Submitted URL: https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Dexter-Malware--Getting-Your-Hands-Dirty/
Effective URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Submission: On June 23 via api from US — Scanned from GB

Summary

This website contacted 49 IPs in 9 countries across 41 domains to perform 159 HTTP transactions. The main IP is 52.151.96.240, located in London, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is www.trustwave.com. The Cisco Umbrella rank of the primary domain is 476014.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on November 17th 2022. Valid for: a year.
This is the only time www.trustwave.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 22 52.151.96.240 8075 (MICROSOFT...)
16 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
12 2a02:26f0:780... 20940 (AKAMAI-ASN1)
6 2a00:1450:400... 15169 (GOOGLE)
3 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 162.159.138.60 13335 (CLOUDFLAR...)
1 2.19.224.115 16625 (AKAMAI-AS)
4 204.79.197.234 8068 (MICROSOFT...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 2606:2800:133... 15133 (EDGECAST)
5 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
9 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.239.171.228 8075 (MICROSOFT...)
2 104.102.38.132 16625 (AKAMAI-AS)
3 2001:4860:480... 15169 (GOOGLE)
2 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 146.75.116.157 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
2 4 142.250.186.166 15169 (GOOGLE)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 2 151.139.128.10 20446 (STACKPATH...)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 104.244.42.197 13414 (TWITTER)
2 104.244.42.131 13414 (TWITTER)
2 2600:9000:217... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 199.15.214.243 15224 (OMNITURE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.222.169.121 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f17... 32934 (FACEBOOK)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2603:1020:100... 8075 (MICROSOFT...)
1 15.197.193.217 16509 (AMAZON-02)
1 13.32.145.123 16509 (AMAZON-02)
2 2603:1040:150... 8075 (MICROSOFT...)
2 2a01:111:f100... 8075 (MICROSOFT...)
11 2606:4700::68... 13335 (CLOUDFLAR...)
2 13.69.106.212 8075 (MICROSOFT...)
159 49
Apex Domain
Subdomains
Transfer
22 trustwave.com
www.trustwave.com — Cisco Umbrella Rank: 476014
405 KB
16 cookiepro.com
cookie-cdn.cookiepro.com — Cisco Umbrella Rank: 6742
205 KB
12 azureedge.net
trustwave.azureedge.net
231 KB
11 hubspot.com
track.hubspot.com — Cisco Umbrella Rank: 2462
7 KB
11 gstatic.com
www.gstatic.com
fonts.gstatic.com
1 MB
9 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 4470
forms-na1.hsforms.com — Cisco Umbrella Rank: 7472
37 KB
9 google.com
www.google.com — Cisco Umbrella Rank: 3
region1.analytics.google.com — Cisco Umbrella Rank: 2890
adservice.google.com — Cisco Umbrella Rank: 107
30 KB
7 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 57
10419288.fls.doubleclick.net
9785483.fls.doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 124
5 KB
6 footprintdns.com
847c3546cc49055feb7d840226086038.azr.footprintdns.com
788e8429e27e8b9da94d34e0b77c6a6b.azr.footprintdns.com
172eb9c9bd1371270bc54b2ba963aa33.azr.footprintdns.com
1 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 408
www.linkedin.com — Cisco Umbrella Rank: 563
px4.ads.linkedin.com — Cisco Umbrella Rank: 6542
5 KB
5 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 80
4 KB
5 hsforms.net
js.hsforms.net — Cisco Umbrella Rank: 7235
822 KB
4 atmrum.net
www.atmrum.net — Cisco Umbrella Rank: 40036
4 KB
3 google.co.uk
www.google.co.uk — Cisco Umbrella Rank: 2779
669 B
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
70 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 263
31 KB
2 visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 687
306 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 101
236 B
2 terminus.services
vidassets.terminus.services — Cisco Umbrella Rank: 22885
wec-assets.terminus.services — Cisco Umbrella Rank: 19700
12 KB
2 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4971
forms.hscollectedforms.net — Cisco Umbrella Rank: 5088
26 KB
2 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2377
127 KB
2 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1027
733 B
2 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 721
634 B
2 t.co
t.co — Cisco Umbrella Rank: 504
600 B
2 mouseflow.com
cdn.mouseflow.com — Cisco Umbrella Rank: 7442
57 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 176
115 KB
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 960
6 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 4000
7 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82
182 KB
2 hs-scripts.com
js-na1.hs-scripts.com — Cisco Umbrella Rank: 8622
2 KB
1 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 375
265 B
1 hubapi.com
api.hubapi.com — Cisco Umbrella Rank: 3763
1 KB
1 hsadspixel.net
js.hsadspixel.net — Cisco Umbrella Rank: 3542
3 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2379
21 KB
1 mktoresp.com
815-rfm-693.mktoresp.com
121 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 768
15 KB
1 windows.net
trustwave.blob.core.windows.net
10 KB
1 msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2417
22 KB
1 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 2353
361 B
1 vimeo.com
player.vimeo.com — Cisco Umbrella Rank: 2001
12 KB
1 fonts.net
fast.fonts.net — Cisco Umbrella Rank: 3877
159 41
Domain Requested by
22 www.trustwave.com 4 redirects www.trustwave.com
az416426.vo.msecnd.net
16 cookie-cdn.cookiepro.com www.trustwave.com
cookie-cdn.cookiepro.com
az416426.vo.msecnd.net
12 trustwave.azureedge.net www.trustwave.com
trustwave.azureedge.net
11 track.hubspot.com
8 forms.hsforms.com az416426.vo.msecnd.net
www.trustwave.com
6 fonts.gstatic.com www.trustwave.com
www.google.com
6 www.google.com www.trustwave.com
www.gstatic.com
www.google.com
5 www.gstatic.com www.google.com
www.gstatic.com
5 fonts.googleapis.com trustwave.azureedge.net
js.hsforms.net
5 js.hsforms.net www.trustwave.com
js.hsforms.net
4 www.atmrum.net www.trustwave.com
www.atmrum.net
az416426.vo.msecnd.net
3 px.ads.linkedin.com 3 redirects
3 www.google.co.uk www.trustwave.com
3 www.google-analytics.com www.googletagmanager.com
az416426.vo.msecnd.net
3 cdnjs.cloudflare.com www.trustwave.com
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 172eb9c9bd1371270bc54b2ba963aa33.azr.footprintdns.com www.trustwave.com
2 788e8429e27e8b9da94d34e0b77c6a6b.azr.footprintdns.com www.trustwave.com
2 847c3546cc49055feb7d840226086038.azr.footprintdns.com www.trustwave.com
2 www.facebook.com www.trustwave.com
2 adservice.google.com 9785483.fls.doubleclick.net
10419288.fls.doubleclick.net
2 js.hs-banner.com js-na1.hs-scripts.com
2 cdn.linkedin.oribi.io az416426.vo.msecnd.net
2 analytics.twitter.com www.trustwave.com
2 t.co www.trustwave.com
2 stats.g.doubleclick.net www.googletagmanager.com
az416426.vo.msecnd.net
2 cdn.mouseflow.com 1 redirects www.trustwave.com
2 connect.facebook.net www.trustwave.com
connect.facebook.net
2 9785483.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 10419288.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 munchkin.marketo.net trustwave.azureedge.net
munchkin.marketo.net
2 www.googletagmanager.com www.trustwave.com
www.googletagmanager.com
2 js-na1.hs-scripts.com www.trustwave.com
www.googletagmanager.com
1 wec-assets.terminus.services www.trustwave.com
1 match.adsrvr.org www.trustwave.com
1 forms.hscollectedforms.net az416426.vo.msecnd.net
1 api.hubapi.com az416426.vo.msecnd.net
1 forms-na1.hsforms.com www.trustwave.com
1 vidassets.terminus.services www.googletagmanager.com
1 js.hscollectedforms.net js-na1.hs-scripts.com
1 js.hsadspixel.net js-na1.hs-scripts.com
1 js.hs-analytics.net js-na1.hs-scripts.com
1 815-rfm-693.mktoresp.com munchkin.marketo.net
1 px4.ads.linkedin.com www.trustwave.com
1 www.linkedin.com 1 redirects
1 region1.analytics.google.com www.googletagmanager.com
1 googleads.g.doubleclick.net www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 trustwave.blob.core.windows.net www.trustwave.com
1 az416426.vo.msecnd.net www.trustwave.com
1 s7.addthis.com www.trustwave.com
1 player.vimeo.com www.trustwave.com
1 fast.fonts.net www.trustwave.com
159 54
Subject Issuer Validity Valid
www.trustwave.com
DigiCert TLS RSA SHA256 2020 CA1
2022-11-17 -
2023-11-16
a year crt.sh
cookiepro.com
Cloudflare Inc ECC CA-3
2023-03-20 -
2024-03-19
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-05 -
2024-05-04
a year crt.sh
*.azureedge.net
Microsoft Azure TLS Issuing CA 05
2023-05-17 -
2024-05-11
a year crt.sh
www.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert TLS RSA SHA256 2020 CA1
2023-02-07 -
2024-02-07
a year crt.sh
atmrum.net
Microsoft Azure TLS Issuing CA 06
2023-04-18 -
2024-04-12
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA
2023-05-05 -
2024-04-28
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-22 -
2023-08-22
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-04-01 -
2023-06-30
3 months crt.sh
www.google.co.uk
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1
2022-11-14 -
2023-11-14
a year crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-01 -
2023-10-01
a year crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.terminus.services
Amazon RSA 2048 M01
2023-02-22 -
2023-11-14
9 months crt.sh
hubapi.com
Cloudflare Inc ECC CA-3
2023-04-07 -
2024-04-06
a year crt.sh
*.footprintdns.com
Microsoft Azure TLS Issuing CA 02
2023-06-12 -
2024-06-06
a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
hubspot.com
Cloudflare Inc ECC CA-3
2023-02-05 -
2024-02-05
a year crt.sh
in.applicationinsights.azure.com
Microsoft Azure TLS Issuing CA 05
2023-04-20 -
2024-04-14
a year crt.sh

This page contains 9 frames:

Primary Page: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Frame ID: 87A38A3463EFAD84C14903C43677CE1E
Requests: 138 HTTP requests in this frame

Frame: https://10419288.fls.doubleclick.net/activityi;dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F
Frame ID: F6C62E03396EBC63CC41DC0B7FB50206
Requests: 2 HTTP requests in this frame

Frame: https://9785483.fls.doubleclick.net/activityi;dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F
Frame ID: EB98A17F3D0210711082FCDD82C9F6BC
Requests: 2 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/embed/v2.js
Frame ID: 0E7C5A98D85B0D91A7ABAAA55737DAF8
Requests: 2 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/embed/v2.js
Frame ID: A9697201351F0AA2A275E5702775C1D9
Requests: 2 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/embed/v2.js
Frame ID: 6AAB0C4499A383F18E290F571C3006B1
Requests: 2 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/embed/v2.js
Frame ID: 0326068CBF5D7A952A0F35FD62981D72
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
Frame ID: 4902E91E72966354703C0038D5CEFA99
Requests: 7 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 4EDA2493AC31C9A7517A00C19C29BD1E
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

The Dexter Malware: Getting Your Hands Dirty | Trustwave | SpiderLabs | TrustwaveBack ButtonSearch IconFilter IconBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

  1. https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Dexter-Malware--Getting-Your-Hands-Dirty/ HTTP 301
    https://www.trustwave.com/resources/spiderlabs-blog/the-dexter-malware--getting-your-hands-dirty/ HTTP 301
    https://www.trustwave.com/resources/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/ HTTP 301
    https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • addthis\.com/js/

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.mouseflow\.com

Overall confidence: 100%
Detected patterns
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

159
Requests

98 %
HTTPS

66 %
IPv6

41
Domains

54
Subdomains

49
IPs

9
Countries

3640 kB
Transfer

9886 kB
Size

33
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Dexter-Malware--Getting-Your-Hands-Dirty/ HTTP 301
    https://www.trustwave.com/resources/spiderlabs-blog/the-dexter-malware--getting-your-hands-dirty/ HTTP 301
    https://www.trustwave.com/resources/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/ HTTP 301
    https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49
  • https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
Request Chain 61
  • https://10419288.fls.doubleclick.net/activityi;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F HTTP 302
  • https://10419288.fls.doubleclick.net/activityi;dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F
Request Chain 62
  • https://9785483.fls.doubleclick.net/activityi;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F HTTP 302
  • https://9785483.fls.doubleclick.net/activityi;dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F
Request Chain 64
  • https://cdn.mouseflow.com/projects/96dff353-a928-44b4-b1d0-6432c69133ba.js HTTP 301
  • https://cdn.mouseflow.com/projects/96dff353-a928-44b4-b1d0-6432c69133ba_eu.js
Request Chain 80
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26time%3D1687527208676%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen-us%252Fresources%252Fblogs%252Fspiderlabs-blog%252Fthe-dexter-malware-getting-your-hands-dirty%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&cookiesTest=true&liSync=true&e_ipv6=AQLw7_tncMQ7DgAAAYjodbnmC9V38jlVknCzRTAqsstZ3gI1sBdCTjb90YWQqlhgTSyX

159 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Redirect Chain
  • https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Dexter-Malware--Getting-Your-Hands-Dirty/
  • https://www.trustwave.com/resources/spiderlabs-blog/the-dexter-malware--getting-your-hands-dirty/
  • https://www.trustwave.com/resources/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
  • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
101 KB
21 KB
Document
General
Full URL
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5615de849cb183806fc73839e8794e965d563d0ac22b20529b1bff2b6630cfeb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

cache-control
no-cache
content-encoding
gzip
content-length
21106
content-type
text/html; charset=utf-8
date
Fri, 23 Jun 2023 13:33:27 GMT
expires
-1
pragma
no-cache
server
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-aspnet-version
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

cache-control
no-cache
content-length
231
content-type
text/html; charset=utf-8
date
Fri, 23 Jun 2023 13:33:26 GMT
location
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
server
strict-transport-security
max-age=31536000; includeSubDomains
x-aspnet-version
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
otSDKStub.js
cookie-cdn.cookiepro.com/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/otSDKStub.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0be44b8963766e88bfb1034f5cf93deb8710ec30e7a54537ff463951c5976234
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
0mEq0pw2uQHv5iDD8WI5Bw==
age
73701
x-ms-lease-status
unlocked
last-modified
Fri, 09 Jun 2023 01:34:35 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
8efd431d-301e-006b-4a38-9bbfb9000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a57bf2848c8-LHR
expires
Sat, 24 Jun 2023 13:33:27 GMT
9c85e15b-99ed-40a4-929d-2262f9ed2706.css
fast.fonts.net/cssapi/
0
0
Stylesheet
General
Full URL
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:e14e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

legacy.min.css
trustwave.azureedge.net/dist/css/
265 KB
35 KB
Stylesheet
General
Full URL
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
4e01c98e627574457dc4a7251f0b5a3d8ca22fc72fe7127db1ebd63e36a06a70

