4549-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730859819.245227,VS0,VE7
x-styx-req-id
27eaae8d-8d2b-11ef-b851-8ed28118664d
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771619f05401-YYZ
accept-ranges
bytes
content-length
850
fastly-io-served-by
vpop-kiad7010213
server
cloudflare
Kryptina-Desert-Ftr-150x150.jpg
www.sentinelone.com/wp-content/uploads/2024/09/
7 KB
8 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/uploads/2024/09/Kryptina-Desert-Ftr-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5589064355e3df666b6be1e23c86166dfdac76c7f58d08ed867331fdbb4fe7c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-a-5466c7c5b8-rm7m4
fastly-io-info
ifsz=7065 idim=150x150 ifmt=jpeg ofsz=6968 odim=150x150 ofmt=webp
cf-cache-status
REVALIDATED
etag
"9jg/BLGio6hE+tsz+hq9xGeHuQ5GetpeZLFFfGoSuRw"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d9IfzP0gm1OtvGoCgd7CDWfDEHIOkLqpH1qTqnvdB9fwDwuwej2z8B3zZg3uH%2BXaPmNm1o5ktX3J8zuqrBQ%2FS9FM7BYyjYNgsMvBnsj1RHyeN%2BaSbzdDlqe%2BLuw24L9ZBT0wcvs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Tue, 04 Nov 2025 08:58:58 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22824&sent=494&recv=331&lost=0&retrans=0&sent_bytes=527597&recv_bytes=5297&delivery_rate=8721551&cwnd=485&unsent_bytes=0&cid=80e19d55626cbabb&ts=740&x=0"
x-cache
MISS, HIT, HIT, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-klot8100124-CHI, cache-yyz4577-YYZ, cache-yyz4574-YYZ, cache-yyz4574-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730904750.653095,VS0,VE5
x-styx-req-id
dd242584-99c1-11ef-953b-26381e4c950b
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771619f25401-YYZ
accept-ranges
bytes
content-length
6968
fastly-io-served-by
vpop-kiad7010212
server
cloudflare
iframe_api
www.youtube.com/
993 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/global.min.js?ver=1730828465
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::5d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
bfeecc3034987d97b185701cb80e3e420bbc211ba7ea1752843d5152cb8da6b4
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options
nosniff
origin-trial
AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
expires
Wed, 06 Nov 2024 22:19:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/javascript; charset=utf-8
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
content-security-policy
require-trusted-types-for 'script'
cache-control
private, max-age=0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
x-xss-protection
0
server
ESF
SentinelLabs_Logo_RGB_WhitePurp.png
www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
2 KB
3 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-9cdv9
fastly-io-info
ifsz=5631 idim=566x102 ifmt=png ofsz=2400 odim=566x102 ofmt=webp
cf-cache-status
REVALIDATED
etag
"RQu1dwEJtFWeuwfGEHe2Efz1p35b1Asg8OLjSirVS3k"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7YDpMeQ%2B3za9Mn7OIoosBce1MTgGSyqd3bwrjg%2FOsy9m7CpgBnjeyQ%2BbZpDDKqVllaGCseNds0UoM6bGQu6tckkzELPEN6K02JAR5xHmQXWhalx%2BeJL%2Fi%2FVYnGHwnr%2BBikFhzks%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 15 Oct 2025 04:41:53 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=29162&sent=561&recv=385&lost=0&retrans=0&sent_bytes=602658&recv_bytes=5566&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=863&x=0"
x-cache
HIT, MISS, HIT, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/webp
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-klot8100069-CHI, cache-yyz4551-YYZ, cache-yyz4561-YYZ, cache-yyz4561-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730728389.666816,VS0,VE4
x-styx-req-id
a2558975-89e6-11ef-9c65-324c479d206c
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87716ea9a5401-YYZ
accept-ranges
bytes
content-length
2400
fastly-io-served-by
vpop-kiad7010231
server
cloudflare
Black-Basta-Feature.jpg
www.sentinelone.com/wp-content/uploads/2022/11/
148 KB
149 KB
Image
General
Full URL
https://www.sentinelone.com/wp-content/uploads/2022/11/Black-Basta-Feature.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5580705563824650857de2856ef8469e280ab28a55ab75dbf7c2b45e53ac59c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5b56695d4d-ss8qd
fastly-io-info
ifsz=154951 idim=1200x628 ifmt=jpeg ofsz=151297 odim=1200x628 ofmt=jpeg
cf-cache-status
MISS
etag
"u2LSmdF4lSm59QHEJC7kdRhrFO8ECyA27OV6VKbo7uU"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Pk6w1yO8MdGPaVEyZUm8%2BCfXXPjM8nzccOPg3LT7lwSweklAPyQCANIjWBwBZ4apOfkjSgCeRvKsBQHtieVYB2N6J7LtgRkf%2B8nfCw2H4cLQrRR0jnUdKp7vfuwGlMfrN1nCcQ%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Fri, 10 Oct 2025 11:45:56 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=22340&sent=570&recv=436&lost=0&retrans=0&sent_bytes=609975&recv_bytes=5760&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=1119&x=0"
x-cache
HIT, MISS, MISS, MISS
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/jpeg
vary
Accept, Accept-Encoding
x-cache-hits
0, 0, 0, 0
x-served-by
cache-chi-kigq8000172-CHI, cache-yyz4563-YYZ, cache-yyz4523-YYZ, cache-yyz4523-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
fastly-stats
io=1
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
fastly-io-warning
Failed to shrink image
x-timer
S1730931567.202760,VS0,VE261
x-styx-req-id
0b89df63-8634-11ef-8dec-aab69bd9462b
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de87716ea9c5401-YYZ
accept-ranges
bytes
content-length
151297
fastly-io-served-by
vpop-kiad7010213
server
cloudflare
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/
284 KB
68 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=1.0.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=259200
content-encoding
br
cf-cache-status
HIT
etag
W/"7e91359b46e1da637080a03b759164fa"
age
3005
via
1.1 google
cf-ray
8de87716f9e4a1f9-YYZ
expires
Sat, 09 Nov 2024 22:19:27 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
forms2.css
go.sentinelone.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"15208a8-3437-62370c030d900"
age
6708
x-content-type-options
nosniff
cf-ray
8de877170823aaeb-YYZ
expires
Thu, 07 Nov 2024 02:19:27 GMT
accept-ranges
bytes
content-length
2623
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/css
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/
828 B
335 B
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"5c01d7-33c-62370c030d900"
age
4381
x-content-type-options
nosniff
cf-ray
8de877170824aaeb-YYZ
expires
Thu, 07 Nov 2024 02:19:27 GMT
accept-ranges
bytes
content-length
246
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/css
last-modified
Tue, 01 Oct 2024 21:10:28 GMT
vary
Accept-Encoding
server
cloudflare
v1
ca.knock-ai.com/client/an/
0
0
Fetch
General
Full URL
https://ca.knock-ai.com/client/an/v1?clientId=97ee7348-9176-4a4b-9af2-40711264546b&version=1.1.3&revisionNumber=12&userId=74d6856d-d080-4084-aa4b-76849dc1976a.1730931567124&sessionId=5dd7c82d-76a3-4d4a-a3d0-acb7791bc93c&prevSessionStartTime=null&sessionStartTime=1730931567201&browser=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F130.0.0.0%20Safari%2F537.36&device=pc&os=Linux&pageNumber=1&pageVisit=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&prevPageVisitStartTime=null&pageVisitStartTime=1730931567201&prevPageVisitEndTime=null&pageVisitEndTime=null&timestamp=1730931567201&utmSource=&utmMedium=&utmCampaign=&utmTerm=&utmContent=&referrerDomain=&referrerPath=&referrerUrl=Direct
Requested by
Host: js.knock-ai.com
URL: https://js.knock-ai.com/97ee7348-9176-4a4b-9af2-40711264546b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::79 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

www-widgetapi.js
www.youtube.com/s/player/dad5a960/www-widgetapi.vflset/
30 KB
10 KB
Script
General
Full URL
https://www.youtube.com/s/player/dad5a960/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::5d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ab729c30cf1f421e9f8d2f9d8a6f5981fc906e90da32d5a46c7cbbf251fe8af3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
age
979
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 22:03:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 22:03:08 GMT
last-modified
Tue, 05 Nov 2024 05:17:59 GMT
content-type
text/javascript
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
content-length
10157
x-xss-protection
0
server
sffe
collect
analytics.google.com/g/
0
0
Fetch
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-KJPGLC9EVP&gtm=45je4au0v889850326za200&_p=1730931566985&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101823848~101925629&cid=859586636.1730931567&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1730931567&sct=1&seg=0&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&dt=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1259
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::71 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.sentinelone.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/plain
server
Golfe2
collect
stats.g.doubleclick.net/g/
0
557 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KJPGLC9EVP&cid=859586636.1730931567&gtm=45je4au0v889850326za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101823848~101925629
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.sentinelone.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/plain
server
Golfe2
rul
td.doubleclick.net/td/ga/ Frame C587
0
0
Document
General
Full URL
https://td.doubleclick.net/td/ga/rul?tid=G-KJPGLC9EVP&gacid=859586636.1730931567&gtm=45je4au0v889850326za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101925629&z=500027914
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
16
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 06 Nov 2024 22:19:27 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ga-audiences
www.google.ca/ads/
42 B
63 B
Image
General
Full URL
https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-KJPGLC9EVP&cid=859586636.1730931567&gtm=45je4au0v889850326za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101823848~101925629&tag_exp=101823848~101925629&z=738142466
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ww-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Wed, 06 Nov 2024 22:19:27 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
22 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
qVqAwzZMp5y69q24H0KNhg==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCFCF66DFEA780
x-ms-lease-status
unlocked
age
36973
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Thu, 07 Nov 2024 12:03:14 GMT
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript
last-modified
Mon, 04 Nov 2024 17:30:51 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
0cb2e4d5-001e-002e-669e-2f134d000000
cf-ray
8de877188826a308-YUL
accept-ranges
bytes
access-control-allow-origin
*
content-length
7212
x-ms-blob-type
BlockBlob
server
cloudflare
collect
www.google.com/ccm/
0
0
Ping
General
Full URL
https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=142024828.1730931567&auid=1521246621.1730931567&npa=0&gtm=45He4au0v71208095za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&tft=1730931567393&tfd=1282&apve=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.104 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f104.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-13-172-203.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Encoding
gzip
ETag
"49bb20382072bfb6b798a6f4c6ab8354:1730261707.305765"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
746
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date
Wed, 06 Nov 2024 22:19:27 GMT
Content-Type
application/x-javascript
Last-Modified
Wed, 30 Oct 2024 04:15:07 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
js
www.googletagmanager.com/gtag/
226 KB
81 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-13115870
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f601ad00963b4f8991efe50bc64dbd186844e7b8974988495fca679e442f60ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Wed, 06 Nov 2024 22:19:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Wed, 06 Nov 2024 21:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
82711
x-xss-protection
0
server
Google Tag Manager
a.js
cdn.calibermind.com/
213 KB
61 KB
Script
General
Full URL
https://cdn.calibermind.com/a.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d595 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"672135ec-354c2"
age
50848
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XFzLgJR%2FnYlkC8ps3lmGKhGPcRIfuF%2F9hLgNjvWSGlu54xyB%2BiDjIuIWKxrJxdHZBVyChz5NvYIWB3VIG3bUAXA3Y%2F1luUa92C2qZz7AKKGvcmHL8CsB9wIohiabvB9W5N8ovtKktkKOH0lCHBcXWHAe"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=15637&sent=7&recv=11&lost=0&retrans=0&sent_bytes=4046&recv_bytes=2209&delivery_rate=247063&cwnd=252&unsent_bytes=0&cid=e3bddd3a36af5462&ts=36&x=0"
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript
last-modified
Tue, 29 Oct 2024 19:22:20 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'
cache-control
public, max-age=86400, stale-if-error=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8de87718ad7e4bd6-YUL
server
cloudflare
identifyEmail.latest.js
cdn.calibermind.com/js/
838 B
930 B
Script
General
Full URL
https://cdn.calibermind.com/js/identifyEmail.latest.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d595 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"67213667-346"
age
40567
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F5pGFRfRZiC799Z3rX7KK%2FiyHjS8rFcma48Ah75EhITfXRBV4wZ9%2F7XXfrK7Ivc1860RcV4i%2BD8rl58TUdiJ%2B52zrY53BJbnGt1o61OwUMSQWaHJ6YxTZUvF38uX8BX3%2FC1M28kyZLKUMDoKJUhAWXYC"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=15637&sent=8&recv=11&lost=0&retrans=0&sent_bytes=4816&recv_bytes=2209&delivery_rate=247063&cwnd=252&unsent_bytes=0&cid=e3bddd3a36af5462&ts=36&x=0"
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript
last-modified
Tue, 29 Oct 2024 19:24:23 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'
cache-control
public, max-age=86400, stale-if-error=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8de87718ad7f4bd6-YUL
server
cloudflare
insight.min.js
snap.licdn.com/li.lms-analytics/
40 KB
14 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:c400:5::17c7:3719 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
max-age=42104
content-encoding
gzip
x-cdn
AKAM
x-content-type-options
nosniff
accept-ranges
bytes
content-length
14628
date
Wed, 06 Nov 2024 22:19:27 GMT
last-modified
Thu, 22 Aug 2024 11:06:54 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
x-amz-server-side-encryption
AES256
d16b1fea0b2ed64f.min.js
tag.demandbase.com/
61 KB
18 KB
Script
General
Full URL
https://tag.demandbase.com/d16b1fea0b2ed64f.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.160.10.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-160-10-55.iad12.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
x-amz-version-id
N2rb5lMV51RwbNUWzMvxWNf3Nzc5EPqh
etag
W/"1745d7ef3444455a72a3f86e4fb2ad07"
age
2006
x-cache
Hit from cloudfront
x-amz-cf-id
3GoBWqbIcSYiTfddtCpM-XcjERLCr0TU7lsLz6SNc45hiYhd-I5SeQ==
date
Wed, 06 Nov 2024 21:46:02 GMT
content-type
application/javascript; charset=utf-8
vary
accept-encoding
last-modified
Thu, 17 Oct 2024 13:53:58 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
cache-control
public, max-age=3600
via
1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
IAD12-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
o0e2bgdhqr
www.clarity.ms/tag/
689 B
1 KB
Script
General
Full URL
https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f6176412e6ec98f573b845121d5285acacd2d7025d54a4516543a52ec52303ba

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, no-store
request-context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
expires
-1
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
689
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/x-javascript
x-azure-ref
20241106T221927Z-17cf4964b89vzn8xhC1YTOuy5000000006d0000000006102
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.sentinelone.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.sentinelone.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.sentinelone.com&pId=4188232049878062920
4 B
281 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=4188232049878062920
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
2600:9000:27c5:b600:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

via
1.1 9ff565339b2a1ea629d89c8a9696c2fc.cloudfront.net (CloudFront)
apigw-requestid
A2G5jjyLIAMESaw=
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
4
x-amz-cf-id
oU4xX8NtryWCjG0NTG49VrrDZH0lrSU3bvmS5R5SwrkQPGUHKuf5Kw==
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
application/json
x-amz-cf-pop
IAD61-P5