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:27 GMT
content-encoding
gzip
last-modified
Tue, 28 Jun 2022 16:24:08 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
tG3mqBdm+eKsTXR9yDZSNQ==
etag
0x8DA5922A0B0456D
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
b7153196-401e-0070-0341-8ed751000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
35618
styles.min.css
www.trustwave.com/dist/css/
150 KB
35 KB
Stylesheet
General
Full URL
https://www.trustwave.com/dist/css/styles.min.css?id=1037
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
68e318c58c5a8e85cf16359b0897e1766a64528353a5db53843a4dffbf097baf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:27 GMT
last-modified
Tue, 20 Jun 2023 04:20:20 GMT
server
x-aspnet-version
etag
"05a3b862ea3d91:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
content-length
35364
x-xss-protection
1; mode=block
feather.css
www.trustwave.com/dist/css/
315 B
361 B
Stylesheet
General
Full URL
https://www.trustwave.com/dist/css/feather.css?id=1037
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4e5ab440329cd7d94538bc256cd00097682d6dcfb803cc0e9e64cfab683831dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:27 GMT
last-modified
Tue, 20 Jun 2023 04:20:20 GMT
server
x-aspnet-version
etag
"05a3b862ea3d91:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
content-length
263
x-xss-protection
1; mode=block
api.js
www.google.com/recaptcha/
850 B
876 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
092a690c556396c5c85bb83728e427187415bcc74a7be26c340d0d3affd70129
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
556
x-xss-protection
1; mode=block
expires
Fri, 23 Jun 2023 13:33:27 GMT
api.js
www.google.com/recaptcha/
884 B
655 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?render=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
68ef234d3e989dcdfb6bfc9e7f2a14a6d2638181575d2cf7a820ab52ee6452b8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
586
x-xss-protection
1; mode=block
expires
Fri, 23 Jun 2023 13:33:27 GMT
trustwave-logo-color.svg
trustwave.azureedge.net/dist/svg/logos/trustwave/
3 KB
3 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/logos/trustwave/trustwave-logo-color.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
eec92db3906701a283982a9ea481e806b6fd01fb2efb2c802cba1c376b19c2f5

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:09 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
dve3eUlE6WumX3xgQyGMDA==
etag
0x8DA5922A14A2267
content-type
image/svg+xml
x-ms-request-id
8ecdf408-301e-007a-437a-8d73e6000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
2788
fusion-logo-color.svg
trustwave.azureedge.net/dist/svg/logos/fusion/
9 KB
9 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/logos/fusion/fusion-logo-color.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a76b2bc12b0e3c9536c8c0c3af4170cc66c19ff44fb96326aa6b542ee272365f

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:09 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
PEBEe6TBHJ1Si1foIhaJWA==
etag
0x8DA5922A1061FA4
content-type
image/svg+xml
x-ms-request-id
cd9e9b77-001e-0085-117a-8d437b000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
9083
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/
84 KB
27 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.min.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
2047904
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27139
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-15145"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z67c1VSGyrwXZhXT83U5sUvoElwMV4%2BhpWSbc4PHI0lNJY3zGsrbLlVuWc9S806tTITbwa1zN2bPHYPNe%2BSy8VI4ShU3jaomncdsbQT3Zi%2Bdigx1WVWjcb1iGycJ%2F%2FIYieSfVsygB2saM6FUM2riu81j"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7dbd1a5a0f757726-LHR
expires
Wed, 12 Jun 2024 13:33:28 GMT
jquery.modal.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/
5 KB
2 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
33583
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1399
last-modified
Mon, 04 May 2020 16:11:46 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec2-1359"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HSQTawb43eu1g2iL4%2B4jZhOoa21wonWvv8fer13VMGLr0FpDfEY37Ml%2FcwxdVE53eUpVAEFESHdhz6cSTEL3Bb%2BANAsGXqgxo2x8YJ7u0oUDdORdiXhbSQn7Z2hWBtEc1gucDwWltEOZDFx7dWN0cuGi"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7dbd1a5a68177726-LHR
expires
Wed, 12 Jun 2024 13:33:28 GMT
jquery.modal.min.css
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/
3 KB
2 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
4912144
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1541
last-modified
Mon, 04 May 2020 16:11:46 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec2-c81"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uH714GIRzBSuRjD1U%2FTEtlfR5Owj6bPt1NLdLAAsJSPiCnL03Xf2NfEvaI37OeqxWG7%2BUsjTZbgdn3D5%2FnWxccyMYlJlw8dlnJLqewcd5Bbe5nthx7qE5lPGFXCf%2F9vJ%2F3qJ4CM5vTaYl%2B29qSrqyXnL"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7dbd1a5a98627726-LHR
expires
Wed, 12 Jun 2024 13:33:28 GMT
v2.js
js.hsforms.net/forms/embed/
526 KB
165 KB
Script
General
Full URL
https://js.hsforms.net/forms/embed/v2.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bb41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
521
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dbd0da1caf924d7-LHR
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
b47313d7-1052-474d-80f7-0231be5c9502
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vbLf7HErnvUfAp93h4QkMvgRzXQ5Kwm9%2BLQYMhB7OrG8n7GAlHV4dfRRJCzwibtZS7acoJCSUbUlc7hi5yipRB3SToF6vbZOEHSPO97cncRf6unPXJon%2BI26%2Bus82ucGeYG6kUk74ulhDmuu"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray
7dbd1a5b1be823de-LHR
x-amz-cf-id
M0e2wBoTPXndtPkmA9d4EAuW8F1Lm45MMgwXqW64Ujh3EQiX2P-8XA==
twitter.svg
www.trustwave.com/img/icon/social/svg/dark/
778 B
874 B
Image
General
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/twitter.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
cf7008a1bb1e7dcffa096b3f0c782f3dd610f847413ae4861a5c03006f093553
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:21:08 GMT
server
x-aspnet-version
etag
"092d7a22ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
778
x-xss-protection
1; mode=block
linkedin.svg
www.trustwave.com/img/icon/social/svg/dark/
636 B
682 B
Image
General
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/linkedin.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
42f2f65a52347bf6ed6c0633b5458c48ddc1b439923c92caec18c6d6f111afe3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:21:08 GMT
server
x-aspnet-version
etag
"092d7a22ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
636
x-xss-protection
1; mode=block
facebook.svg
www.trustwave.com/img/icon/social/svg/dark/
446 B
492 B
Image
General
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/facebook.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3f18aeab9b9baa3e61c4bc2cd0372e3946f494bd03bff3cad740e5ea817fce2b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:21:08 GMT
server
x-aspnet-version
etag
"092d7a22ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
446
x-xss-protection
1; mode=block
82c0a146-7a70-4983-afd2-4378b6160f5c.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
127 KB
128 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/82c0a146-7a70-4983-afd2-4378b6160f5c.png?v=0.0.1
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e284ec9da0c8c1d6e7e991fbc111b1cbb682a0bc40b084c176ac1ebc43b5aab0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:20:40 GMT
server
x-aspnet-version
etag
"01c27922ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
130514
x-xss-protection
1; mode=block
7bbbd6e9-b232-408d-8aaa-6cd1b2573627.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
64 KB
64 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/7bbbd6e9-b232-408d-8aaa-6cd1b2573627.png?v=0.0.1
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e2b9de667ed27a028d643fce70755ad477a649d10d516a9cd0fb0b567e9b16d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:20:38 GMT
server
x-aspnet-version
etag
"0eff5902ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
65677
x-xss-protection
1; mode=block
3dd124c8-2afd-484e-bfb9-27cee3bd1a5d.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
43 KB
43 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/3dd124c8-2afd-484e-bfb9-27cee3bd1a5d.png?v=0.0.1
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b53419cecf347820d8fec7a6300d98dfe17fbb325d74683a8010e0a96f888e5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:20:30 GMT
server
x-aspnet-version
etag
"03b318c2ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
44070
x-xss-protection
1; mode=block
legacy.min.js
trustwave.azureedge.net/dist/js/
495 KB
152 KB
Script
General
Full URL
https://trustwave.azureedge.net/dist/js/legacy.min.js?id=1037
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
acb597f6847f2877c81754fdb6a4b483cc05516c2a87865c8d0d02307b670c65

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
last-modified
Tue, 28 Jun 2022 16:24:09 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
yG5v7s3rVw9uMb1rb1aZPA==
etag
0x8DA5922A14C9303
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
614d7be9-d01e-005d-6804-f66422000000
cache-control
public, max-age=30393641
x-ms-version
2009-09-19
content-length
154921
player.js
player.vimeo.com/api/
37 KB
12 KB
Script
General
Full URL
https://player.vimeo.com/api/player.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.159.138.60 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98e67b7c00d3ed50871865e8acf0381d72b909eb2360b56261061c9be60bde9e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-varnish-cache
1
Date
Fri, 23 Jun 2023 13:33:28 GMT
content-security-policy
default-src 'none'; style-src 'unsafe-inline'
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
CF-Cache-Status
DYNAMIC
via
1.1 varnish (Varnish/6.0), 1.1 varnish
Age
276
X-Cache
HIT
p3p
CP="This is not a P3P policy! See https://vimeo.com/privacy"
expires
Fri, 23 Jun 2023 13:31:18 GMT
x-host
player-596996844b-cjrsp
Connection
keep-alive
x-vserver
player-varnish-prod-varnish-3
Content-Length
11160
x-xss-protection
1; mode=block
X-Served-By
cache-man4131-MAN
X-Player-Backend
p
Server
cloudflare
X-Timer
S1687527208.190511,VS0,VE0
x-backend-proxy
playproxy4
Vary
Accept-Encoding
Content-Type
application/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-bapp-server
player-596996844b-cjrsp
Accept-Ranges
bytes
CF-RAY
7dbd1a5af8fa0ac9-MAN
X-Cache-Hits
103
addthis_widget.js
s7.addthis.com/js/300/
56 B
361 B
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.19.224.115 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-19-224-115.deploy.static.akamaitechnologies.com
Software
Oracle API Gateway /
Resource Hash
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
server
Oracle API Gateway
opc-request-id
/82784F912830F4A8753DF6B893FAAB68/D945F53ED05E154F3EE1B9DBC17394B8
x-frame-options
sameorigin
vary
Accept-Encoding
content-type
text/javascript
x-distribution
99
x-host
s7.addthis.com
content-length
76
x-xss-protection
1; mode=block
rum.js
www.atmrum.net/
301 B
609 B
Script
General
Full URL
https://www.atmrum.net/rum.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
80afdcdab5af95e11f8edac404947668a91582b9799723a8d5272483a010f23d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Fri, 09 Jun 2023 22:47:16 GMT
x-msedge-ref
Ref A: FA27ABF5C06247BB9B9A82D152110AB6 Ref B: MAN31EDGE0415 Ref C: 2023-06-23T13:33:28Z
etag
0x8D4FC0223F2F653
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
301
21158977.js
js-na1.hs-scripts.com/
2 KB
1 KB
Script
General
Full URL
https://js-na1.hs-scripts.com/21158977.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:883b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ade67c971739ab79fbedbc35fe91c27160b196308c28e544ead290df364b35c9

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
cf-cache-status
EXPIRED
x-hubspot-correlation-id
1c9bfa2f-676b-4115-96b8-3ec01d696c74
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
11
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
82e99d2d-fbad-41c0-a4b1-cc4a0299c17a
last-modified
Fri, 23 Jun 2023 13:26:44 GMT
server
cloudflare
x-trace
2BB32B1C5A755B94EABC308037B543833BAD984651000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
cache-control
public, max-age=30
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-nbhzm
cf-ray
7dbd1a5b1d9900a7-LHR
c7ede6b6-5518-4502-94a5-673e62cff495.json
cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/
3 KB
2 KB
XHR
General
Full URL
https://cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/c7ede6b6-5518-4502-94a5-673e62cff495.json
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
809765ad9401369a9a87159ade197a7893be54c78de5e0c1995f77efbde4a286
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:27 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
FlMWWNWt99scM6fkHGo+qw==
age
20312
x-ms-lease-status
unlocked
last-modified
Tue, 23 May 2023 05:24:03 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
9756ce2a-f01e-0016-1336-8dce9a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a58adf671e4-LHR
gtm.js
www.googletagmanager.com/
274 KB
92 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1199b8c9c9a6f7e263f73ef9c298a3ad54299871c3e2db28b19d7cd1b1010926
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
94027
x-xss-protection
0
last-modified
Fri, 23 Jun 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 23 Jun 2023 13:33:28 GMT
otBannerSdk.js
cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/
403 KB
94 KB
Script
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed3a69e3267f056582ed012f7252319adb227fed203a4781eb820ea732aa4594
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
fuN6EZWNAh2xn3yE+0HSRQ==
age
15620
x-ms-lease-status
unlocked
last-modified
Thu, 25 May 2023 07:08:27 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
6cc411c3-d01e-0011-2ddc-8ea2f9000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5a9b2f48c8-LHR
expires
Sat, 24 Jun 2023 13:33:28 GMT
css2
fonts.googleapis.com/
14 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@100;300;400;500;700;900&display=swap
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
87289efaf9cc62bd74432c4048229f1f1f1108973a99460d5676c4caa4fb4923
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 23 Jun 2023 13:33:28 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 23 Jun 2023 13:33:28 GMT
ai.0.js
az416426.vo.msecnd.net/scripts/a/
94 KB
22 KB
Script
General
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/488D) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
987
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (ama/488D)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
7642c62e-f01e-0071-18d4-a54189000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Fri, 23 Jun 2023 14:03:28 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/
427 KB
172 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
02ca49fda602d411bc21fbfa941871cd8944352e3ffb6b289b4f86eb1849a6c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 20:15:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
235085
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
175191
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:10:42 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 20:15:23 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/SglpK98hSCn2CroR0bKRSJl5/
416 KB
167 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/SglpK98hSCn2CroR0bKRSJl5/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
752d16411f4866d01a2fc6c8f984da8104367e264a8865a63714e2f8181f5a73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 19 Jun 2023 16:47:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
333988
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170572
x-xss-protection
0
last-modified
Sun, 11 Jun 2023 18:00:29 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 18 Jun 2024 16:47:00 GMT
trustwave-logo-white.svg
trustwave.azureedge.net/dist/svg/logos/trustwave/
3 KB
3 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/logos/trustwave/trustwave-logo-white.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b0f35cc025dc27ea345536d4eafc13e52fe2b1c237fd6c4150d4dbf85c323c27

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:09 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
6MtEXkwnMy6FcNENYC/dGQ==
etag
0x8DA5922A14B5AB4
content-type
image/svg+xml
x-ms-request-id
f09fa688-c01e-008a-1028-803517000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
2776
twi-radar-color.svg
trustwave.azureedge.net/dist/svg/icons/trustwave/
1 KB
2 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/icons/trustwave/twi-radar-color.svg
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a6843d5ffd9052e631f84994401389694fd86b7cff2f9910ec6a28814cbb6b03

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:12 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
GNjSQQWJRAl3TR5ibPNqMw==
etag
0x8DA5922A2CA43AF
content-type
image/svg+xml
x-ms-request-id
d3ced45e-901e-0011-083c-8ef412000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
1533
twi-cloud-lock-color.svg
trustwave.azureedge.net/dist/svg/icons/trustwave/
2 KB
2 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/icons/trustwave/twi-cloud-lock-color.svg
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
08529955a8d9e583dacd78d8ade75159e0869e25766fba0ac911d5fa3e3b234b

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:10 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
tX3lBpqGWSajnyTY7cF8lg==
etag
0x8DA5922A1B86291
content-type
image/svg+xml
x-ms-request-id
09330bb7-a01e-009c-4df9-8ec3c0000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
1770
twi-briefcase-color.svg
trustwave.azureedge.net/dist/svg/icons/trustwave/
1 KB
2 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/icons/trustwave/twi-briefcase-color.svg
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b016380c1e5281bf5629d39c1dd2d79d1d8eec45e77f69d7f101105b93e813e0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:10 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
hGlggEcUaBxKcCIx033beQ==
etag
0x8DA5922A189B913
content-type
image/svg+xml
x-ms-request-id
eaddc15b-e01e-0079-59ca-889282000000
cache-control
public, max-age=30752851
x-ms-version
2009-09-19
content-length
1289
twi-dashboard-color.svg
trustwave.azureedge.net/dist/svg/icons/trustwave/
8 KB
9 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/icons/trustwave/twi-dashboard-color.svg
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
85617163a0d798f5865addd9cb026438b1096093b4cac1838630ad93ebfdf4b4

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:10 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
acoxEKKx1R/DrtFbiOadbQ==
etag
0x8DA5922A1D77E43
content-type
image/svg+xml
x-ms-request-id
869f7fd6-101e-000f-102c-8718ca000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
8525
twi-database-color.svg
trustwave.azureedge.net/dist/svg/icons/trustwave/
1 KB
2 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/icons/trustwave/twi-database-color.svg
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
9a2b09b1bd7190df58b8462804537f71a64e447921a03e62dc16148f9c433511

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:10 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
q85KHiSPCUDrj48jT/7LXA==
etag
0x8DA5922A1DAB208
content-type
image/svg+xml
x-ms-request-id
5b44b31a-a01e-009c-60b1-9ac3c0000000
cache-control
public, max-age=30775416
x-ms-version
2009-09-19
content-length
1431
twi-email-color.svg
trustwave.azureedge.net/dist/svg/icons/trustwave/
719 B
1015 B
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/icons/trustwave/twi-email-color.svg
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b9833a558a67d159aa6139bb0b9168560a37f580ae04654ccc7b6b1ce0d75ea6

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:10 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
eVpqIsKpjw3YUN0OY6Y/Tw==
etag
0x8DA5922A1F89567
content-type
image/svg+xml
x-ms-request-id
0e5ecbba-401e-0094-5844-83d9cf000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
719
twi-managed-portal-color.svg
trustwave.azureedge.net/dist/svg/icons/trustwave/
12 KB
12 KB
Image
General
Full URL
https://trustwave.azureedge.net/dist/svg/icons/trustwave/twi-managed-portal-color.svg
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a409 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2071a3274f291c02c034caf6889a9e7267640862d6d22d348507e929534e74f3

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://trustwave.azureedge.net/dist/css/legacy.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 28 Jun 2022 16:24:11 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
MIxQ1hT8XSaqnrbBWdMTUQ==
etag
0x8DA5922A2480803
content-type
image/svg+xml
x-ms-request-id
571e36b7-b01e-0064-1e74-829f3e000000
cache-control
public, max-age=31556926
x-ms-version
2009-09-19
content-length
12197
loading-white.svg
www.trustwave.com/img/utility/
687 B
770 B
Image
General
Full URL
https://www.trustwave.com/img/utility/loading-white.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?id=1037
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4d84802c2cc3550892199289d28a046c4e1d011964c7c7f9d43bdeebecf107de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/dist/css/styles.min.css?id=1037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:21:10 GMT
server
x-aspnet-version
etag
"0bf8a42ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
687
x-xss-protection
1; mode=block
Feather.ttf
www.trustwave.com/fonts/feather/
64 KB
64 KB
Font
General
Full URL
https://www.trustwave.com/fonts/feather/Feather.ttf?sdxovp
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/feather.css?id=1037
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e103929dd758126ea4a090ff0e33b620f3ceb1b81ffad1345023c95661c84d8c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/dist/css/feather.css?id=1037
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:20:20 GMT
server
x-aspnet-version
etag
"05a3b862ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
accept-ranges
bytes
content-length
65112
x-xss-protection
1; mode=block
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuLyfMZg.ttf
fonts.gstatic.com/s/inter/v11/
296 KB
143 KB
Font
General
Full URL
https://fonts.gstatic.com/s/inter/v11/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuLyfMZg.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cddda5bfbb5cfd3c61a5ae0075a6b5719d1eca08ce1575fe1bad14fe7f79a5f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:08:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
242714
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
146696
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:40:49 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
vary
Accept-Encoding
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 18:08:14 GMT
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuI6fMZg.ttf
fonts.gstatic.com/s/inter/v11/
301 KB
153 KB
Font
General
Full URL
https://fonts.gstatic.com/s/inter/v11/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuI6fMZg.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8032d79deba14b8b207f78489b5cb3b7dd8c39e3519688988e075c30aa128157
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 20:35:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
493097
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
156504
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:30:06 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
vary
Accept-Encoding
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 20:35:11 GMT
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuFuYMZg.ttf
fonts.gstatic.com/s/inter/v11/
303 KB
155 KB
Font
General
Full URL
https://fonts.gstatic.com/s/inter/v11/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuFuYMZg.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
399275d88086e4012aa96f7769747462bee9f414f38ab6df75ac13dbc03ccfe1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:33:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
237586
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
158245
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:30:10 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
vary
Accept-Encoding
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 19:33:42 GMT
en.json
cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/f45c1dcb-4e3d-4ab0-a829-22e58a3f19f6/
44 KB
10 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/f45c1dcb-4e3d-4ab0-a829-22e58a3f19f6/en.json
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f8bc26c4789780ae3a330a2d348a7c806e3e019f852d543937745e0512d4e62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
zSu/aRykCTI2vfMfJM1amQ==
age
30402
x-ms-lease-status
unlocked
last-modified
Tue, 23 May 2023 05:24:03 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
98a02e4b-a01e-00b2-2495-92c73c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5b5a6771e4-LHR
otFlat.json
cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/otFlat.json
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa355c393e03f831dbdbcc678ba16396aab95930b1bc5b0549695d40cc955ca1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
iCAxFkQWfzfDHevR0IbBjg==
age
64920
x-ms-lease-status
unlocked
last-modified
Thu, 25 May 2023 07:08:15 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
0de38b04-101e-0021-480e-8f1c36000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5bdb2471e4-LHR
expires
Sat, 24 Jun 2023 13:33:28 GMT
otPcCenter.json
cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/v2/
61 KB
13 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/v2/otPcCenter.json
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
Nrtw9V+L/sfw1fri0BTPUA==
age
64920
x-ms-lease-status
unlocked
last-modified
Thu, 25 May 2023 07:08:17 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
2df8f15d-301e-0054-760e-8f771a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5bdb2671e4-LHR
expires
Sat, 24 Jun 2023 13:33:28 GMT
otCommonStyles.css
cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/
21 KB
4 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/otCommonStyles.css
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0c233d327541d2961f1cde9e53a6166279655f4d4041c1bc458ac1701827719
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
oWkBTLgDDXvrUsd93y/Zxg==
age
19728
x-ms-lease-status
unlocked
last-modified
Thu, 25 May 2023 07:08:33 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
64605b3e-a01e-009d-4b0e-8fcaf7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5bdb2771e4-LHR
expires
Sat, 24 Jun 2023 13:33:28 GMT
json
forms.hsforms.com/embed/v3/form/21158977/92358282-9e9e-4fe6-a21f-c30c1e55336d/
53 KB
8 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21158977/92358282-9e9e-4fe6-a21f-c30c1e55336d/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ceaac0057298644fd3fd7f2a4ccb13837823f4d63658d62e73be0cdf7b1d9c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Origin-Hublet
na1
Date
Fri, 23 Jun 2023 13:33:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
br
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
efd57c89-06ed-46c8-bc64-997fb896688c
x-evy-trace-route-service-name
envoyset-translator
Transfer-Encoding
chunked
x-envoy-upstream-service-time
16
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
02e89ccc-46cb-4bc7-9aa5-705c31c1e214
Server
cloudflare
X-Trace
2B6EB19B6F06979D82DEB992506BBE9B82F151FEDA000000000000000000
Vary
origin
Access-Control-Allow-Methods
OPTIONS, GET
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
Access-Control-Expose-Headers
X-Origin-Hublet
Access-Control-Max-Age
180
Access-Control-Allow-Credentials
false
Cache-Control
max-age=0, no-cache, no-store
X-Robots-Tag
none
Access-Control-Allow-Headers
*
CF-RAY
7dbd1a5ca9d14130-LHR
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-jkmcj
a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/
Redirect Chain
  • https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000
  • https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
9 KB
10 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
HTTP/1.1
Server
52.239.171.228 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
9998a28912966aa8ae78c7bae4b70bce32095ac4cafb972428f96c60bf374a98

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Fri, 23 Jun 2023 13:33:28 GMT
Last-Modified
Sat, 28 Jan 2023 22:26:27 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
MsdJ7/i6e4BXG2Gh7eeTmQ==
ETag
0x8DB017EB2C0DC88
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
6a433962-601e-002a-1ed7-a5b1b6000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
9529