Redirect headers

cache-control
no-store, no-cache, private
location
https://attr.ml-api.io/?domain=www.sentinelone.com&pId=4188232049878062920
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
167.114.209.103; 167.114.209.103; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
33e6c2ae-055b-4cf7-85d8-98ed7b7da919
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Wed, 06 Nov 2024 22:19:27 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.23.4
rt
tags.srv.stackadapt.com/
43 B
928 B
Image
General
Full URL
https://tags.srv.stackadapt.com/rt?sid=DIQlrAikIjHHohfyFxzIrn
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.44.251.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-251-75.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/gif
content-length
43
XDFrame
go.sentinelone.com/index.php/form/ Frame FFE1
2 KB
863 B
Document
General
Full URL
https://go.sentinelone.com/index.php/form/XDFrame
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
8de877188a05aaeb-YYZ
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 06 Nov 2024 22:19:27 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
web
onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.160.145 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
747e3532aaad5b5b6e6c81707e418887e00ab1a4fcdf40eb100277e9d8c667a8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-request-id
13d3bbab-a4a6-4e61-bb0a-69d1a83f2ba3
content-encoding
br
cf-cache-status
HIT
etag
W/"747e3532aaad5b5b6e6c81707e418887"
age
2851
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Wed, 06 Nov 2024 23:19:27 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/javascript; charset=utf-8
vary
Origin, Accept-Encoding
x-runtime
0.053458
access-control-allow-headers
SDK-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=3600
referrer-policy
strict-origin-when-cross-origin
x-download-options
noopen
via
1.1 google
cf-ray
8de877190a31543d-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 6AC1
0
0
Document
General
Full URL
https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.sentinelone.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
450366
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
1476
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Nov 2024 17:13:21 GMT
expires
Sat, 01 Nov 2025 17:13:21 GMT
last-modified
Mon, 21 Oct 2024 16:58:00 GMT
report-to
{"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server
sffe
service-worker-allowed
/static/service_worker
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d459609c962a9c19deba4ab0fd5769f7e103b76a084060e26e0e061423890ea5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
ibtwbyvWm9ELPsjj22uxRQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DCF1FD8F9B5210
age
85564
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Thu, 07 Nov 2024 22:19:27 GMT
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json
last-modified
Mon, 21 Oct 2024 18:24:11 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
7cfa8407-a01e-0089-4a4c-262aae000000
cf-ray
8de877190bcca296-YUL
accept-ranges
bytes
access-control-allow-origin
*
content-length
1777
x-ms-blob-type
BlockBlob
server
cloudflare
activityi;dc_pre=CJHd4sneyIkDFV6lWgUdmjY9mg;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;u...
13115870.fls.doubleclick.net/ Frame FF75
Redirect Chain
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv...
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CJHd4sneyIkDFV6lWgUdmjY9mg;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=...
0
0
Document
General
Full URL
https://13115870.fls.doubleclick.net/activityi;dc_pre=CJHd4sneyIkDFV6lWgUdmjY9mg;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.149 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
412
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 06 Nov 2024 22:19:27 GMT
expires
Wed, 06 Nov 2024 22:19:27 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 06 Nov 2024 22:19:27 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://13115870.fls.doubleclick.net/activityi;dc_pre=CJHd4sneyIkDFV6lWgUdmjY9mg;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
activityi;fledge=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gt...
td.doubleclick.net/td/fls/rul/ Frame 76D6
0
0
Document
General
Full URL
https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
16
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 06 Nov 2024 22:19:27 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=no...
ad.doubleclick.net/
0
24 B
Image
General
Full URL
https://ad.doubleclick.net/activity;register_conversion=1;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;npa=0;auiddc=1521246621.1730931567;ps=1;pcor=1221533341;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4au0v9135076156za200;gcd=13l3l3l3l1l1;dma=0;tag_exp=101823848~101925629;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F?
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f148.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 06 Nov 2024 22:19:27 GMT
attribution-reporting-register-trigger
{"aggregatable_deduplication_keys":[{"deduplication_key":"6182924551895060356"}],"aggregatable_trigger_data":[{"filters":[{"14":["14055451"]}],"key_piece":"0x98a328861a17d20a","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x45be8029ce79255f","not_filters":{"14":["14055451"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"109499463033293759","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"6182924551895060356","filters":[{"14":["14055451"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"6182924551895060356","filters":[{"14":["14055451"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"6182924551895060356","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"6182924551895060356","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["13115870"]}}
content-type
image/png
x-xss-protection
0
server
cafe
forms2.min.js
go.sentinelone.com/js/forms2/js/ Frame FFE1
199 KB
0
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f144e3bc13095ce7d1b638b1b2cc50b52cd12312cba1323706f6e71e8ded1e2c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://go.sentinelone.com/index.php/form/XDFrame

Response headers

cache-control
public, max-age=14400
content-encoding
gzip
cf-cache-status
HIT
etag
"1521a79-31b91-625a9127dc9e3"
age
4380
x-content-type-options
nosniff
cf-ray
8de877152e2aaaeb-YYZ
expires
Thu, 07 Nov 2024 02:19:26 GMT
date
Wed, 06 Nov 2024 22:19:26 GMT
content-type
application/x-javascript
last-modified
Wed, 30 Oct 2024 03:12:30 GMT
vary
Accept-Encoding
server
cloudflare
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
295 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db0da7efe3ac5fc9e598f71e291326f137ea7bbbf97fed4fee0e86b717b0d9a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept
application/json
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
access-control-allow-methods
GET, OPTIONS
cf-ray
8de87719cc8ca29c-YUL
access-control-allow-origin
*
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
Content-Type
sync
s.company-target.com/s/ Frame 96B5
0
0
Document
General
Full URL
https://s.company-target.com/s/sync?exc=lr
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/d16b1fea0b2ed64f.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
22.71.96.34.bc.googleusercontent.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-methods
GET,OPTIONS
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
634
content-type
text/html; charset=UTF-8
date
Wed, 06 Nov 2024 22:19:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
log
segments.company-target.com/
Redirect Chain
  • https://id.rlcdn.com/464526.gif
  • https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCO_Wr7kGEgUI6AcQAEIASgA
  • https://segments.company-target.com/log?vendor=liveramp&user_id=Xc12979SXm8M0aKYWX9hgK4e2zMHAHCjnhwxHhuVqCI_NipRI
26 B
348 B
Image
General
Full URL
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc12979SXm8M0aKYWX9hgK4e2zMHAHCjnhwxHhuVqCI_NipRI
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
HTTP/1.1
Server
99.84.191.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-191-47.iad89.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Connection
keep-alive
Via
1.1 40adc3dc2f5b304254d63ab3859fedd2.cloudfront.net (CloudFront)
X-Cache
Miss from cloudfront
Content-Length
26
X-Amz-Cf-Id
_-BTmwg3Nepca5I4HdjEykG1klxfRAMtMhTXqXHOj_TkVTcg6QeDow==
Date
Wed, 06 Nov 2024 22:19:27 GMT
Content-Type
image/gif
X-Amz-Cf-Pop
IAD89-C2

Redirect headers

cache-control
no-cache, no-store
timing-allow-origin
*
location
https://segments.company-target.com/log?vendor=liveramp&user_id=Xc12979SXm8M0aKYWX9hgK4e2zMHAHCjnhwxHhuVqCI_NipRI
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Wed, 06 Nov 2024 22:19:27 GMT
ip.json
api.company-target.com/api/v3/
465 B
1019 B
XHR
General
Full URL
https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&page_title=Black%20Basta%20Ransomware%20%7C%20Attacks%20Deploy%20Custom%20EDR%20Evasion%20Tools%20Tied%20to%20FIN7%20Threat%20Actor%20-%20SentinelOne
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/d16b1fea0b2ed64f.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.39.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-39-126.iad89.r.cloudfront.net
Software
nginx /
Resource Hash
ee98439c11ee9f2eaece7971d414049ec4089f484c21bef2c3145533592098ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.sentinelone.com/

Response headers

access-control-max-age
7200
access-control-expose-headers
x-amz-cf-id
content-encoding
gzip
identification-source
CENTRAL
access-control-allow-methods
GET, POST, OPTIONS
request-id
700f780a-42a1-4a71-90a1-02392e0fa3ef
expires
Tue, 05 Nov 2024 22:19:27 GMT
x-cache
Miss from cloudfront
x-amz-cf-id
KkUhFo8CRIE9PibQrrrXQ38s7jw8SeUW_ujRUUys7xlAmvxPkjFY-A==
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json;charset=utf-8
vary
Accept-Encoding, Origin
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
api-version
v3
access-control-allow-credentials
true
via
1.1 a251e31740a6e166e8fdccf296c41644.cloudfront.net (CloudFront)
access-control-allow-origin
https://www.sentinelone.com
x-amz-cf-pop
IAD89-C1
server
nginx
attribution_trigger
px.ads.linkedin.com/
2 B
813 B
XHR
General
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=5427652%2C5500618&time=1730931567626&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*
Referer
https://www.sentinelone.com/

Response headers

x-li-pop
afd-prod-lor1-x
content-encoding
gzip
x-fs-uuid
00062645e93a90abdfbf8f49d8e0b456
x-msedge-ref
Ref A: E97FF2ABBBDD4023A36983EE864DDB85 Ref B: YMQ01EDGE0820 Ref C: 2024-11-06T22:19:27Z
x-li-fabric
prod-lor1
x-restli-protocol-version
1.0.0
access-control-allow-methods
GET, OPTIONS
x-li-uuid
AAYmRek6kKvfv49J2OC0Vg==
x-li-proto
http/2
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json
access-control-allow-headers
*
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5427652%2C5500618&time=1730931567626&li_adsId=920d45bb-b5c0-4d52-b656-a35f17f55eb1&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-rans...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5427652%2C5500618&time=1730931567626&li_adsId=920d45bb-b5c0-4d52-b656-a35f17f55eb1&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ran...
0
483 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5427652%2C5500618&time=1730931567626&li_adsId=920d45bb-b5c0-4d52-b656-a35f17f55eb1&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&e_ipv6=AQKdsG7mN_Gh5AAAAZMDj6y5PBypJnZAWB1ZwicQYHVsvlLUomrcXc_iTDgI1u2Z_Vxqv-P82g
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-lva1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref
Ref A: 6DC27FE5EEB5485293FFEC93818009FC Ref B: YMQ01EDGE0516 Ref C: 2024-11-06T22:19:27Z
x-li-fabric
prod-lva1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid
AAYmRek9Os73KxZvmCSiHw==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5427652%2C5500618&time=1730931567626&li_adsId=920d45bb-b5c0-4d52-b656-a35f17f55eb1&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&e_ipv6=AQKdsG7mN_Gh5AAAAZMDj6y5PBypJnZAWB1ZwicQYHVsvlLUomrcXc_iTDgI1u2Z_Vxqv-P82g
x-msedge-ref
Ref A: 0BD1AB709F824369A3058C9120738153 Ref B: YMQ01EDGE0621 Ref C: 2024-11-06T22:19:27Z
x-li-fabric
prod-lva1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid
AAYmRek6V6XMyeCfl5wOdA==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
x-li-source-fabric
prod-ltx1
date
Wed, 06 Nov 2024 22:19:26 GMT
/
px.ads.linkedin.com/wa/
0
943 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*
Content-Type
text/plain;charset=UTF-8

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref
Ref A: 53A316C2E69C4544BBC2E7E6F428ED48 Ref B: YMQ01EDGE0621 Ref C: 2024-11-06T22:19:27Z
x-li-fabric
prod-lva1
access-control-allow-credentials
true
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid
AAYmRek6WJOu3Wy7JZX6rQ==
x-li-proto
http/2
access-control-allow-origin
https://www.sentinelone.com
x-cache
CONFIG_NOCACHE
x-li-source-fabric
prod-ltx1
date
Wed, 06 Nov 2024 22:19:26 GMT
vary
Origin
p
e.calibermind.com/v1/
16 B
781 B
Fetch
General
Full URL
https://e.calibermind.com/v1/p
Requested by
Host: cdn.calibermind.com
URL: https://cdn.calibermind.com/a.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.213.149 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.sentinelone.com/

Response headers

access-control-max-age
900
x-request-id
0a814a5e-c53e-49b0-86a8-83e5377438f7
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dgDbl1NPG3ymv4a4gygMNF5msSvZztY5bvzqQmP4IkXBQcNFaZdlptZpzkTp5UwCBkSL6Lb6%2B9b4QbCW%2BJvECNp2Ijy2wOFkypYoHBnPA7TRuzGAyVHDwCG9wKd2a%2BL41JYTyg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=22201&sent=12&recv=12&lost=0&retrans=0&sent_bytes=4187&recv_bytes=7154&delivery_rate=26144&cwnd=12000&unsent_bytes=0&cid=112bd8a33a33e99c&ts=68&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json; charset=utf-8
priority
u=1,i
access-control-allow-headers
Content-Type,Authorization
strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8de8771a4c68ac60-YYZ
access-control-allow-origin
*
content-length
16
server
cloudflare
clarity.js
www.clarity.ms/s/0.7.49/
64 KB
27 KB
Script
General
Full URL
https://www.clarity.ms/s/0.7.49/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/o0e2bgdhqr?ref=gtm2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
09fa04e84d7038cc32f19bedcba454b9e637a35f4de496e8ec9148c47550f0fc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-azure-ref
20241106T221927Z-17cf4964b89vzn8xhC1YTOuy5000000006d0000000006103
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DCF3CA14C9A428"
x-fd-int-roxy-purgeid
51562430
x-ms-request-id
1f627ed7-601e-0050-6f4e-2dec8b000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Thu, 24 Oct 2024 01:20:43 GMT
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-13-172-203.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Cache-Control
max-age=8640000
Content-Encoding
gzip
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection
keep-alive
Expires
Fri, 14 Feb 2025 22:19:27 GMT
Accept-Ranges
bytes
Content-Length
4741
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date
Wed, 06 Nov 2024 22:19:27 GMT
Content-Type
application/x-javascript
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
OneSignalSDKStyles.css
onesignal.com/sdks/
82 KB
9 KB
Stylesheet
General
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.160.145 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2592000
content-encoding
br
cf-cache-status
HIT
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
age
220
via
1.1 google
cf-ray
8de87719fb04543d-YYZ
expires
Fri, 06 Dec 2024 22:19:27 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/css
vary
Accept-Encoding
server
cloudflare
access-control-allow-headers
OneSignal-Subscription-Id
visitWebPage
327-mnm-087.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1730931567682&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1730931567679-47431&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Transfer-Encoding
chunked
X-Request-Id
274f5f09-d399-4187-8b3d-aafc0aa33ad5
Content-Encoding
gzip
Connection
keep-alive
Access-Control-Allow-Origin
*
Date
Wed, 06 Nov 2024 22:19:27 GMT
Content-Type
text/plain; charset=UTF-8
Server
nginx/1.20.1
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202409.2.0/
461 KB
112 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d9c9ad349c47e81a545ff3e3bdb0a8df5ebe959da9b52cadd9440d92f7ef359
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
uGd5VTJp/PFmoOURmUW/IQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCF719E1819D6B
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
49848
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/javascript
last-modified
Mon, 28 Oct 2024 06:29:30 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
ec98eb99-d01e-00e0-4b63-297502000000
cf-ray
8de8771a1a29a308-YUL
accept-ranges
bytes
access-control-allow-origin
*
content-length
114311
x-ms-blob-type
BlockBlob
server
cloudflare
en.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/0192af67-573c-7dd0-9a86-4e7461ace81f/
172 KB
30 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/0192af67-573c-7dd0-9a86-4e7461ace81f/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d26226754134e57412525e87dc59530be3578c86559efd7b4389cd629a8d74ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
6vKS0PR6n1AuINUcRecYRQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
cf-cache-status
HIT
etag
0x8DCF1FD9269E930
age
85563
x-ms-lease-status
unlocked
x-content-type-options
nosniff
x-ms-version
2009-09-19
expires
Thu, 07 Nov 2024 22:19:27 GMT
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json
last-modified
Mon, 21 Oct 2024 18:24:16 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin, cross-origin
x-ms-request-id
6f8574cd-301e-000f-604c-267e7c000000
cf-ray
8de8771a8dbaa296-YUL
accept-ranges
bytes
access-control-allow-origin
*
content-length
30248
x-ms-blob-type
BlockBlob
server
cloudflare
icon
onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/
240 B
791 B
Fetch
General
Full URL
https://onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151606
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.160.145 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-request-id
a76d93a8-2470-48f0-9f6e-36839f95a3bb
content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"c30dc39ff7449779c568ff4e90c170f0"
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json; charset=utf-8
vary
Accept, Origin, Accept-Encoding
x-runtime
0.013782
access-control-allow-headers
SDK-Version
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
max-age=0, private, must-revalidate
referrer-policy
strict-origin-when-cross-origin
x-download-options
noopen
via
1.1 google
cf-ray
8de8771acfa5ab4e-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
bg9s
tag-logger.demandbase.com/
0
420 B
XHR
General
Full URL
https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=KkUhFo8CRIE9PibQrrrXQ38s7jw8SeUW_ujRUUys7xlAmvxPkjFY-A==&api-version=v3
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/d16b1fea0b2ed64f.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2009:400:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-amz-version-id
8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
24032
x-cache
Error from cloudfront
x-amz-cf-id
_S90Rlgj3wu5jO5EB1JEf2k7-g4Bfw8SneJgHzxZv4AVgQ34vsRC4A==
date
Wed, 06 Nov 2024 15:38:55 GMT
content-type
text/html
vary
accept-encoding
last-modified
Tue, 07 Mar 2023 20:47:02 GMT
via
1.1 96a209e44727117dd65f64a42c737a2c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
0
x-amz-cf-pop
IAD66-C2
server
AmazonS3
x-amz-server-side-encryption
AES256
otFlat.json
cdn.cookielaw.org/scripttemplates/202409.2.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
CDHNBOyaHPNE3EDr/Gzy5w==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCF719DDD38B75
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
31143
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json
last-modified
Mon, 28 Oct 2024 06:29:24 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
442fed9c-201e-00ba-23af-297383000000
cf-ray
8de8771b0e4ea296-YUL
accept-ranges
bytes
access-control-allow-origin
*
content-length
3003
x-ms-blob-type
BlockBlob
server
cloudflare
otPcPanel.json
cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/
64 KB
13 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/otPcPanel.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61721c8ccac413f9c55dede65a99c739ff8bf68c423fdbb918bd80d9bc4c9fa3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
l+5O72TWRgHmm4UuVxyiqg==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8DCF719DF4835CC
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
85563
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
application/json
last-modified
Mon, 28 Oct 2024 06:29:27 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
9e7f8d21-601e-0071-7166-29e1b3000000
cf-ray
8de8771b0e50a296-YUL
accept-ranges
bytes
access-control-allow-origin
*
content-length
12880
x-ms-blob-type
BlockBlob
server
cloudflare
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202409.2.0/assets/
24 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2afa04c9a3e080712c94d68b9c1d33587fddcbaeaba9dfcaf1d53d19f6a280a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
A9jekd5UoO8SyzJ6LiStug==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
85563
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
text/css
last-modified
Mon, 28 Oct 2024 06:29:35 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
bc30c5d0-d01e-00a4-06af-29a96e000000
cf-ray
8de8771b0e51a296-YUL
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
collect
b.clarity.ms/
0
283 B
XHR
General
Full URL
https://b.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.49/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
4.153.129.168 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://www.sentinelone.com/