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
server
x-aspnet-version
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuOKfMZg.ttf
fonts.gstatic.com/s/inter/v11/
297 KB
151 KB
Font
General
Full URL
https://fonts.gstatic.com/s/inter/v11/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuOKfMZg.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?id=1037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5948fc8f016a175f6dc4b0e00bc4dbbc93875315d7af4469ab7e4c0c47f4c269
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 18:34:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
154736
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
154459
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:40:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
vary
Accept-Encoding
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Jun 2024 18:34:32 GMT
MaterialIcons-Regular.woff2
www.trustwave.com/fonts/material-icons/
43 KB
43 KB
Font
General
Full URL
https://www.trustwave.com/fonts/material-icons/MaterialIcons-Regular.woff2
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?id=1037
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/dist/css/styles.min.css?id=1037
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 04:20:20 GMT
server
x-aspnet-version
etag
"05a3b862ea3d91:0"
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff2
accept-ranges
bytes
content-length
44300
x-xss-protection
1; mode=block
json
forms.hsforms.com/embed/v3/form/21158977/cfc901a2-eafd-46d4-a988-cdec75f02fd1/
53 KB
8 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21158977/cfc901a2-eafd-46d4-a988-cdec75f02fd1/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
804489be180651865e9d058dbbacfa6bb294075415c70c3bb7f75f44be8f1b00
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Origin-Hublet
na1
Date
Fri, 23 Jun 2023 13:33:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
br
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
46914be9-3339-40cd-965a-0e0a2fe6ae7e
x-evy-trace-route-service-name
envoyset-translator
Transfer-Encoding
chunked
x-envoy-upstream-service-time
18
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
77ba5c57-9b86-4054-a3a7-8f4e38f1abdc
Server
cloudflare
X-Trace
2B0F4D1C95F5230BAF32EE2FC7C342E0EE7631A00C000000000000000000
Vary
origin
Access-Control-Allow-Methods
OPTIONS, GET
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
Access-Control-Expose-Headers
X-Origin-Hublet
Access-Control-Max-Age
180
Access-Control-Allow-Credentials
false
Cache-Control
max-age=0, no-cache, no-store
X-Robots-Tag
none
Access-Control-Allow-Headers
*
CF-RAY
7dbd1a5cdc2a7743-LHR
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-jkmcj
json
forms.hsforms.com/embed/v3/form/21158977/cfc901a2-eafd-46d4-a988-cdec75f02fd1/
53 KB
8 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21158977/cfc901a2-eafd-46d4-a988-cdec75f02fd1/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
945621ea8bca0474945d87e6bb8fd741a33492c56446666a007ae09d6c6ba228
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Origin-Hublet
na1
Date
Fri, 23 Jun 2023 13:33:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
br
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
3a1d2245-6af3-4d23-9415-a559edaddbb9
x-evy-trace-route-service-name
envoyset-translator
Transfer-Encoding
chunked
x-envoy-upstream-service-time
22
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
582f5593-e00f-43c9-b920-aca40cc4864f
Server
cloudflare
X-Trace
2BD00F51C61BA3D0BC4C1EE19D24C4FB7416C6C75A000000000000000000
Vary
origin
Access-Control-Allow-Methods
OPTIONS, GET
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
Access-Control-Expose-Headers
X-Origin-Hublet
Access-Control-Max-Age
180
Access-Control-Allow-Credentials
false
Cache-Control
max-age=0, no-cache, no-store
X-Robots-Tag
none
Access-Control-Allow-Headers
*
CF-RAY
7dbd1a5cdb2b7777-LHR
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-44rkg
json
forms.hsforms.com/embed/v3/form/21158977/de7ea1d6-a749-4248-88db-dc813310bec6/
53 KB
8 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21158977/de7ea1d6-a749-4248-88db-dc813310bec6/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f9b0cdbb9f529ab9f9f41a261a39aceab600ec996c86494b03df12340ac1326
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Origin-Hublet
na1
Date
Fri, 23 Jun 2023 13:33:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
br
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
75a7e1d7-3da0-421f-87f3-801ae2a1693f
x-evy-trace-route-service-name
envoyset-translator
Transfer-Encoding
chunked
x-envoy-upstream-service-time
19
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
e9d0266d-1cac-4654-9160-a6d8f44a2c34
Server
cloudflare
X-Trace
2B37082C04FDADF24E1F5AB55D0BB5E2D54255CA30000000000000000000
Vary
origin
Access-Control-Allow-Methods
OPTIONS, GET
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
Access-Control-Expose-Headers
X-Origin-Hublet
Access-Control-Max-Age
180
Access-Control-Allow-Credentials
false
Cache-Control
max-age=0, no-cache, no-store
X-Robots-Tag
none
Access-Control-Allow-Headers
*
CF-RAY
7dbd1a5cea41dd1b-LHR
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-j4dtm
json
forms.hsforms.com/embed/v3/form/21158977/68741a11-8e56-4f23-ba7f-b2307e77714c/
2 KB
2 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21158977/68741a11-8e56-4f23-ba7f-b2307e77714c/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06c786e9992af6b25c5547beaac5142b1378c64e3c8ecac51f4ca8d55a104d35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Origin-Hublet
na1
Date
Fri, 23 Jun 2023 13:33:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
br
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
a7b015c3-30e7-4991-83f5-0574f5afad67
x-evy-trace-route-service-name
envoyset-translator
Transfer-Encoding
chunked
x-envoy-upstream-service-time
8
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
817f9994-d91f-4cba-bb46-66f9c4d9308c
Server
cloudflare
X-Trace
2B35B893406BB15357B550C176A072232B4C16E8C3000000000000000000
Vary
origin
Access-Control-Allow-Methods
OPTIONS, GET
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
Access-Control-Expose-Headers
X-Origin-Hublet
Access-Control-Max-Age
180
Access-Control-Allow-Credentials
false
Cache-Control
max-age=0, no-cache, no-store
X-Robots-Tag
none
Access-Control-Allow-Headers
*
CF-RAY
7dbd1a5d2d1176c9-LHR
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-qr8ft
munchkin.js
munchkin.marketo.net/
1 KB
2 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: trustwave.azureedge.net
URL: https://trustwave.azureedge.net/dist/js/legacy.min.js?id=1037
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Fri, 23 Jun 2023 13:33:28 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
optimize.js
www.google-analytics.com/gtm/
129 KB
49 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-5B38B7F
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
81ca1f14c472917fc81a9c10ad36994b8a79b65334d8bd9f2728d35e50ce0048
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
50238
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 23 Jun 2023 13:33:28 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
774 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7edd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
77cf16e1867991ea4ed7fb6d470e613528693de636fb0f1352936cc480e180ae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2023 17:56:59 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=15841
accept-ranges
bytes
content-length
562
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230099-FRA
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/494613180/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/494613180/?random=1687527208457&cv=11&fst=1687527208457&bg=ffffff&guid=ON&async=1&gtm=45He36l0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&hn=www.googleadservices.com&frm=0&tiba=The%20Dexter%20Malware%3A%20Getting%20Your%20Hands%20Dirty%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&auid=278850928.1687527208&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b87c7ea9a9fa02e7868c8a0ed7de074c906f15837c28f3a991204938078cbee8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1393
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fb...
10419288.fls.doubleclick.net/ Frame F6C6
Redirect Chain
  • https://10419288.fls.doubleclick.net/activityi;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%...
  • https://10419288.fls.doubleclick.net/activityi;dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww....
664 B
659 B
Document
General
Full URL
https://10419288.fls.doubleclick.net/activityi;dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f6.1e100.net
Software
cafe /
Resource Hash
4101a7d45447d50e29f61f57dd05dc801bacb58d9a84cabfe5fce345c927c879
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
321
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Jun 2023 13:33:28 GMT
expires
Fri, 23 Jun 2023 13:33:28 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Jun 2023 13:33:28 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10419288.fls.doubleclick.net/activityi;dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
activityi;dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%...
9785483.fls.doubleclick.net/ Frame EB98
Redirect Chain
  • https://9785483.fls.doubleclick.net/activityi;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=http...
  • https://9785483.fls.doubleclick.net/activityi;dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;...
534 B
656 B
Document
General
Full URL
https://9785483.fls.doubleclick.net/activityi;dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f6.1e100.net
Software
cafe /
Resource Hash
acef92feebd51825074dd2144d4e75e36e6e880faebe6336b7f9ccc205e03c31
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
317
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Jun 2023 13:33:28 GMT
expires
Fri, 23 Jun 2023 13:33:28 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Jun 2023 13:33:28 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://9785483.fls.doubleclick.net/activityi;dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
fbevents.js
connect.facebook.net/en_US/
112 KB
29 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 23 Jun 2023 13:33:28 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
28296
x-xss-protection
0
pragma
public
x-fb-debug
qI/3ubA9OCDkNoZK3d4Y7uYGs2ptvZ7BK2iiywelpjVivgCDx8dLW2KChUjULho8LMbUqAgGmj+dDmnk5XmyVw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
96dff353-a928-44b4-b1d0-6432c69133ba_eu.js
cdn.mouseflow.com/projects/
Redirect Chain
  • https://cdn.mouseflow.com/projects/96dff353-a928-44b4-b1d0-6432c69133ba.js
  • https://cdn.mouseflow.com/projects/96dff353-a928-44b4-b1d0-6432c69133ba_eu.js
192 KB
56 KB
Script
General
Full URL
https://cdn.mouseflow.com/projects/96dff353-a928-44b4-b1d0-6432c69133ba_eu.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Mouseflow /
Resource Hash
a4c6f490f7db151fb0dd9ce3339d17fdc511dabe0252f5b73bdf67b20268b107
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Tue, 06 Jun 2023 15:54:49 GMT
server
Mouseflow
etag
W/"f6ff75398f98d91:0"
x-cache-status
MISS
x-hw
1687527208.cds301.lo4.hn,1687527208.cds212.lo4.c
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
57442

Redirect headers

date
Fri, 23 Jun 2023 13:33:28 GMT
x-hw
1687527208.cds301.lo4.hn,1687527208.cds073.lo4.c
location
https://cdn.mouseflow.com/projects/96dff353-a928-44b4-b1d0-6432c69133ba_eu.js
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-hw-loc
https://cdn.mouseflow.com/projects/96dff353-a928-44b4-b1d0-6432c69133ba.js
content-length
0
22616067.js
js-na1.hs-scripts.com/
978 B
618 B
Script
General
Full URL
https://js-na1.hs-scripts.com/22616067.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:883b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b27db9a7ed1c92ffb635d474249023209341291b21dea9da8e0b636dbae288a

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
cf-cache-status
EXPIRED
x-hubspot-correlation-id
ac391dff-ee55-4d6b-a585-c0b769157df9
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
9
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
cf372c1e-f7a5-4225-b4b2-ffbbd8cc2acd
last-modified
Fri, 23 Jun 2023 13:26:44 GMT
server
cloudflare
x-trace
2BA17D1FA28FC1EA47452C518F5693FC390C484B51000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
cache-control
public, max-age=30
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-nbhzm
cf-ray
7dbd1a5d28c800a7-LHR
js
www.googletagmanager.com/gtag/
265 KB
89 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-DP8B111F8E&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e2167b750ec6c628236ee97382f751a23f2eef0f27067492e2f51d4cadd1e66d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
91428
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 23 Jun 2023 13:33:28 GMT
collect
region1.analytics.google.com/g/
0
247 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-DP8B111F8E&gtm=45je36l0&_p=2032878370&_gaz=1&cid=1823390258.1687527209&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1687527208&sct=1&seg=0&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&dt=The%20Dexter%20Malware%3A%20Getting%20Your%20Hands%20Dirty%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DP8B111F8E&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trustwave.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
247 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-DP8B111F8E&cid=1823390258.1687527209&gtm=45je36l0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DP8B111F8E&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trustwave.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.co.uk/ads/
42 B
107 B
Image
General
Full URL
https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-DP8B111F8E&cid=1823390258.1687527209&gtm=45je36l0&aip=1&z=1055714134
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
insight.old.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7edd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
656
date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 21 Jun 2023 22:21:38 GMT
x-cdn
AKAM
x-edgeconnect-midmile-rtt
0
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=70543
accept-ranges
bytes
content-length
4777
munchkin.js
munchkin.marketo.net/163/
11 KB
6 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Fri, 23 Jun 2023 13:33:28 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sun, 01 Oct 2023 13:33:28 GMT
/
www.google.com/pagead/1p-user-list/494613180/
42 B
327 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/494613180/?random=1687527208457&cv=11&fst=1687525200000&bg=ffffff&guid=ON&async=1&gtm=45He36l0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&frm=0&tiba=The%20Dexter%20Malware%3A%20Getting%20Your%20Hands%20Dirty%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&fmt=3&is_vtc=1&random=2636553789&rmt_tld=0&ipr=y
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.co.uk/pagead/1p-user-list/494613180/
42 B
455 B
Image
General
Full URL
https://www.google.co.uk/pagead/1p-user-list/494613180/?random=1687527208457&cv=11&fst=1687525200000&bg=ffffff&guid=ON&async=1&gtm=45He36l0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&frm=0&tiba=The%20Dexter%20Malware%3A%20Getting%20Your%20Hands%20Dirty%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&fmt=3&is_vtc=1&random=2636553789&rmt_tld=1&ipr=y
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/
43 B
377 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=cc3db2f8-4d1d-4fb5-86dd-ad97714fa1c7&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0ff3df2d-6a08-422b-9d1a-a705c273fb6a&tw_document_href=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ya5&type=javascript&version=2.3.29
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time
104
date
Fri, 23 Jun 2023 13:33:27 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
cfcf2e91719d837b
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
203421d3b42b122a62c7cc024a7fbcf4880dc4c64e7fa9f52f903f5af6f7032e
content-length
43
adsct
analytics.twitter.com/i/
43 B
395 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=cc3db2f8-4d1d-4fb5-86dd-ad97714fa1c7&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0ff3df2d-6a08-422b-9d1a-a705c273fb6a&tw_document_href=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ya5&type=javascript&version=2.3.29
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time
104
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
054f60bc279cfbfc
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
927ca79bd01ef9e5c815838bb8a1b207010fb0d1fe186c5d9d3482185dc0c94d
content-length
43
adsct
t.co/i/
43 B
223 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=d9809bdd-65da-48ad-9825-e7a06379c18c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0ff3df2d-6a08-422b-9d1a-a705c273fb6a&tw_document_href=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ya5&type=javascript&version=2.3.29
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time
104
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
d6e3226f61772ab5
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
203421d3b42b122a62c7cc024a7fbcf4880dc4c64e7fa9f52f903f5af6f7032e
content-length
43
adsct
analytics.twitter.com/i/
43 B
239 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=d9809bdd-65da-48ad-9825-e7a06379c18c&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0ff3df2d-6a08-422b-9d1a-a705c273fb6a&tw_document_href=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ya5&type=javascript&version=2.3.29
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-response-time
106
date
Fri, 23 Jun 2023 13:33:27 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
c68e080b5ef5e7cf
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
927ca79bd01ef9e5c815838bb8a1b207010fb0d1fe186c5d9d3482185dc0c94d
content-length
43
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 12:12:03 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
4885
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 23 Jun 2023 14:12:03 GMT
token
cdn.linkedin.oribi.io/partner/70652/domain/trustwave.com/
36 B
367 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/70652/domain/trustwave.com/token
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2171:e200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 12:05:01 GMT
content-encoding
gzip
via
1.1 29f91c1e9be6cbd10add7ba15aee7660.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG53-C1
age
5307
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=27221
x-amz-cf-id
pSuYNLlkmY-UlrP7KvFkNW9Fq0jQjmTKd8WA14-e78kkyX799FSTdA==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26time%3D1687527208676%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hand...
0
266 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&cookiesTest=true&liSync=true&e_ipv6=AQLw7_tncMQ7DgAAAYjodbnmC9V38jlVknCzRTAqsstZ3gI1sBdCTjb90YWQqlhgTSyX
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:29 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 242078C3A8AF46BC83DD762493B9EA59 Ref B: MAN30EDGE0912 Ref C: 2023-06-23T13:33:29Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX+zAvhez/s81dG994gAA==

Redirect headers

date
Fri, 23 Jun 2023 13:33:28 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 82BE651F328E44758BD6F9A0B6C41C08 Ref B: LTSEDGE1106 Ref C: 2023-06-23T13:33:29Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1687527208676&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&cookiesTest=true&liSync=true&e_ipv6=AQLw7_tncMQ7DgAAAYjodbnmC9V38jlVknCzRTAqsstZ3gI1sBdCTjb90YWQqlhgTSyX
x-li-proto
http/2
content-length
0
x-li-uuid
AAX+zAveDD9uargL/siokg==
token
cdn.linkedin.oribi.io/partner/70652/domain/trustwave.com/
36 B
366 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/70652/domain/trustwave.com/token
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2171:e200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 12:05:01 GMT
content-encoding
gzip
via
1.1 29f91c1e9be6cbd10add7ba15aee7660.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG53-C1
age
5307
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=27221
x-amz-cf-id
u-zEl0mKiKEFLdqyLN9QGvto5TK6R-Y2B9fZgLWGbCUu0qJJSx-KcQ==
657537318161329
connect.facebook.net/signals/config/
300 KB
86 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/657537318161329?v=2.9.108&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
1f0d907e14654e6eeb88cf14035fdff4081be0f4bb5b0d1e45245bf32ea50721
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 23 Jun 2023 13:33:28 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
RPER6oalKeYCj3Ght1nbzoTd1+CB3W1IHb/PYr3LZGlvxbLYUVTegPHdV9eZGev31uycz7EuBYid46Z622PnoQ==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
fpv2.min.js
www.atmrum.net/client/v1/atm/
3 KB
3 KB
Script
General
Full URL
https://www.atmrum.net/client/v1/atm/fpv2.min.js
Requested by
Host: www.atmrum.net
URL: https://www.atmrum.net/rum.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
32ea28e4cc9fb2662d406bc5e859f774b58f927861c31864c33cb81aa8263aac
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
x-content-type-options
nosniff
last-modified
Sat, 10 Jun 2023 21:31:02 GMT
x-msedge-ref
Ref A: 46BEFA05330C4620B0F444141C9BD71F Ref B: MAN31EDGE0415 Ref C: 2023-06-23T13:33:28Z
etag
0x8D501F7AFB7338D
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
2983
c7ede6b6-5518-4502-94a5-673e62cff495.json
cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/
3 KB
2 KB
XHR
General
Full URL
https://cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/c7ede6b6-5518-4502-94a5-673e62cff495.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
809765ad9401369a9a87159ade197a7893be54c78de5e0c1995f77efbde4a286
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
FlMWWNWt99scM6fkHGo+qw==
age
20313
x-ms-lease-status
unlocked
last-modified
Tue, 23 May 2023 05:24:03 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
9756ce2a-f01e-0016-1336-8dce9a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5e7f0c71e4-LHR
visitWebPage
815-rfm-693.mktoresp.com/webevents/
43 B
121 B
Ping
General
Full URL
https://815-rfm-693.mktoresp.com/webevents/visitWebPage?_mchNc=1687527208700&_mchCn=&_mchId=815-RFM-693&_mchTk=_mch-trustwave.com-1687527208699-36915&_mchHo=www.trustwave.com&_mchPo=&_mchRu=%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.15.214.243 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
BigIP /
Resource Hash
cbbd42bb1d88693e6805bd9d676840424af5ecf3e13d874fd06e6b57d53d8d40

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Length
43
Server
BigIP
banner.js
js.hs-banner.com/v2/21158977/
209 KB
64 KB
Script
General
Full URL
https://js.hs-banner.com/v2/21158977/banner.js
Requested by
Host: js-na1.hs-scripts.com
URL: https://js-na1.hs-scripts.com/21158977.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b40a93cfffc7cc88b425c84b80cf85f60577787fb1e9a0a77acbe1f3bd6389d

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
YmU9KHJWFldI3_SW2dhultvMKGSaoehL
content-encoding
br
cf-cache-status
REVALIDATED
x-amz-request-id
9F4QREH501XCZBJ7
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
57
x-amz-id-2
OyDOfAaCJ8HNC6g2CwueWqcdhidBJAJTYwoWLdG0waZsHCfNM9yTx4yXV6XqxjcRVj/zcM1QtIU=
x-evy-trace-listener
listener_https
x-request-id
e2b26884-99d7-4848-90a0-e53c4a7fa714
x-evy-trace-route-configuration
listener_https/all
last-modified
Thu, 22 Jun 2023 18:56:38 GMT
server
cloudflare
etag
W/"40857cbc36102f3da8233a58b1429a8a"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
7dbd1a5ef8f38877-LHR
expires
Fri, 23 Jun 2023 13:38:28 GMT
21158977.js
js.hs-analytics.net/analytics/1687527000000/
66 KB
21 KB
Script
General
Full URL
https://js.hs-analytics.net/analytics/1687527000000/21158977.js
Requested by
Host: js-na1.hs-scripts.com
URL: https://js-na1.hs-scripts.com/21158977.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:8bce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c7bfd4207c811df43b95b8e0f3cc33e108082555d4e97690a48f96c7c3cf7ef

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
2EPN9VJ58AB8J1E9
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
15
x-amz-id-2
0H8IJAOprhnN6O7b77cAr3ZFknZQD278MVwNTRZmKrITi6K7u2MD4W+kJDj9ydf+l0pMhYnJmgs=
x-evy-trace-listener
listener_https
x-request-id
284aa622-5f51-4c10-8b5e-6368e839fd61
x-evy-trace-route-configuration
listener_https/all
last-modified
Thu, 15 Jun 2023 15:21:06 GMT
server
cloudflare
etag
W/"cd72b05bfe04e2ea8b1c3a96ba901064"
vary
origin, Accept-Encoding
content-type
text/javascript
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
cache-control
max-age=300,public
access-control-allow-credentials
false
cf-ray
7dbd1a5f1cf3719e-LHR
expires
Fri, 23 Jun 2023 13:38:28 GMT
fb.js
js.hsadspixel.net/
6 KB
3 KB
Script
General
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: js-na1.hs-scripts.com
URL: https://js-na1.hs-scripts.com/21158977.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:79be , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1874f11501aa7118cdfa7af21a9ef1c87301e917881dc941831b122d82b34a

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
tZNqk9JR4hpL4HhK3M1JevHxbsFiShRO
via
1.1 76e55a2361219fb19722e949475d1844.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P3
age
586
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.382/bundles/pixels-release.js&cfRay=7dbd0c0c0e82887d-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
0
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
0d3469ca-672a-4ca5-a038-a850de2cd5da
last-modified
Tue, 20 Jun 2023 11:26:10 UTC
server
cloudflare
etag
W/"15e730192a32cd4563797f160ff1fd6f"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-mm66x
cf-ray
7dbd1a5f180e71ed-LHR
x-amz-cf-id
wK-ARWaZmwR-tcfXo4xFst8PqR_4f83Maoz1wzh9ypk7smg8H5fDxw==
x-hs-target-asset
adsscriptloaderstatic/static-1.382/bundles/pixels-release.js
collectedforms.js
js.hscollectedforms.net/
69 KB
25 KB
Script
General
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js-na1.hs-scripts.com
URL: https://js-na1.hs-scripts.com/21158977.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6ac7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f148a333a7585ab1391cceb303d946f5bf1b38ba6bb8eae863125ccde728bb3

Request headers

Referer
https://www.trustwave.com/
Origin
https://www.trustwave.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
38
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.378/bundles/project.js&cfRay=7dbd196eabfcdc63-LHR
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"b19afd994dc32a5784e74169cca8128a"
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
collected-forms-embed-js/static-1.378/bundles/project.js
date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
S1jmwKbmrdTaJO._teNI0LpuWSvl4WIJ
via
1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
8
x-evy-trace-route-configuration
listener_https/all
x-request-id
9c08b7bd-d9ea-4c01-8689-1f1452cd5dff
last-modified
Tue, 13 Jun 2023 09:45:35 UTC
server
cloudflare
access-control-max-age
3000
x-hs-cache-status
MISS
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-s8xd8
cf-ray
7dbd1a5f6d5bdd81-LHR
x-amz-cf-id
wCWnoYpC0HxcGdVaRCbDXcHIp_cnx0qa2gexXpDZ6JRILTu0r4uZAw==
v2.js
js.hsforms.net/forms/embed/ Frame 0E7C
526 KB
164 KB
Script
General
Full URL
https://js.hsforms.net/forms/embed/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bb41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
521
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dbd0da1caf924d7-LHR
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
b47313d7-1052-474d-80f7-0231be5c9502
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BeIk7cIDTqq4iPmu8ZgUm29uI9oRYQsJVx7nDpisuh2vawDuORqw8MQHWolB9vLMpA2ZJ3y9QCb1IaPzPwxItqoJEZOs0hQdBC92oKuO7iQdzYlqZ4mhh%2BJ5xRM7k%2FJsbVaw1n8NVye64QGI"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray
7dbd1a5e9a9623de-LHR
x-amz-cf-id
M0e2wBoTPXndtPkmA9d4EAuW8F1Lm45MMgwXqW64Ujh3EQiX2P-8XA==
v2.js
js.hsforms.net/forms/embed/ Frame A969
526 KB
164 KB
Script
General
Full URL
https://js.hsforms.net/forms/embed/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bb41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
521
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dbd0da1caf924d7-LHR
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
b47313d7-1052-474d-80f7-0231be5c9502
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bHhVf4eC%2FrOigdU%2FsEo0rC6XAIqX4dBnHeUglu9Hibtldkm0q3CAL%2F%2FO2PzynilHfM4C%2BxaCmPTssezx6trekWm77l%2Fe7v0AVZzf5DAVUccFyCmThLSHDE%2BjXDfgqw7rhwg4UbscdJcn46MF"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray
7dbd1a5eaaab23de-LHR
x-amz-cf-id
M0e2wBoTPXndtPkmA9d4EAuW8F1Lm45MMgwXqW64Ujh3EQiX2P-8XA==
v2.js
js.hsforms.net/forms/embed/ Frame 6AAB
526 KB
164 KB
Script
General
Full URL
https://js.hsforms.net/forms/embed/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bb41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
521
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dbd0da1caf924d7-LHR
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
b47313d7-1052-474d-80f7-0231be5c9502
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QF3jZTzwWkEsdLcYKupOWv90yNwjIDDGiFUNUh67GqNZAtFtWbzsAXReZA6G0g7qR4USP03NCx0Gv77Aj8oSWxSTbr8fXBQJD%2Bm0qH3Dc5sEgKO0fxwK9jfl%2FlQXX8nqkSQimVcAwf%2F85iMc"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray
7dbd1a5eaaba23de-LHR
x-amz-cf-id
M0e2wBoTPXndtPkmA9d4EAuW8F1Lm45MMgwXqW64Ujh3EQiX2P-8XA==
v2.js
js.hsforms.net/forms/embed/ Frame 0326
526 KB
164 KB
Script
General
Full URL
https://js.hsforms.net/forms/embed/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bb41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
521
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dbd0da1caf924d7-LHR
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Fri, 23 Jun 2023 13:33:28 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 73c5607bdb5db0d651e25c848846d554.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
b47313d7-1052-474d-80f7-0231be5c9502
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=11RYBlBKDsxVsqMhC459%2BGt%2F36nc%2BX1s9E7G8Hosa2X3wsvjlgWrgS7TcS8qgQO0DpN9lyQkaVP72Swg%2F5BraoJ93xqVcrUz1JpeegArOC2OavA5ZTMuUNl%2BdLWdzaxGerz4w%2BIhcOkzj%2FE1"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
cf-ray
7dbd1a5ebac223de-LHR
x-amz-cf-id
M0e2wBoTPXndtPkmA9d4EAuW8F1Lm45MMgwXqW64Ujh3EQiX2P-8XA==
counters.gif
forms.hsforms.com/embed/v3/
35 B
624 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
f3286aff-b4cd-41bd-b992-0f30fbbc4818
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
3
alt-svc
h3=":443"; ma=86400
content-length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
4fc4aabb-c749-4dcb-a796-b8de9a816ef7
server
cloudflare
x-trace
2B6BD04EA8F32B78705595C0B9B6D5CCD42FD0FDF0000000000000000000
vary
origin
content-type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-nt996
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
7dbd1a5f2e007587-LHR
ot_guard_logo.svg
cookie-cdn.cookiepro.com/logos/static/
497 B
474 B
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/logos/static/ot_guard_logo.svg
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
tXyZydHjxQshFMbbBT1/8A==
age
86078
x-ms-lease-status
unlocked
last-modified
Fri, 09 Jun 2023 01:34:38 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
03d2ae97-201e-0015-5380-9a2ffe000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5effbc71e4-LHR
expires
Sat, 24 Jun 2023 13:33:28 GMT
cookiepro_logo.png
cookie-cdn.cookiepro.com/logos/static/
35 KB
36 KB
Image
General
Full URL
https://cookie-cdn.cookiepro.com/logos/static/cookiepro_logo.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
088dbe5e4bb2f902e2e7c62ca7a15bae5cb55f4708d99f7c4daae7148a19a865
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
HIT
content-md5
IipuN9Einq/0wIZw6VIt/g==
age
67849
cf-polished
origSize=36419
content-length
36343
x-ms-lease-status
unlocked
cf-bgj
imgq:100,h2pri
last-modified
Fri, 09 Jun 2023 01:34:39 GMT
server
cloudflare
etag
0x8DB6889B113E3C1
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
e112b1eb-e01e-00b3-783a-9b98e0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7dbd1a5f189a48c8-LHR
expires
Sat, 24 Jun 2023 13:33:28 GMT
poweredBy_cp_logo.svg
cookie-cdn.cookiepro.com/logos/static/
5 KB
2 KB
Image
General
Full URL
https://cookie-cdn.cookiepro.com/logos/static/poweredBy_cp_logo.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8df4e2508308452516a8972eb7d993d970eefeea6705487b0e100c0fa7b4b447
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
uInNdQwuuw8s7lYl3cE7eQ==
age
63823
x-ms-lease-status
unlocked
last-modified
Fri, 09 Jun 2023 01:34:38 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
ba71f173-201e-002a-2238-9be75d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5f189c48c8-LHR
expires
Sat, 24 Jun 2023 13:33:28 GMT
anchor
www.google.com/recaptcha/api2/ Frame 4902
50 KB
27 KB
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
631704da3b9efddcf53ac90d032ba3b0df74cd997adf6e9cb8d2745a153908cf
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-wKRPJEKfeSviAR3tONnoKg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-length
27816
content-security-policy
script-src 'report-sample' 'nonce-wKRPJEKfeSviAR3tONnoKg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Fri, 23 Jun 2023 13:33:28 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
t.js
vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/
35 KB
11 KB
Script
General
Full URL
https://vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.169.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-169-121.cdg52.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
9178d19c46b5a36fc8d4de24aa7fef3b62e7f69c259f4e81ee3f2d5aba263216
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
via
1.1 aaa5fbd869d655f42986dd16509f667e.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG52-P2
age
17
x-cache
Hit from cloudfront
last-modified
Fri, 09 Jun 2023 13:18:07 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
vpqkrCviCFB-hpeVQ_SBUeD60SEFiC46jwy9WAy4w_8uQ1Fx02WECg==
MktoGetPrefill
www.trustwave.com/umbraco/surface/AJAX/
106 B
622 B
XHR
General
Full URL
https://www.trustwave.com/umbraco/surface/AJAX/MktoGetPrefill
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
81c6d71111c799f222de79bd233811437f9970ac702306fb402f3de576c7cf54
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
X-Requested-With
XMLHttpRequest
Request-Id
|4ZsM3.giz2K
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
server
x-aspnet-version
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
cache-control
private
content-length
216
x-xss-protection
1; mode=block
en-us.json
www.trustwave.com/locale/en-us/LC_MESSAGES/
1 KB
673 B
XHR
General
Full URL
https://www.trustwave.com/locale/en-us/LC_MESSAGES/en-us.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
21c3d65ef1a0105fb3114d843bd4c68e474e7571db6b0af5ca759fbfec9eca81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
X-Requested-With
XMLHttpRequest
Request-Id
|4ZsM3.pqPwy
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 20 Jun 2023 04:21:10 GMT
server
x-aspnet-version
etag
"0bf8a42ea3d91:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/json
accept-ranges
bytes
content-length
590
x-xss-protection
1; mode=block
ja-jp.json
www.trustwave.com/locale/ja-jp/LC_MESSAGES/
1 KB
925 B
XHR
General
Full URL
https://www.trustwave.com/locale/ja-jp/LC_MESSAGES/ja-jp.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7b0ef13b754c456f5621d74ca260e49b061f759bcaeb9223e0eaa78ff4359189
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
X-Requested-With
XMLHttpRequest
Request-Id
|4ZsM3.cfqCW
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 20 Jun 2023 04:21:10 GMT
server
x-aspnet-version
etag
"0bf8a42ea3d91:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/json
accept-ranges
bytes
content-length
877
x-xss-protection
1; mode=block
de-de.json
www.trustwave.com/locale/de-de/LC_MESSAGES/
1 KB
612 B
XHR
General
Full URL
https://www.trustwave.com/locale/de-de/LC_MESSAGES/de-de.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b5e5c5c8b9ebe9fb7f4a8cde7f2ff4f6652e6beb87585c18e99fb446fbb301a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
X-Requested-With
XMLHttpRequest
Request-Id
|4ZsM3.FRUQG
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
last-modified
Tue, 20 Jun 2023 04:21:10 GMT
server
x-aspnet-version
etag
"0bf8a42ea3d91:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/json
accept-ranges
bytes
content-length
564
x-xss-protection
1; mode=block
dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=*;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fe...
adservice.google.com/ddm/fls/z/ Frame EB98
42 B
107 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=*;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F
Requested by
Host: 9785483.fls.doubleclick.net
URL: https://9785483.fls.doubleclick.net/activityi;dc_pre=CMnJyN7A2f8CFc1CwgodYKgJKA;src=9785483;type=siter0;cat=siter00;ord=2068200382536;gtm=45He36l0;auiddc=278850928.1687527208;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://9785483.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:29 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=*;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-...
adservice.google.com/ddm/fls/z/ Frame F6C6
42 B
401 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=*;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F
Requested by
Host: 10419288.fls.doubleclick.net
URL: https://10419288.fls.doubleclick.net/activityi;dc_pre=CLm5yd7A2f8CFQzuGQodOtYDPw;src=10419288;type=trust0;cat=trust0;ord=9445590294135;gtm=45He36l0;auiddc=278850928.1687527208;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://10419288.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
en.json
cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/f45c1dcb-4e3d-4ab0-a829-22e58a3f19f6/
44 KB
10 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/consent/c7ede6b6-5518-4502-94a5-673e62cff495/f45c1dcb-4e3d-4ab0-a829-22e58a3f19f6/en.json
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f8bc26c4789780ae3a330a2d348a7c806e3e019f852d543937745e0512d4e62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
zSu/aRykCTI2vfMfJM1amQ==
age
30402
x-ms-lease-status
unlocked
last-modified
Tue, 23 May 2023 05:24:03 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
98a02e4b-a01e-00b2-2495-92c73c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a5f886d71e4-LHR
counters.gif
forms-na1.hsforms.com/embed/v3/
35 B
983 B
Image
General
Full URL
https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Fri, 23 Jun 2023 13:33:29 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
e8266663-2f5a-4b0a-bab1-30232b9dbe43
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
1
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
52c6525c-13ad-4d87-b5ef-aaa5b19c7c65
Server
cloudflare
X-Trace
2BBEB2433DBE5DB3B16791EF380A7D099D9D96ABA7000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-44rkg
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
7dbd1a5ff83c7783-LHR
collect
www.google-analytics.com/j/
4 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2032878370&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&ul=en-us&de=UTF-8&dt=The%20Dexter%20Malware%3A%20Getting%20Your%20Hands%20Dirty%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=839279746&gjid=1235041674&cid=1823390258.1687527209&tid=UA-123880220-1&_gid=814342874.1687527209&_r=1&_slc=1&gtm=45He36l0n8154M2ZJN&z=997173736
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trustwave.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
fpconfig.min.json
www.atmrum.net/conf/v1/atm/
191 B
496 B
XHR
General
Full URL
https://www.atmrum.net/conf/v1/atm/fpconfig.min.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
72766f736186eb5c7c6d08502f3bf28da0092e8ea85cf3b5413c9daf8dc2d94a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:28 GMT
x-content-type-options
nosniff
last-modified
Sat, 10 Jun 2023 21:31:02 GMT
x-msedge-ref
Ref A: 63ADFB3BDE3448FABE9821502BBBA746 Ref B: MAN30EDGE0819 Ref C: 2023-06-23T13:33:28Z
etag
0x8D501F7AFB7338D
x-cache
CONFIG_NOCACHE
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
191
styles__ltr.css
www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/ Frame 4902
55 KB
24 KB
Stylesheet
General
Full URL
https://www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 20:18:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
234878
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24605
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:10:42 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 20:18:51 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/ Frame 4902
427 KB
171 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
02ca49fda602d411bc21fbfa941871cd8944352e3ffb6b289b4f86eb1849a6c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 20:15:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
235086
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
175191
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:10:42 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 20:15:23 GMT
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=657537318161329&ev=PageView&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&rl=&if=false&ts=1687527208953&sw=1600&sh=1200&v=2.9.108&r=stable&ec=0&o=30&fbp=fb.1.1687527208952.1676477776&it=1687527208691&coo=false&rqm=GET
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:29 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
collect
stats.g.doubleclick.net/j/
7 B
154 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-123880220-1&cid=1823390258.1687527209&jid=839279746&gjid=1235041674&_gid=814342874.1687527209&_u=YADAAEAAQAAAACAAI~&z=47908850
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3c25b077a6d92cd9d3576660b68c4c0bd135b78b3cd3b66491ff2c7aa0eeaad3
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 23 Jun 2023 13:33:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trustwave.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7
expires
Fri, 01 Jan 1990 00:00:00 GMT
css2
fonts.googleapis.com/ Frame 0E7C
7 KB
760 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@400;500;700&display=swap
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2a6d7a06a4458b56f188177654688a18648aaf4800feee0a4a09a858f46bc920
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 23 Jun 2023 13:33:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 23 Jun 2023 13:19:35 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 23 Jun 2023 13:33:28 GMT
css2
fonts.googleapis.com/ Frame A969
7 KB
783 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@400;500;700&display=swap
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2a6d7a06a4458b56f188177654688a18648aaf4800feee0a4a09a858f46bc920
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 23 Jun 2023 13:33:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 23 Jun 2023 13:11:19 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 23 Jun 2023 13:33:29 GMT
banner.js
js.hs-banner.com/v2/22616067/
209 KB
63 KB
Script
General
Full URL
https://js.hs-banner.com/v2/22616067/banner.js
Requested by
Host: js-na1.hs-scripts.com
URL: https://js-na1.hs-scripts.com/22616067.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed8376e9badc551507bafcee5df98369b04c2091086bd161f641209d558e603c