Response headers

Request-Context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
Access-Control-Allow-Origin
https://www.sentinelone.com
Date
Wed, 06 Nov 2024 22:19:28 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
tv2track.js
collector-5527.tvsquared.com/
0
190 B
Script
General
Full URL
https://collector-5527.tvsquared.com/tv2track.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.141.114 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-246-141-114.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

Content-Length
0
Date
Wed, 06 Nov 2024 22:19:28 GMT
Content-Type
application/javascript, application/javascript
Server
nginx
Connection
keep-alive
ot_guard_logo.svg
cdn.cookielaw.org/logos/static/
497 B
495 B
Fetch
General
Full URL
https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
22846
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Mon, 04 Nov 2024 17:30:58 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
0059715c-101e-00b9-80e5-2e7084000000
cf-ray
8de8771b7ec8a296-YUL
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
header-logo-dark.png
cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920551-70fc-76a4-a34b-902d0ad63828/1f67f62c-48f1-40a9-a4a9-418df05f10c8/
17 KB
17 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/32cb4128-496e-485c-a440-c1361261f0b9/01920551-70fc-76a4-a34b-902d0ad63828/1f67f62c-48f1-40a9-a4a9-418df05f10c8/header-logo-dark.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
zP9vNoac0WWOsoM5qHSlqQ==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
etag
0x8DCD7E5B54439DF
age
85562
cf-cache-status
HIT
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/png
last-modified
Wed, 18 Sep 2024 13:27:56 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
e0125d72-801e-0095-09ce-09f2b9000000
cf-ray
8de8771bac23a308-YUL
accept-ranges
bytes
access-control-allow-origin
*
content-length
17475
x-ms-blob-type
BlockBlob
server
cloudflare
powered_by_logo.svg
cdn.cookielaw.org/logos/static/
5 KB
2 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-md5
Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
cf-cache-status
HIT
age
41006
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 22:19:27 GMT
content-type
image/svg+xml
last-modified
Mon, 04 Nov 2024 17:30:59 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=86400
cross-origin-resource-policy
cross-origin
x-ms-request-id
8618a89f-501e-0079-61a7-2ffac0000000
cf-ray
8de8771bac25a308-YUL
access-control-allow-origin
*
x-ms-blob-type
BlockBlob
server
cloudflare
wINUGMVQyKNdKtMTH4Wt_s1.png
img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/
6 KB
7 KB
Image
General
Full URL
https://img.onesignal.com/permanent/43c3ad2d-0a70-4421-8189-b15392c350e5/wINUGMVQyKNdKtMTH4Wt_s1.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.111.223 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=1QkUUA==, md5=Dj+SUoicGnX7oiG7n37+GQ==
cf-bgj
imgq:85,h2pri
etag
"-CPLdwrW3woQDEAE="
cf-cache-status
HIT
x-goog-stored-content-encoding
identity
expires
Sat, 07 Dec 2024 22:19:28 GMT
cf-polished
origSize=11143, status=vary_header_present
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
11143
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
image/png
last-modified
Fri, 23 Feb 2024 21:44:25 GMT
vary
Origin, Accept-Encoding
x-guploader-uploadid
ACJd0Nqfqi5TN2BPqf2DMex2GMNoKQkhxJKJZTRRxpwd1jbqZ5FDR8dQDJZE8IO9B6V8sdoAUe2sudMFyQ
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2678400
pragma
no-cache
x-goog-storage-class
STANDARD
cf-ray
8de8771c5e3fa1f9-YYZ
x-goog-encryption-kms-key-name
projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
accept-ranges
bytes
x-goog-generation
1708724665233138
content-length
6492
server
cloudflare
nr-rum-1.271.0.min.js
js-agent.newrelic.com/
51 KB
17 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-rum-1.271.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2602:816:5001::39 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b1bb78c75db84dbd958fc653c0ff6e461e54352cfe41f0cfecff995efb1f21ac
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://www.sentinelone.com
Referer
https://www.sentinelone.com/

Response headers

strict-transport-security
max-age=300
cache-control
public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
content-encoding
br
etag
"1a78a2ef89456138fdf58df85b0c0073"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
x-cache
HIT
content-length
16588
date
Wed, 06 Nov 2024 22:19:28 GMT
last-modified
Fri, 01 Nov 2024 17:54:17 GMT
content-type
application/javascript
x-served-by
cache-yul1970066-YUL
x-cache-hits
4872
vary
Accept-Encoding
zi-tag.js
js.zi-scripts.com/
9 KB
3 KB
Script
General
Full URL
https://js.zi-scripts.com/zi-tag.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-amz-version-id
PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
etag
W/"b2877da906a3216c4f3fc4030b205e54"
age
57059
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
2PA5066ko-tSMD9T9c2Ha-drSW1YvG7BFBtZlYP6JnW0ngg_xLzPFw==
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
application/javascript
last-modified
Thu, 18 Jul 2024 08:13:46 GMT
vary
Accept-Encoding
via
1.1 90b7b9dc3aa8817f0cef3cfd45fb8916.cloudfront.net (CloudFront)
cf-ray
8de8771edb18a1fc-YYZ
x-amz-cf-pop
YUL62-C2
server
cloudflare
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=33D3E73234144A37BCC81704E8DB5AD4&RedC=c.clarity.ms&MXFR=1D0584C2446A634B273491ED406A6DCE
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=33D3E73234144A37BCC81704E8DB5AD4&MUID=31144A33CC846DD730475F1CCD526C11
42 B
465 B
Image
General
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=33D3E73234144A37BCC81704E8DB5AD4&MUID=31144A33CC846DD730475F1CCD526C11
Protocol
H2
Server
20.110.205.119 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"8d3dafd6e71fdb1:0"
accept-ranges
bytes
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
42
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
image/gif
last-modified
Wed, 16 Oct 2024 16:24:13 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET

Redirect headers

cache-control
private, no-cache, proxy-revalidate, no-store
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=33D3E73234144A37BCC81704E8DB5AD4&MUID=31144A33CC846DD730475F1CCD526C11
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: CAF647D4F83D44A2BDE6F311F3FCC2A9 Ref B: YMQ01EDGE0313 Ref C: 2024-11-06T22:19:28Z
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
0
date
Wed, 06 Nov 2024 22:19:27 GMT
x-powered-by
ASP.NET
favicon.ico
www.sentinelone.com/wp-content/themes/sentinelone/assets/favicon-whyte/
15 KB
3 KB
Other
General
Full URL
https://www.sentinelone.com/wp-content/themes/sentinelone/assets/favicon-whyte/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e189b6269fc9c19343d172b50d26939bc988ba9ee4b75bd7e39268ce9926c05b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

x-pantheon-styx-hostname
styx-fe2-b-5955f47cc7-4ddpx
content-encoding
gzip
cf-cache-status
EXPIRED
etag
"672a58b1-3aee"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o%2B8%2Bjs5EloO8rUC9K0CGZGrXJZgorSZYMz5W6hGmLt21bbsegwDwgcoiIXY%2FZWPj0xDeeC8HAZ7xlA2B8xf9XWbNJ%2FxDkqbYuj0eBxepVeqVI4n4TwD7zFt0uFbKVtgNuDTkaso%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 18:04:41 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=29394&sent=700&recv=517&lost=0&retrans=0&sent_bytes=770412&recv_bytes=6405&delivery_rate=8721551&cwnd=506&unsent_bytes=0&cid=80e19d55626cbabb&ts=2085&x=0"
x-cache
HIT, HIT, MISS, MISS
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
image/x-icon
last-modified
Tue, 05 Nov 2024 17:41:05 GMT
vary
Accept-Encoding
x-cache-hits
13, 237, 0, 0
x-served-by
cache-chi-klot8100086-CHI, cache-yyz4526-YYZ, cache-yyz4527-YYZ, cache-yyz4527-YYZ
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=60
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730931568.424928,VS0,VE6
x-styx-req-id
6e48560b-9ba0-11ef-b89e-1af01b70491e
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray
8de8771e89cf5401-YYZ
accept-ranges
bytes
content-length
2131
server
cloudflare
NRJS-7f7a0b93139dcf56f90
bam.nr-data.net/1/
179 B
634 B
XHR
General
Full URL
https://bam.nr-data.net/1/NRJS-7f7a0b93139dcf56f90?a=773889139&v=1.271.0&to=ZlwDMkMCWxJQUkdYXF8WIAVFCloPHkJaX1RdXA%3D%3D&rst=2357&ck=0&s=b803ea91a80a29c4&ref=https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/&ptid=89c3d6dabde844bf&ap=611&be=604&fe=1677&dc=480&at=ShsARAsYSBw%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1730931566112,%22n%22:0,%22f%22:546,%22dn%22:546,%22dne%22:546,%22c%22:546,%22s%22:546,%22ce%22:546,%22rq%22:547,%22rp%22:605,%22rpe%22:636,%22di%22:1083,%22ds%22:1083,%22de%22:1084,%22dc%22:2277,%22l%22:2278,%22le%22:2281%7D,%22navigation%22:%7B%7D%7D&fp=930&fcp=930
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-rum-1.271.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
02eb86b1afc2418800ab2c95f1d6e9a7869c05d9df41518ef2d25a6bc6e6b496