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:29 GMT
x-amz-version-id
56gDbMFi7wXJ5SlcURoN2W5oEr0CY1M5
content-encoding
br
cf-cache-status
REVALIDATED
x-amz-request-id
9F4NRW81GDF220NR
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
37
x-amz-id-2
3WsEtGR02cQ5PeKdCK5WKcKdSTqIHx+JDOdQh+9qr6918v1WpnnX+mGifcaSwC+9ZE2zckqg9FZwsvLNum6LHZkDp/IXwPAXsg8/kcxO1L8=
x-evy-trace-listener
listener_https
x-request-id
b9efa86e-12cd-4094-9a6d-f75f0b77d9b4
x-evy-trace-route-configuration
listener_https/all
last-modified
Thu, 22 Jun 2023 19:48:40 GMT
server
cloudflare
etag
W/"08f42533849a02e3d81531e1c710c278"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-v9vn7
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
7dbd1a604b4b8877-LHR
expires
Fri, 23 Jun 2023 13:38:29 GMT
css2
fonts.googleapis.com/ Frame 6AAB
7 KB
760 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@400;500;700&display=swap
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2a6d7a06a4458b56f188177654688a18648aaf4800feee0a4a09a858f46bc920
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 23 Jun 2023 13:33:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 23 Jun 2023 13:13:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 23 Jun 2023 13:33:29 GMT
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-123880220-1&cid=1823390258.1687527209&jid=839279746&_u=YADAAEAAQAAAACAAI~&z=2075500897
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:29 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.co.uk/ads/
42 B
107 B
Image
General
Full URL
https://www.google.co.uk/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-123880220-1&cid=1823390258.1687527209&jid=839279746&_u=YADAAEAAQAAAACAAI~&z=2075500897
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Jun 2023 13:33:29 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
css2
fonts.googleapis.com/ Frame 0326
7 KB
760 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@400;500;700&display=swap
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/embed/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2a6d7a06a4458b56f188177654688a18648aaf4800feee0a4a09a858f46bc920
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 23 Jun 2023 13:33:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 23 Jun 2023 13:07:38 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 23 Jun 2023 13:33:29 GMT
json
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/
50 B
1 KB
XHR
General
Full URL
https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=22616067
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:cccc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dbc438358bff6d1933a1bf280a0c0bd2f4f30864487a12cc0526acd877a9e636
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:29 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
f24ad384-fa56-4141-a6e8-fd7299674ae6
x-envoy-upstream-service-time
12
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
48b97bb1-30e2-417e-8fe1-d9ab1043e4aa
server
cloudflare
x-trace
2B23C7044F9332491885EACB8582F32020C53844A5000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.trustwave.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-wnhdc
access-control-max-age
180
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Aq5%2FI1nI%2ByVV6kFSMYvmwt1K5MWALX1nQ4MJ%2Bgu7XFAPckTbtCG6hzwgWVKMpEN8MjUH3oQq2l8QZBhOAvgJlf3zPSzEH2PpHmt7QD4uF%2Fwyelb6LWcDjjSFUCQnr5MxfZVY7lmYIo8FSQEH"}],"group":"cf-nel","max_age":604800}
cf-ray
7dbd1a613e3724b7-LHR
access-control-allow-headers
*
otFlat.json
cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/otFlat.json
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa355c393e03f831dbdbcc678ba16396aab95930b1bc5b0549695d40cc955ca1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:29 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
iCAxFkQWfzfDHevR0IbBjg==
age
64921
x-ms-lease-status
unlocked
last-modified
Thu, 25 May 2023 07:08:15 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
0de38b04-101e-0021-480e-8f1c36000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a60ca0271e4-LHR
expires
Sat, 24 Jun 2023 13:33:29 GMT
otPcCenter.json
cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/v2/
61 KB
13 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/v2/otPcCenter.json
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:29 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
Nrtw9V+L/sfw1fri0BTPUA==
age
64921
x-ms-lease-status
unlocked
last-modified
Thu, 25 May 2023 07:08:17 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
2df8f15d-301e-0054-760e-8f771a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a60ca0571e4-LHR
expires
Sat, 24 Jun 2023 13:33:29 GMT
otCommonStyles.css
cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/
21 KB
4 KB
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/assets/otCommonStyles.css
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0c233d327541d2961f1cde9e53a6166279655f4d4041c1bc458ac1701827719
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:29 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
oWkBTLgDDXvrUsd93y/Zxg==
age
19729
x-ms-lease-status
unlocked
last-modified
Thu, 25 May 2023 07:08:33 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
64605b3e-a01e-009d-4b0e-8fcaf7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a60ca0671e4-LHR
expires
Sat, 24 Jun 2023 13:33:29 GMT
trans.gif
847c3546cc49055feb7d840226086038.azr.footprintdns.com/apc/
43 B
380 B
Image
General
Full URL
https://847c3546cc49055feb7d840226086038.azr.footprintdns.com/apc/trans.gif?ae8749da5c42d710e279d7717289d5ef
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:1001:6::37 , Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:29 GMT
x-machinename
gvx01app023
x-content-type-options
nosniff
last-modified
Fri, 02 Jun 2023 00:46:28 GMT
server
Microsoft-IIS/10.0
etag
"392fdcaaeb94d91:0"
x-powered-by
ASP.NET
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName
x-endpoint
gvx01prdapp02
accept-ranges
bytes
content-length
43
x-userhostaddress
2001:ac8:21::
IsUserAusi
www.trustwave.com/umbraco/surface/AJAX/
5 B
168 B
XHR
General
Full URL
https://www.trustwave.com/umbraco/surface/AJAX/IsUserAusi
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
X-Requested-With
XMLHttpRequest
Request-Id
|4ZsM3.3HMXq
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
server
x-aspnet-version
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
cache-control
private
content-length
123
x-xss-protection
1; mode=block
IsUserAPAC
www.trustwave.com/umbraco/surface/AJAX/
5 B
165 B
XHR
General
Full URL
https://www.trustwave.com/umbraco/surface/AJAX/IsUserAPAC
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
X-Requested-With
XMLHttpRequest
Request-Id
|4ZsM3.GreDh
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 23 Jun 2023 13:33:28 GMT
server
x-aspnet-version
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
cache-control
private
content-length
123
x-xss-protection
1; mode=block
json
forms.hscollectedforms.net/collected-forms/v1/config/
116 B
451 B
XHR
General
Full URL
https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=21158977&utk=
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6ac7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
932082305544d3426acaefac13815f07c276046aee77847071d1dfc1754636e4

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:29 GMT
content-encoding
br
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
5076a12f-9861-4ca1-8bcd-15232e593788
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
3
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
d49e98f7-b336-4e02-824a-9a7f5f5888a4
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.trustwave.com
x-evy-trace-virtual-host
all
cache-control
max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-x5fmx
access-control-max-age
180
x-robots-tag
none
access-control-allow-headers
*
cf-ray
7dbd1a61695bdd81-LHR
generic
match.adsrvr.org/track/cmf/
70 B
265 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=id17evj&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|8694a161-66ab-4bbc-8984-e7355569be21
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Fri, 23 Jun 2023 13:33:29 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
t.gif
wec-assets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/
43 B
304 B
Image
General
Full URL
https://wec-assets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.gif?d=8694a161-66ab-4bbc-8984-e7355569be21&s=a6ada831-0b41-4d3f-9dd7-6c9cae972627&p=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&cb=1687527209170&t=The%20Dexter%20Malware%3A%20Getting%20Your%20Hands%20Dirty%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&r=&e=page_viewed&u=0a82fe37-c483-4d7f-a6e4-95f6fbe24241-1687527209170
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.145.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-145-123.cdg50.r.cloudfront.net
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:19:24 GMT
strict-transport-security
max-age=31536000
via
1.1 d73334619b61f6b8383fe80234b1299c.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG50-C2
age
845
x-cache
Hit from cloudfront
content-type
image/gif
content-length
43
x-amz-cf-id
x-a-nDF8wYKuHzA4S179hhLY8c4di8X8cFWqHDX7j4xQ9qvRg9fUog==
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 4902
2 KB
2 KB
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/IqA9DpBOUJevxkykws9RiIBs/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 15:17:24 GMT
x-content-type-options
nosniff
age
598565
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Fri, 23 Jun 2023 15:17:24 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 4902
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 00:06:15 GMT
x-content-type-options
nosniff
age
221234
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Jun 2024 00:06:15 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 4902
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 17:47:45 GMT
x-content-type-options
nosniff
age
503144
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 17:47:45 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 4902
102 B
133 B
Other
General
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=IqA9DpBOUJevxkykws9RiIBs
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7cdd1ac485682bdbec3acd13ad2f7121dc33a37c8b1b9e295dccf11cab871a0a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=IqA9DpBOUJevxkykws9RiIBs&size=invisible&cb=tdkypz3gox0t
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
x-xss-protection
1; mode=block
expires
Fri, 23 Jun 2023 13:33:29 GMT
ot_guard_logo.svg
cookie-cdn.cookiepro.com/logos/static/
497 B
390 B
Fetch
General
Full URL
https://cookie-cdn.cookiepro.com/logos/static/ot_guard_logo.svg
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/scripttemplates/202305.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Jun 2023 13:33:29 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
content-md5
tXyZydHjxQshFMbbBT1/8A==
age
86079
x-ms-lease-status
unlocked
last-modified
Fri, 09 Jun 2023 01:34:38 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
03d2ae97-201e-0015-5380-9a2ffe000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
cf-ray
7dbd1a61fbb771e4-LHR
expires
Sat, 24 Jun 2023 13:33:29 GMT
counters.gif
forms.hsforms.com/embed/v3/
35 B
590 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=8
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:29 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
9a69f3ad-7dd5-49fa-b38c-9db455616ee6
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
1
alt-svc
h3=":443"; ma=86400
content-length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
4ae93652-1b96-49d8-8c60-f027a6a4a272
server
cloudflare
x-trace
2BC9DD6D1D1DF59273D1554DF21B3C28B5E5423BB1000000000000000000
vary
origin
content-type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-44rkg
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
7dbd1a627a217587-LHR
trans.gif
847c3546cc49055feb7d840226086038.azr.footprintdns.com/apc/
43 B
110 B
Image
General
Full URL
https://847c3546cc49055feb7d840226086038.azr.footprintdns.com/apc/trans.gif?a73d77c4be1a8077447c1bab493a8d41
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:1001:6::37 , Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:29 GMT
x-machinename
gvx01app023
x-content-type-options
nosniff
last-modified
Fri, 02 Jun 2023 00:46:28 GMT
server
Microsoft-IIS/10.0
etag
"392fdcaaeb94d91:0"
x-powered-by
ASP.NET
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName
x-endpoint
gvx01prdapp02
accept-ranges
bytes
content-length
43
x-userhostaddress
2001:ac8:21::
counters.gif
forms.hsforms.com/embed/v3/
35 B
589 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:29 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
7b6d664c-5c9c-4be1-8330-165a5f70f401
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
content-length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
14c26df4-0a58-43c4-b8c2-1247a37aafa0
server
cloudflare
x-trace
2BCAE975714BDD0E4EE835B7BE3DCDEA11E76AE20A000000000000000000
vary
origin
content-type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-f4t27
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
7dbd1a634b247587-LHR
/
www.facebook.com/tr/ Frame 4EDA
0
51 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.trustwave.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Fri, 23 Jun 2023 13:33:29 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
trans.gif
788e8429e27e8b9da94d34e0b77c6a6b.azr.footprintdns.com/apc/
43 B
380 B
Image
General
Full URL
https://788e8429e27e8b9da94d34e0b77c6a6b.azr.footprintdns.com/apc/trans.gif?ba1a0faf77fd1c3b65ffc806d6d7a789
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1040:1502:2::2 Johor Bahru, Malaysia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:29 GMT
x-machinename
jhz20app010
x-content-type-options
nosniff
last-modified
Fri, 02 Jun 2023 00:46:28 GMT
server
Microsoft-IIS/10.0
etag
"392fdcaaeb94d91:0"
x-powered-by
ASP.NET
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName
x-endpoint
jhz20prdapp01
accept-ranges
bytes
content-length
43
x-userhostaddress
2001:ac8:21::
trans.gif
788e8429e27e8b9da94d34e0b77c6a6b.azr.footprintdns.com/apc/
43 B
110 B
Image
General
Full URL
https://788e8429e27e8b9da94d34e0b77c6a6b.azr.footprintdns.com/apc/trans.gif?f57ccd52085206aca3c8abdb1535dab6
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1040:1502:2::2 Johor Bahru, Malaysia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:29 GMT
x-machinename
jhz20app010
x-content-type-options
nosniff
last-modified
Fri, 02 Jun 2023 00:46:28 GMT
server
Microsoft-IIS/10.0
etag
"392fdcaaeb94d91:0"
x-powered-by
ASP.NET
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName
x-endpoint
jhz20prdapp01
accept-ranges
bytes
content-length
43
x-userhostaddress
2001:ac8:21::
trans.gif
172eb9c9bd1371270bc54b2ba963aa33.azr.footprintdns.com/apc/
43 B
377 B
Image
General
Full URL
https://172eb9c9bd1371270bc54b2ba963aa33.azr.footprintdns.com/apc/trans.gif?343c18507a594ec70336c852cc7868d0
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:111:f100:6000::4134:a6a1 Central, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:31 GMT
x-machinename
hk2app021
x-content-type-options
nosniff
last-modified
Fri, 02 Jun 2023 00:46:28 GMT
server
Microsoft-IIS/10.0
etag
"392fdcaaeb94d91:0"
x-powered-by
ASP.NET
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName
x-endpoint
hk2prdapp02
accept-ranges
bytes
content-length
43
x-userhostaddress
2001:ac8:21::
trans.gif
172eb9c9bd1371270bc54b2ba963aa33.azr.footprintdns.com/apc/
43 B
110 B
Image
General
Full URL
https://172eb9c9bd1371270bc54b2ba963aa33.azr.footprintdns.com/apc/trans.gif?32c6a03f981a5c9efaabd5b6eff6b069
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-dexter-malware-getting-your-hands-dirty/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:111:f100:6000::4134:a6a1 Central, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 23 Jun 2023 13:33:31 GMT
x-machinename
hk2app021
x-content-type-options
nosniff
last-modified
Fri, 02 Jun 2023 00:46:28 GMT
server
Microsoft-IIS/10.0
etag
"392fdcaaeb94d91:0"
x-powered-by
ASP.NET
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName
x-endpoint
hk2prdapp02
accept-ranges
bytes
content-length
43
x-userhostaddress
2001:ac8:21::
r.gif
www.atmrum.net/report/v1/atm/
7 B
162 B
XHR
General
Full URL
https://www.atmrum.net/report/v1/atm/r.gif?MonitorID=atm&rid=3a6ced0de543c9a99bf3f2fbf9ae7eb8&w3c=true&prot=https:&v=2017061301&tag=602cc9bb0a513db2b327299487211347&DATA=[{%22RequestID%22:%22847c3546cc49055feb7d840226086038%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:355},{%22RequestID%22:%22847c3546cc49055feb7d840226086038%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:68},{%22RequestID%22:%22788e8429e27e8b9da94d34e0b77c6a6b%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:860},{%22RequestID%22:%22788e8429e27e8b9da94d34e0b77c6a6b%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:193},{%22RequestID%22:%22172eb9c9bd1371270bc54b2ba963aa33%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:992},{%22RequestID%22:%22172eb9c9bd1371270bc54b2ba963aa33%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:225}]
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f82624464e9e95dfae29e0e54c360aff84dda3c419fc8c3bd10ef668bbe7df9e

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.trustwave.com
date
Fri, 23 Jun 2023 13:33:30 GMT
cache-control
no-store
x-msedge-ref
Ref A: DF9FA85A45AD4ECFA5C44CFB2105E62A Ref B: MAN30EDGE0819 Ref C: 2023-06-23T13:33:31Z
content-type
image/gif
__ptq.gif
track.hubspot.com/
45 B
1 KB
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211773&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
33e7b150-b6cf-4d88-845d-cc80a0ad687a
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
7
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
d52c3aec-8572-4562-8a92-f7bf231359ad
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B1p%2FKHg0X4pObVnwQS67Xr%2FbEsne4WBo%2BS6N86u6sYDgom75p3xBI2XUW%2B2Bq34c58ocZMjjLK90MNE7df5jJXvVHi8XXVqH6PggcPkeQ7hEg2yHfASsaSQuY%2F%2FyufK%2FW6WDc%2FyVaLVqGoHCyb7q"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-86grs
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a723c0c76c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
1 KB
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=68741a11-8e56-4f23-ba7f-b2307e77714c&fci=fb12f478-4ffb-4ba0-a519-5465ac4aa7db&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211775&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
ad1c8bbf-20fa-4f57-ba7b-e6510ffe96ec
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
3
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
04de463c-82ac-47a3-a8e7-a8366d1cc240
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2wWe4d1yMd8CsJowbNLqiXzlt3o4M65O3ZoVgVQJAtf5QylDRNc3aI%2BfT5SJZ8QpQlD9K1L%2FPXwdaDkNiv5zFSvV2j37XqyAPo2fGJ%2FbavQrcuqcr1WyfqQAlbyzLeRVRM58c3Ae2JG0vs9HNx7t"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-2c4rt
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a723c1976c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
635 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=68741a11-8e56-4f23-ba7f-b2307e77714c&fci=fb12f478-4ffb-4ba0-a519-5465ac4aa7db&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211775&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
1933f4fb-b954-4d31-9282-c3ccdaef60dd
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
3
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
968e35fe-ac75-431c-84fd-f5829f205b10
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mC%2BkSSkLdvZYg8j6u7A54hRiT1qeBRm8iMxQ7HTN7w%2B3wQAGgH7bI%2BMmZGMEV2rgUXowC7dki1iuSIPZkbHaYMfIZXR0JMR2IcpTjNWbwmfcvFfyAgTciOB9sy2XwhLyn8zmxEYyJ7RX5rAOGbC%2B"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-vrlgm
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a723c0f76c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
634 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=92358282-9e9e-4fe6-a21f-c30c1e55336d&fci=78ace515-2adc-4c98-b70e-a43d0c1855c3&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211779&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
8820303f-feb0-4572-b66b-11accebeceee
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
6
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
1bbe40fa-6ae2-4613-8067-b7e243063c2c
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZNgKcb7%2FZQfEBpoQ%2FOaeMxhbQmNkqQtmGDDkIns5z8L5vHqvQ9RZQd6FYBchRI9Tgr1Z9i11siQfdWA58Cx6Xyc8W8sZ%2Bg7w8aj3W7XFxv6SQ04Wj1oa13UOXw66IMEsF4s1TZoTBL6gWpSzOD%2Fg"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-z7z79
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a723c1476c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
598 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=92358282-9e9e-4fe6-a21f-c30c1e55336d&fci=78ace515-2adc-4c98-b70e-a43d0c1855c3&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211780&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
560e91b5-012f-4dc4-a3c8-2f987c4048d7
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
f1107595-d934-4339-b3d7-cb35a5810d91
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BsHb%2Fx%2F1sw8hij7NsCE8Pp2N11sGfQ%2FHUJE%2Bktat5J3k6zPxYeGn%2FeThzJnF8o0RMVMyWL4eAk%2FfEENbQzYH2Xh2PWkaGcdBW8nXmvL4wVk7JdlsC5jo2%2Bsdgh2M2Wt239m3IUNTqYopiPBnX%2BU5"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-86grs
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a723c1076c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
591 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=cfc901a2-eafd-46d4-a988-cdec75f02fd1&fci=7d29e574-a2da-41a9-8559-98e140daa0f0&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211781&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
ba8fece4-576b-47d0-aecc-fbeb838d5a26
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
4f0f1735-f142-49e4-98db-c56e72b493a7
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9V8UfC1gpuC0CEgOTm3Jc5kpyYbMjhIOPnyFmyLQU%2BjxzsZ1usnh8SyyXluW68BiAmpku4EcZF3GsuRTQ2ObidXdueeIaMji%2BJanL1eQr%2F6gL3fKztZPYDKgvuumePJPFmHDBD92S6WOA9jkvLb%2F"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-z7z79
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a723c1576c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
456 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=cfc901a2-eafd-46d4-a988-cdec75f02fd1&fci=7d29e574-a2da-41a9-8559-98e140daa0f0&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211781&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
0b5709a3-d39d-4fb8-9083-dd705a1af4e8
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
c8d8db34-562e-43ef-9df9-a01b0513e994
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y9ftb9LnIbZ3bb9VjLXHdqPb7a35J75cWEaHAum5afbgD%2BTOBPoWiVRybDyQnmXriRDnCVjNlL0CvJrJuILm2sZ88Q8n81S1LjTQthYBuAH9FnTNORqgLWnEI6Fd5ziitUdDq7osOo9fhNX8qu4x"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-xtt4j
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a732dbe76c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
436 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=de7ea1d6-a749-4248-88db-dc813310bec6&fci=aa6e491a-b187-427d-9dfc-cc2326ff097e&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211783&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
db43c002-4a11-46f9-ad8a-e76c67953c82
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
ad2be7b3-5402-4c92-9751-804c45269e84
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GMumUeDYgtAv4e%2FJZDGUCh2RyjzlFId6AScgGnEjrfKxthySY41AqbTyU2HGbBhxkepqnr9QjivZsGmYcjmG4viFC%2BGsCGNWmUOzZVRAjvB%2B60nj1gmAYCYkN3lRv5vKTgNB4h%2Bnp4UiWzzKoNHz"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-mc94g
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a732dbf76c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
439 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=de7ea1d6-a749-4248-88db-dc813310bec6&fci=aa6e491a-b187-427d-9dfc-cc2326ff097e&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211784&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
3f79590a-846f-4330-96eb-0c35cdd7e015
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
6
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
2c599b67-a24a-43ae-8f9e-d08dd7cfd048
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=huEjPtoxgCNZrVmrWy89RR%2Baw72HSAiYIrLdbBl%2BVLb9KeOuzyolCJGWtbs4Y1kgTIym%2BbChHLwJRtzTQtvsTr1sZuE%2FBiu81WY%2F9xekh0t2DbVDtw7ZjX17QzHJdNIM1AO32BWcXkPEy8pg70yM"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-86grs
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a732dc076c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
429 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=cfc901a2-eafd-46d4-a988-cdec75f02fd1&fci=c21b32c8-b7f1-4c98-9f9d-4278c2f09983&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211785&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
a4798988-a529-40e9-b1a8-07536354263f
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
472561da-0f86-44d9-88b8-252fb4d0b85d
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0970XbYDDMcc8W41q5Eqbg3nEvKq8ihiTUwivJj3sJRiZUq7YuOkIcUtpfBH0HjPEkRpFUcd2v2YSAkStiusc8PIiefOqhyPrutZYPbImCeFluynM4P3qN7kn8LWqiOmxJRhtoLnI4cUon0cV9cK"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-skh97
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a732dc176c0-LHR
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
830 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=cfc901a2-eafd-46d4-a988-cdec75f02fd1&fci=c21b32c8-b7f1-4c98-9f9d-4278c2f09983&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21158977&rcu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&pu=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&t=The+Dexter+Malware%3A+Getting+Your+Hands+Dirty+%7C+Trustwave+%7C+SpiderLabs+%7C+Trustwave&cts=1687527211785&vi=49da852de09cf1c1b8d8e40cc8cd7457&nc=true&u=94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1&b=94548739.1.1687527211770&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 13:33:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
326c237e-5bd4-45ef-b5c3-c82436380af3
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
3
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
365e1014-5e4d-4a69-81c4-d9bd6f69918c
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lo6ACc8KcGVZIB4u6qHp8bZbTvYnsu7dZ3vuvHTCQF05IynjNG1%2FwqdiBZdb8SdzUNaKEoxbc2QlAytX5vFTGb%2B%2BSNoVq8n8lyC9lwAvtgiD0Fiye7NTTcHv43HnD%2F6lE%2B8Z6z5I38K040aiAoNn"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-8bmqp
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dbd1a732dc276c0-LHR
x-robots-tag
none
track
dc.services.visualstudio.com/v2/
98 B
306 B
XHR
General
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.212 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
20bc4e72a5f8dd72675a3ade2136dcce5665d9f698ae007b6ae0956256b48fce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
accept-language
en-GB,en;q=0.9
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
9B354A43-D9A7-4E5B-86BD-5A59E52336D5
strict-transport-security
max-age=31536000
date
Fri, 23 Jun 2023 13:33:32 GMT
x-content-type-options
nosniff
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
98
track
dc.services.visualstudio.com/v2/ Frame
0
0
Preflight
General
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.212 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,sdk-context
Access-Control-Request-Method
POST
Origin
https://www.trustwave.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
3600
content-length
0
date
Fri, 23 Jun 2023 13:33:31 GMT
x-content-type-options
nosniff