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://www.sentinelone.com/

Response headers

access-control-expose-headers
Date
timing-allow-origin
https://www.sentinelone.com
Connection
keep-alive
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
cross-origin-resource-policy
cross-origin
access-control-allow-origin
https://www.sentinelone.com
Content-Length
179
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
text/plain
x-served-by
cache-nyc-kteb1890059-NYC
getSubscriptions
js.zi-scripts.com/unified/v1/master/
203 B
582 B
Fetch
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
c8b81758ce4608b0cd9f70e49b12312e033d091a403d516e043ff1f73b2f494a

Request headers

Authorization
Bearer 48c04a7b101669405516
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json
visited_url
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
etag
W/"cb-zagnEV6MNrPPbBRj7Vd5HqBvV34"
apigw-requestid
A2G5qhokvHcEMBg=
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
4EwtYnpv_sfWY26PMBfPhSN-cUdiGZzsM4DHngWG_64UMkBpmPcbXg==
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
application/json; charset=utf-8
vary
Origin
via
1.1 972558ca27335deefa2033492c807fe6.cloudfront.net (CloudFront)
cf-ray
8de8771ffdbcab3f-YYZ
access-control-allow-origin
https://www.sentinelone.com
x-amz-cf-pop
YTO53-P1
x-powered-by
Express
server
cloudflare
getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame
0
0
Preflight
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type,visited_url
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods
POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin
https://www.sentinelone.com
alt-svc
h3=":443"; ma=86400
apigw-requestid
A2G5pieqPHcEMsQ=
cf-cache-status
DYNAMIC
cf-ray
8de8771f5d4fab3f-YYZ
date
Wed, 06 Nov 2024 22:19:28 GMT
server
cloudflare
vary
Origin
via
1.1 972558ca27335deefa2033492c807fe6.cloudfront.net (CloudFront)
x-amz-cf-id
jPDfJG-moq1HjscqAJdjrumKVa9DhzjKO-Wr6oQydv5EQPM__9wg5g==
x-amz-cf-pop
YTO53-P1
x-cache
Miss from cloudfront
x-powered-by
Express
/
ws.zoominfo.com/pixel/634714349abfe055a2626d77/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/pixel/634714349abfe055a2626d77/?iszitag=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
_vtok,_zitok,content-type,visited-url
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin
https://www.sentinelone.com
allow
GET,HEAD
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8de877211f87ab48-YYZ
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 06 Nov 2024 22:19:28 GMT
server
cloudflare
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
formcomplete.js
ws-assets.zoominfo.com/
49 KB
15 KB
Script
General
Full URL
https://ws-assets.zoominfo.com/formcomplete.js
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.sentinelone.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=A2aW0Q==, md5=JRurSHzL3UB0yE1Wjm0Zqg==
cf-cache-status
DYNAMIC
etag
W/"251bab487ccbdd4074c84d568e6d19aa"
age
2226
content-encoding
gzip
x-goog-stored-content-encoding
identity
expires
Wed, 06 Nov 2024 22:42:22 GMT
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
50634
date
Wed, 06 Nov 2024 22:19:28 GMT
content-type
application/javascript
last-modified
Wed, 06 Nov 2024 05:44:23 GMT
x-guploader-uploadid
AHmUCY3fX0fOYs4X_0g5pA7cJ1L5Kfu_zH8BbyJIAPNvkQIbvGEeIhDDEW04LoLpUCJv5MupVLYkucTz8g
cache-control
public, max-age=3600
x-goog-storage-class
STANDARD
cf-ray
8de8772109f8b400-YYZ
x-goog-generation
1730871862939881
server
cloudflare
/
ws.zoominfo.com/pixel/634714349abfe055a2626d77/
3 KB
2 KB
Fetch
General
Full URL
https://ws.zoominfo.com/pixel/634714349abfe055a2626d77/?iszitag=true
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
63cd24d04294b61c92cb8067fa817765c14bb0e2447c6fe2ff563d9bc8758f3d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

_zitok
0393f77b6ebe3b7c97e31730931568
_vtok
MTY3LjExNC4yMDkuMTAz
visited-url
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
Referer
https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/javascript

Response headers

x-robots-tag
noindex, nofollow
content-encoding
gzip
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
x-content-type-options
nosniff
via
1.1 google
cf-ray
8de87721ea51ac72-YYZ
access-control-allow-origin
https://www.sentinelone.com
alt-svc
h3=":443"; ma=86400
date
Wed, 06 Nov 2024 22:19:29 GMT
content-type
text/javascript
vary
Accept-Encoding
x-powered-by
Express
server
cloudflare
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
forms
ws.zoominfo.com/formcomplete-v2/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/formcomplete-v2/forms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin
https://www.sentinelone.com
allow
POST
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8de877218827ab48-YYZ
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 06 Nov 2024 22:19:28 GMT
server
cloudflare
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
forms
ws.zoominfo.com/formcomplete-v2/
3 KB
1 KB
Fetch
General
Full URL
https://ws.zoominfo.com/formcomplete-v2/forms
Requested by
Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
8e30a001c8ab4307b5505c297c883e69f506828d17f1b1c2e8f0bccaec67b256
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Authorization
bearer 52dd1ea15b93f74d4065ddeb46b311
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

x-robots-tag
noindex, nofollow
content-encoding
gzip
cf-cache-status
DYNAMIC
etag
W/"a04-Xb/u4ZB4f0aCqbnxE8vZawHDaCc"
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Wed, 06 Nov 2024 22:19:29 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials
true
via
1.1 google
cf-ray
8de877224abdac72-YYZ
access-control-allow-origin
https://www.sentinelone.com
x-powered-by
Express
server
cloudflare
collect
b.clarity.ms/
0
283 B
XHR
General
Full URL
https://b.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.49/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
4.153.129.168 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://www.sentinelone.com/

Response headers

Request-Context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
Access-Control-Allow-Origin
https://www.sentinelone.com
Date
Wed, 06 Nov 2024 22:19:29 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
19c35f3e-e18c-42c0-b32b-557fcbc4ef34
https://www.sentinelone.com/
3 KB
0
Script
General
Full URL
blob:https://www.sentinelone.com/19c35f3e-e18c-42c0-b32b-557fcbc4ef34
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
63cd24d04294b61c92cb8067fa817765c14bb0e2447c6fe2ff563d9bc8758f3d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
text/javascript
Content-Length
3457

Verdicts & Comments Add Verdict or Comment

97 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| NREUM object| webpackChunk:NRBA-1.271.0.PROD object| newrelic function| FontFaceObserver function| redirectUsers function| $ function| jQuery number| __knock_is_running string| knock_vendorId object| MktoForms2 function| documentInitOneSignal function| OneSignal function| gtag object| dataLayer function| ClipboardJS object| lazyLoadInstance function| checkPageScroll function| LazyLoad function| WOW object| Apologetic object| Autopop object| FormGCLID object| GlobalMediaViewer object| PathFactoryUtils object| UtmLinks object| wow object| swiper object| hljs object| MarkerAnimation function| Swiper object| AmazonPolly object| Highlighter object| Magnifier object| TableOfContents object| Tooltip object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| google_tag_manager object| google_tag_data function| postscribe object| google_tag_manager_external function| addCaptchaScript object| gaGlobal object| Cookies object| analytics string| _linkedin_partner_id object| _linkedin_data_partner_ids function| lintrk function| clarity object| zi string| ZIProjectKey number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| expireIn function| OptanonWrapper object| otEventListeners object| regexThatChecksForEmail function| calibermindCaptureSubmit function| calibermindAddFormListener number| r object| webpackChunk_ion_builder_server object| __SEGMENT_INSPECTOR__ object| OtTrustedType object| Demandbase function| ga boolean| _already_called_lintrk object| ORIBILI function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| MunchkinTracker string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| Optanon object| OneTrust object| _tvq object| zitag object| ZILogs function| loadZILogs function| errorHandler object| _zi_fc object| regeneratorRuntime object| _zi object| _ziziws object| ziws

54 Cookies

Domain/Path Name / Value
.go.sentinelone.com/ Name: __cf_bm
Value: 26X0iG1Jksovva8_78WAY_4nzSp0S8OYOC1tnXE4Q2c-1730931566-1.0.1.1-zTDuPiAhwNfJr4yZYbKm6nI93Hrh7qQDyzI_AhF5AynVTsDdg7hCWxRdmRN.hPmSr21H8L2jtfE9CWkrCRlfnw
.onesignal.com/ Name: __cf_bm
Value: JPS.RId4IeokTIPWgz4VZrvyAxUTAu5MYQMJnR2__Yg-1730931567-1.0.1.1-GdxFP87KCSOeknI9Eoz5HzRo4FcqePH4vHJY1ckw9gCDJtH9peQK5amR27sE7XWMtGqU4AEKgt8FjH6CsqawUA
.youtube.com/ Name: YSC
Value: 2chx-dOIFmk
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: jNN2R3ICx-Q
.youtube.com/ Name: VISITOR_PRIVACY_METADATA
Value: CgJDQRIEGgAgGA%3D%3D
.sentinelone.com/ Name: _ga_KJPGLC9EVP
Value: GS1.1.1730931567.1.0.1730931567.60.0.0
.sentinelone.com/ Name: _ga
Value: GA1.1.859586636.1730931567
.sentinelone.com/ Name: _gcl_au
Value: 1.1.1521246621.1730931567
go.sentinelone.com/ Name: BIGipServerab14web-nginx-app_https
Value: !HofjHAKkk1rNcFrTY1tgvhyyRs2fVzkP433neItHDJOe36nL785C1OVRjgN0EX96/8kiIjeHBmfq2TI=
.sentinelone.com/ Name: ajs_anonymous_id
Value: 39e8afc4-8943-4d3e-a1b9-edf87f60b7d9
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%2FnUUdvQbtnS6E0OP2Fmz54
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-a2b16bcd-fd59-5f96-585f-b23182920362.hgDOA52uEDsvLLS8wHBk1%2FnUUdvQbtnS6E0OP2Fmz54
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AorFrzf1ZX5ZYX7IxgpIDYqdy0Wc.SPXDt9tHLKKGBgsRIME1P3Dp860tMQpLFWsgWKQRpmo
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQg79avuQYwAToEQiu0oEIEaVknmg.oNqLpLVvmzqYRR77SzFE8C0gqAUcMpktliypa2lO2dU
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIPiNVVVjf4Tl9IQr6-i1WViXVQEozW0CRQSMhmC6a0aAENYBGAQg79avuQYwAToEQiu0oEIEaVknmg.oNqLpLVvmzqYRR77SzFE8C0gqAUcMpktliypa2lO2dU
www.clarity.ms/ Name: CLID
Value: ee147ef84a72417cb7e7b69b8f16f0dd.20241106.20251106
.doubleclick.net/ Name: ar_debug
Value: 1
.doubleclick.net/ Name: IDE
Value: AHWqTUkz12HKQvVcJQtJ7kwgEdljGM0vet8ZGrWmW8__9rFV_AiMwZ7ic4qSelW8
.sentinelone.com/ Name: _mkto_trk
Value: id:327-MNM-087&token:_mch-sentinelone.com-1730931567679-47431
.sentinelone.com/ Name: _clck
Value: 1fh0pnl%7C2%7Cfqn%7C0%7C1771
.rlcdn.com/ Name: rlas3
Value: nmRY7jCeyXC8DaFGTHd0DSI7nHfmhsZt7D/qqqqpJpo=
.doubleclick.net/ Name: receive-cookie-deprecation
Value: 1
.company-target.com/ Name: tuuid
Value: 2367b4a7-0ebc-497c-a84a-94d4e624f7ef
.company-target.com/ Name: tuuid_lu
Value: 1730931567|ix:0|mctv:0|rp:0
.adnxs.com/ Name: XANDR_PANID
Value: AntTfP3-GUYWjFPmtCbUw2XW6Z3U-c6kzmPrMPw8Po89Ga7-EEq1AcZSTKoo-nNsQ8peh6d1ZaxAdSFeFFhOg3tad1ecO5WLtIyS_nDz5iw.
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
.adnxs.com/ Name: uuid2
Value: 4188232049878062920
.rlcdn.com/ Name: pxrc
Value: CO/Wr7kGEgUI6AcQABIGCMrdKhAA
.linkedin.com/ Name: lidc
Value: "b=VGST06:s=V:r=V:a=V:p=V:g=3126:u=1:x=1:i=1730931567:t=1731017967:v=2:sig=AQGgNT_xrYrsln-IhWpTeCa4T-9BQdBc"
.casalemedia.com/ Name: CMID
Value: Zyvrb0t3ue4AAHyFAS6RMAAA
.casalemedia.com/ Name: CMPS
Value: 1306
.casalemedia.com/ Name: CMPRO
Value: 1306
.linkedin.com/ Name: bcookie
Value: "v=2&2675175a-5afd-4ad1-8ae0-90b4f71ea545"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MzA5MzE1Njc7MjswMjH5xeL0gHLIuG5XQFOKtcpL5gu7PTUtdTEN4wo2lHA3Qg==
.sentinelone.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Wed+Nov+06+2024+14%3A19%3A27+GMT-0800+(Pacific+Standard+Time)&version=202409.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fblack-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor%2F&groups=C0003%3A1%2CC0001%3A1%2CC0002%3A1%2CC0004%3A1
.tremorhub.com/ Name: tvid
Value: 39290dd4d9d7465e886bed3503b8adbd
.tremorhub.com/ Name: tv_UIDM
Value: 2367b4a7-0ebc-497c-a84a-94d4e624f7ef
.rubiconproject.com/ Name: audit_p
Value: 1|J52SJXsdXp5UR9fFSg8XgdldgZeLReBPjD2CtWV804o3Sds8s51Nz28ZgFR191BIqckHefpcnVeM1KxoLazIt5mwZQnb46mpakSEPRRelA5Cbzh4LQ1sIvb2L3/sIxb7IsXOQVeNpqWX/CMwZqckQyVJBuMrZvefcmESKmf2cwrTmoFL5pKQsaZr5ZVxLWDe
.rubiconproject.com/ Name: khaos
Value: M36FYPML-7-3H4U
.rubiconproject.com/ Name: khaos_p
Value: M36FYPML-7-3H4U
.rubiconproject.com/ Name: audit
Value: 1|J52SJXsdXp5UR9fFSg8XgdldgZeLReBPjD2CtWV804o3Sds8s51Nz28ZgFR191BIqckHefpcnVeM1KxoLazIt5mwZQnb46mpakSEPRRelA5Cbzh4LQ1sIvb2L3/sIxb7IsXOQVeNpqWX/CMwZqckQyVJBuMrZvefcmESKmf2cwrTmoFL5pKQsaZr5ZVxLWDe
.rubiconproject.com/ Name: receive-cookie-deprecation
Value: 1
.sentinelone.com/ Name: _clsk
Value: 63mkcf%7C1730931568035%7C1%7C1%7Cb.clarity.ms%2Fcollect
.www.sentinelone.com/ Name: _zitok
Value: 0393f77b6ebe3b7c97e31730931568
.bing.com/ Name: MUID
Value: 31144A33CC846DD730475F1CCD526C11
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 31144A33CC846DD730475F1CCD526C11
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 31144A33CC846DD730475F1CCD526C11
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0
.zoominfo.com/ Name: __cf_bm
Value: ..x1.4vMRfHPumM4gg4f8APbJS9zr_3f5FJL4m23iRA-1730931568-1.0.1.1-VCz.5iit2kosnABJtzuvolCCYMPZPjFgIN_WRnVGIxhyYMNqZEM_aOjqG27y4F7EOFLE8T7hXig0gO.SMZxSmw
.zoominfo.com/ Name: _cfuvid
Value: PFa270PkUbQrqrF.91HtaBfYCz.SoMEtY0fNMfAWMTc-1730931568831-0.0.1.1-604800000

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy object-src 'none'; script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/ https://tags.srv.stackadapt.com/events.js https://js.storylane.io/ https://qvdt3feo.com/ https://javascript.heeet.io/ https://api.brightfunnel.com https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/ https://geolocation.onetrust.com/ https://js-agent.newrelic.com/ https://www.gstatic.com/ https://tag.demandbase.com/ https://cdnjs.com/libraries/Chart.js js.knock-ai.com https://www.clarity.ms https://js.zi-scripts.com/ https://ws.zoominfo.com/ https://tags.clickagy.com/ blob: https://ws-assets.zoominfo.com/ https://app.optimizely.com/ https://cdn.optimizely.com/ https://logx.optimizely.com/ https://pagead2.googlesyndication.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost https://a23gjzphzj.execute-api.us-east-1.amazonaws.com/;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13115870.fls.doubleclick.net
327-mnm-087.mktoresp.com
ad.doubleclick.net
ajax.googleapis.com
analytics.google.com
api.company-target.com
attr.ml-api.io
b.clarity.ms
bam.nr-data.net
c.bing.com
c.clarity.ms
ca.knock-ai.com
cdn.calibermind.com
cdn.cookielaw.org
cdn.onesignal.com
collector-5527.tvsquared.com
e.calibermind.com
geolocation.onetrust.com
go.sentinelone.com
id.rlcdn.com
img.onesignal.com
js-agent.newrelic.com
js.knock-ai.com
js.zi-scripts.com
munchkin.marketo.net
onesignal.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.company-target.com
s.ml-attr.com
s1.ai
secure.adnxs.com
segments.company-target.com
snap.licdn.com
stats.g.doubleclick.net
tag-logger.demandbase.com
tag.demandbase.com
tags.srv.stackadapt.com
td.doubleclick.net
ws-assets.zoominfo.com
ws.zoominfo.com
www.clarity.ms
www.google.ca
www.google.com
www.googletagmanager.com
www.sentinelone.com
www.youtube.com
104.16.117.43
104.16.118.43
104.16.160.145
104.17.111.223
104.17.71.206
104.26.3.18
13.107.42.14
13.249.39.126
142.251.163.149
142.251.167.94
142.251.179.104
162.247.243.29
172.253.63.148
172.64.150.44
172.67.213.149
18.160.10.55
192.28.144.124
20.110.205.119
23.13.172.203
2600:1408:c400:5::17c7:3719
2600:9000:2009:400:1d:8d6d:3b40:93a1
2600:9000:27c5:b600:5:7a81:86c0:93a1
2602:816:5001::39
2606:4700:3031::ac43:d595
2606:4700:4400::ac40:9b77
2606:4700::6812:572a
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c0b::71
2607:f8b0:4004:c19::61
2607:f8b0:4004:c19::79
2607:f8b0:4004:c1d::9d
2607:f8b0:4004:c1f::5d
2607:f8b0:4004:c21::9c
2620:1ec:21::14
2620:1ec:29:1::40
2620:1ec:c11::237
34.246.141.114
34.49.80.229
34.96.71.22
35.244.154.8
4.153.129.168
52.44.251.75
52.72.49.79
68.67.153.60
68.67.179.87
99.84.191.47
02eb86b1afc2418800ab2c95f1d6e9a7869c05d9df41518ef2d25a6bc6e6b496
03a716d58d312f56961da36cf9e9bd2694ba3d0fa9b18c5ebe271d7021b82953
09fa04e84d7038cc32f19bedcba454b9e637a35f4de496e8ec9148c47550f0fc
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
1c570dd4adca2dfe60c33196ca65c06ecab4a580b494816003e123c7d813d701
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
34e435ba7c6172be5ab366a13b6df04fec9078cf076dadd56aac48b54463efff
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3b81f8a05f7c0bd15d528cf8fded1822a4b5237dee76a330bba8d4fc76de0acf
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
444c83e95470e69f7355fcdb3a370c872025ae298b139090ff9f194ce28dea5b
49840572633a54f7cdd62fda23341a36ab335e287e7a3222ef752647eb62ff4c
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57548881a0adbea15099a997653dbe9d9858f4d290dc3ee1c2142d583564b908
575eff3e047a9c0474b49fcda2be6d87ae4b9f54a06f021a1be27951e8e6d33c
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
57d030752d740552eb7759a0dd8e487e96ca86b03c0aa53a7e2b1c213ae74f5f
5b1fc434d56eaa7f42c4d97a9c4b0e106f95d4453b8b7fa0a665ec5b79d7409e
5e43a9e7c42b23467f4766b5dc3a85f8ac62c75c2d5c064dd0c0d6205b287961
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
61721c8ccac413f9c55dede65a99c739ff8bf68c423fdbb918bd80d9bc4c9fa3
63cd24d04294b61c92cb8067fa817765c14bb0e2447c6fe2ff563d9bc8758f3d
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
67418e79f1c8689e34cd9c68f1d5300f627d85e59c22d70abf8cde80b02067b9
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b1d18a296f4611913546e212081fc56b9f159e3c32cab3be4d61c986e25b742
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
70d8757cbcd44c70eba77893311cae6e68e09ae1ed511f92de25eab17de837e8
7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d
747e3532aaad5b5b6e6c81707e418887e00ab1a4fcdf40eb100277e9d8c667a8
758b336b8291c58c944b1d40afd4469609c946ac427f33baac4ea0d5c2ed6fdd
785d3e9ea187b7242e1a4365a48c3fd95dd7a469245d24c6769b8d46c4ef4b81
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
7bfd314ec46e5dc42fbf2037344e20bb95068e0f972aaf26707a4afaaaea6da0
7d9c9ad349c47e81a545ff3e3bdb0a8df5ebe959da9b52cadd9440d92f7ef359
8685640e0a4781c6e2e1951484111c44c980b88b795c5e29baa8dbd471f76448
8a7bd60efabec86bdf29c93ed75d715855ba70b44e2142b07f55810e6f82f009
8e30a001c8ab4307b5505c297c883e69f506828d17f1b1c2e8f0bccaec67b256
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a7612cda562abb7a2e8ba8ff60d66230e02077e218980f4293422ce4c8e0369c
a8242b675ce39cfb1121740543c6e812490465c7c63858f7c77bcf217fcd4433
ab729c30cf1f421e9f8d2f9d8a6f5981fc906e90da32d5a46c7cbbf251fe8af3
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
b1bb78c75db84dbd958fc653c0ff6e461e54352cfe41f0cfecff995efb1f21ac
b5580705563824650857de2856ef8469e280ab28a55ab75dbf7c2b45e53ac59c
bfeecc3034987d97b185701cb80e3e420bbc211ba7ea1752843d5152cb8da6b4
c30dc39ff7449779c568ff4e90c170f01eae00486dc5b5e6595656d0c517439a
c3a2f8ef206c54e505719cbdfe2f7c5732d80d4e01ab277b2f869acb3d062497
c5589064355e3df666b6be1e23c86166dfdac76c7f58d08ed867331fdbb4fe7c
c8b81758ce4608b0cd9f70e49b12312e033d091a403d516e043ff1f73b2f494a
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
d26226754134e57412525e87dc59530be3578c86559efd7b4389cd629a8d74ef
d459609c962a9c19deba4ab0fd5769f7e103b76a084060e26e0e061423890ea5
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
db0da7efe3ac5fc9e598f71e291326f137ea7bbbf97fed4fee0e86b717b0d9a8
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
e0e0b123a376224e1c89fdcfa3e52fef35ea4aeb81aa9242259d96cda0fc5357
e189b6269fc9c19343d172b50d26939bc988ba9ee4b75bd7e39268ce9926c05b
e2afa04c9a3e080712c94d68b9c1d33587fddcbaeaba9dfcaf1d53d19f6a280a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
ec8b1b07980996f574075e1b7e895d5d47794b9dcf345a68d60fbb17034f7bef
ee98439c11ee9f2eaece7971d414049ec4089f484c21bef2c3145533592098ba
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f144e3bc13095ce7d1b638b1b2cc50b52cd12312cba1323706f6e71e8ded1e2c
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
f4dad8bf6c29fb933217ee639b0d17fb9434ac6616f18ecb69b830e6c72c511c
f50dff16f81cf8eefabad78c1bd298fe5e7571e51720cb114575a1b4e8aba26a
f601ad00963b4f8991efe50bc64dbd186844e7b8974988495fca679e442f60ea
f6176412e6ec98f573b845121d5285acacd2d7025d54a4516543a52ec52303ba
f97c33a0d47b04256842d5e0fe975b4d6a6dd91ad35de032f9df63d0dbef1816
fb99553fb6be234b2b6a0ac32f16922f5a3b746578f4879b81c1c3bf861db4f7
fc11ae1919d2e054d5af3535739aaa85f73f873bc49253cfd54ac332fdcfd94f