Verdicts & Comments Add Verdict or Comment

178 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 boolean| credentialless object| onbeforetoggle object| onscrollend object| OneTrustStub function| OptanonWrapper object| dataLayer string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| appInsights object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client number| SThreshold number| globalmktoid boolean| globalpartnerform boolean| globalfooterform function| $ function| jQuery object| Optanon object| OneTrust object| AI object| Microsoft function| __extends function| _endsWith object| hubspot object| HubSpotForms object| _hsq object| hbspt object| hsFormsOnReady object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| FormAbandonmentTracker string| ajaxReq function| autoSuggest string| navAjaxReq function| navAutoSuggest function| formatNumber function| formatCurrency object| loadmorexrh function| objectifyForm function| trim function| rgb2hex function| rgbaToHex function| UpdateResults function| ShowHideLoadMore function| LoadingOn function| LoadingOff function| LoadMore function| GetCurrentLang function| MediaReleases function| closeResetMobile function| closeResetDesktop string| currentCheckSize function| checkSize function| FixScrollOnLoad function| doMenu function| MainMenu function| CardListCheckForZero function| OutputFooterGlobalForm function| FixButtonColorsinSections function| AddAusiLogo function| AddAPACLogo function| AddTaglineToLogo function| LoadDefaultMKTOForms function| FixConsoleErrors function| FixFooterSectionColorAngle function| ScrollToScript function| SpecialEventMenu function| PressReleases function| ToggleFilterOptions function| ResourceLibrary function| pushToAnalytics function| nextPart function| SearchResults function| SLBlog function| CardHeroSliders function| CardLists function| CardListOurHistory function| SWUpdates function| TWBlog function| getParameterByName function| jsonToUrl function| SetupImgClickToVideo object| videoLabels object| lastP object| _playerTitle object| _playerAuthor object| _playerAuthorURL object| _playerUploadDate function| Vimeoinit function| updateUrl function| onMessageReceived function| post function| getLabel function| getVimeoInfo function| vimeoCallback function| onReady function| onPlay function| onPause function| onPlayProgress function| getUrlParameter object| Modernizr function| Cookies function| pluralRuleParser function| TWFilters object| MktoForms2 function| TWLang object| mktoprefilldata function| TWMkto function| TWStepsForm function| supportInfo function| gaUTM string| GoogleAnalyticsObject function| ga string| _linkedin_data_partner_id function| twq object| GooglebQhCsO function| fbq function| _fbq object| _mfq object| recaptcha object| Vimeo boolean| VimeoPlayerResizeEmbeds_ boolean| VimeoSeoMetadataAppended boolean| VimeoCheckedUrlTimeParam function| onYouTubeIframeAPIReady object| gaGlobal function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| regeneratorRuntime object| twttr object| google_optimize function| lintrk boolean| _already_called_lintrk object| rum object| MunchkinTracker object| _hsp object| closure_lm_644161 object| mouseflowHeatmap object| mouseflow object| gaplugins object| gaData object| Footprint boolean| PIXELS_RAN object| enabledEventSettings object| fpconfig object| __hsCollectedFormsDebug boolean| _hspb_loaded boolean| _hspb_ran function| filterHandler object| _paq function| sanitizeKey boolean| _hstc_loaded function| setImmediate function| clearImmediate object| __ldm_rgx object| __ldm_uid undefined| __ldm_img boolean| _hstc_ran string| __hsUserToken number| expireDateTime

33 Cookies

Domain/Path Name / Value
.www.trustwave.com/ Name: ApplicationGatewayAffinity
Value: bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
.www.trustwave.com/ Name: ApplicationGatewayAffinityCORS
Value: bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
.fonts.net/ Name: __cf_bm
Value: 1RvLae89RQKQhLz3EGqo5xPJOqyOra7H.be_PFtRaRc-1687527207-0-AaIHjBJGHJkZ3K9tSjcyK5IdzJjuBzxCOaBfQ7XQ0P0JlUceodSd3oiGHeSDZf9pQQZW81DAZMt0FSqWzdhgUeg=
.vimeo.com/ Name: __cf_bm
Value: 9cBNP.w1QYrDWSdiF9iNKDuxwhsTmCJN9TD.2L7xI0k-1687527208-0-AalG2kJNy9Y6TL1fjNrsspLmowkQI43HRqKb9REw+yiAf3w35QfmZxCFswAhEWfhnBDrcus8+VZrWsY4gUWYeDk=
www.trustwave.com/ Name: ai_user
Value: fmEs4|2023-06-23T13:33:28.294Z
.trustwave.com/ Name: _gcl_au
Value: 1.1.278850928.1687527208
www.trustwave.com/ Name: ai_session
Value: bS3zJ|1687527208574.5|1687527208574.5
.trustwave.com/ Name: _ga_DP8B111F8E
Value: GS1.1.1687527208.1.0.1687527208.60.0.0
.trustwave.com/ Name: _mkto_trk
Value: id:815-RFM-693&token:_mch-trustwave.com-1687527208699-36915
.doubleclick.net/ Name: IDE
Value: AHWqTUmf2quqS5chGyOrs-QQpS2pK3hw-hYKUzCYyPIRb566ZF13h9Qh5FbUN1U89RQ
.t.co/ Name: muc_ads
Value: fc2d88dc-e3fd-48a5-8d57-77cba48cf300
www.trustwave.com/ Name: ln_or
Value: eyI3MDY1MiI6ImQifQ%3D%3D
.twitter.com/ Name: personalization_id
Value: "v1_e+03EsY8+gqhX96/biNNUA=="
.trustwave.com/ Name: mf_96dff353-a928-44b4-b1d0-6432c69133ba
Value: |.-1724553305.1687527208859|1687527208859||0|||0|0|60.82634
.trustwave.com/ Name: _ga
Value: GA1.2.1823390258.1687527209
.trustwave.com/ Name: _gid
Value: GA1.2.814342874.1687527209
.trustwave.com/ Name: _gat_UA-123880220-1
Value: 1
.linkedin.com/ Name: li_sugr
Value: b75679a6-f9f2-48cb-af3d-788a42271303
.linkedin.com/ Name: bcookie
Value: "v=2&24828634-8257-4f1d-8a6e-f39b6518b01e"
.linkedin.com/ Name: lidc
Value: "b=TGST02:s=T:r=T:a=T:p=T:g=3036:u=1:x=1:i=1687527208:t=1687613608:v=2:sig=AQFiW3nfh5BdDWotIPDpjR6jKXLJNwkX"
.trustwave.com/ Name: _fbp
Value: fb.1.1687527208952.1676477776
.www.trustwave.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Fri+Jun+23+2023+13%3A33%3A29+GMT%2B0000+(GMT)&version=202305.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-dexter-malware-getting-your-hands-dirty%2F&groups=C0001%3A1%2CC0002%3A0%2CC0004%3A0%2CC0003%3A0
.linkedin.com/ Name: UserMatchHistory
Value: AQL7P5PyZ_RG4wAAAYjodbhrFZsR5xmR79iZ6tbncxma0Z61qcXvXAecsKR0bywgOD_NFm6yfHIduQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKAc7hA-yZLuwAAAYjodbhri0c9kvsdaArdtTuW6uccnC4LTro99jL4DW4N4Vg1K6b3nFMvsKp10XW6rf6S1w
www.trustwave.com/ Name: d-a8e6
Value: 8694a161-66ab-4bbc-8984-e7355569be21
www.trustwave.com/ Name: s-9da4
Value: a6ada831-0b41-4d3f-9dd7-6c9cae972627
.www.linkedin.com/ Name: bscookie
Value: "v=1&202306231333293e2d937f-7246-49ac-8a8d-9b5225c5f446AQHas65SjePmPbkACzRVtioPp8D7Zgz7"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODc1MjcyMDk7MjswMjHk/TUk6v2kwe6fZkGG3LL4Jq2jcANb4K7c1RFdDoOVSg==
.trustwave.com/ Name: __hstc
Value: 94548739.49da852de09cf1c1b8d8e40cc8cd7457.1687527211769.1687527211769.1687527211769.1
.trustwave.com/ Name: hubspotutk
Value: 49da852de09cf1c1b8d8e40cc8cd7457
.trustwave.com/ Name: __hssrc
Value: 1
.trustwave.com/ Name: __hssc
Value: 94548739.1.1687527211770
.hubspot.com/ Name: __cf_bm
Value: nCRJd6AsMGOhDbQyArcSU1iptg0ElF6WHP_ANw3Bqfw-1687527211-0-AW/7ArCT5NbfO3KvxTSxyvZ1lRa4KcfWZfbgJHCOTiuclfGkD2yIOr3XX03gHAYvgmUyX5deXhnJo2zWFjXzEaA=

1 Console Messages

Source Level URL
Text
network error URL: https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10419288.fls.doubleclick.net
172eb9c9bd1371270bc54b2ba963aa33.azr.footprintdns.com
788e8429e27e8b9da94d34e0b77c6a6b.azr.footprintdns.com
815-rfm-693.mktoresp.com
847c3546cc49055feb7d840226086038.azr.footprintdns.com
9785483.fls.doubleclick.net
adservice.google.com
analytics.twitter.com
api.hubapi.com
az416426.vo.msecnd.net
cdn.linkedin.oribi.io
cdn.mouseflow.com
cdnjs.cloudflare.com
connect.facebook.net
cookie-cdn.cookiepro.com
dc.services.visualstudio.com
fast.fonts.net
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
googleads.g.doubleclick.net
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
match.adsrvr.org
munchkin.marketo.net
player.vimeo.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s7.addthis.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
track.hubspot.com
trustwave.azureedge.net
trustwave.blob.core.windows.net
vidassets.terminus.services
wec-assets.terminus.services
www.atmrum.net
www.facebook.com
www.google-analytics.com
www.google.co.uk
www.google.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.trustwave.com
104.102.38.132
104.244.42.131
104.244.42.197
13.107.42.14
13.32.145.123
13.69.106.212
142.250.186.166
146.75.116.157
15.197.193.217
151.139.128.10
162.159.138.60
199.15.214.243
2.19.224.115
2001:4860:4802:34::178
2001:4860:4802:34::36
204.79.197.234
2600:9000:2171:e200:2:53b2:240:93a1
2603:1020:1001:6::37
2603:1040:1502:2::2
2606:2800:133:206e:1315:22a5:2006:24fd
2606:4700::6810:79be
2606:4700::6810:8bce
2606:4700::6810:bb41
2606:4700::6811:180e
2606:4700::6811:6ac7
2606:4700::6811:cccc
2606:4700::6811:d6f3
2606:4700::6811:e14e
2606:4700::6812:1153
2606:4700::6812:19c4
2606:4700::6812:883b
2606:4700::6813:9a53
2620:1ec:21::14
2a00:1450:4001:803::2003
2a00:1450:4001:806::2003
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:813::200a
2a00:1450:4001:831::2004
2a00:1450:4001:831::2008
2a00:1450:400c:c0b::9d
2a01:111:f100:6000::4134:a6a1
2a02:26f0:480:f::213:7edd
2a02:26f0:780::210:a409
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
52.151.96.240
52.222.169.121
52.239.171.228
02ca49fda602d411bc21fbfa941871cd8944352e3ffb6b289b4f86eb1849a6c5
06c786e9992af6b25c5547beaac5142b1378c64e3c8ecac51f4ca8d55a104d35
08529955a8d9e583dacd78d8ade75159e0869e25766fba0ac911d5fa3e3b234b
088dbe5e4bb2f902e2e7c62ca7a15bae5cb55f4708d99f7c4daae7148a19a865
092a690c556396c5c85bb83728e427187415bcc74a7be26c340d0d3affd70129
0be44b8963766e88bfb1034f5cf93deb8710ec30e7a54537ff463951c5976234
0c7bfd4207c811df43b95b8e0f3cc33e108082555d4e97690a48f96c7c3cf7ef
1199b8c9c9a6f7e263f73ef9c298a3ad54299871c3e2db28b19d7cd1b1010926
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1f0d907e14654e6eeb88cf14035fdff4081be0f4bb5b0d1e45245bf32ea50721
2071a3274f291c02c034caf6889a9e7267640862d6d22d348507e929534e74f3
20bc4e72a5f8dd72675a3ade2136dcce5665d9f698ae007b6ae0956256b48fce
21c3d65ef1a0105fb3114d843bd4c68e474e7571db6b0af5ca759fbfec9eca81
266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d
2a6d7a06a4458b56f188177654688a18648aaf4800feee0a4a09a858f46bc920
2f9b0cdbb9f529ab9f9f41a261a39aceab600ec996c86494b03df12340ac1326
32ea28e4cc9fb2662d406bc5e859f774b58f927861c31864c33cb81aa8263aac
399275d88086e4012aa96f7769747462bee9f414f38ab6df75ac13dbc03ccfe1
3b40a93cfffc7cc88b425c84b80cf85f60577787fb1e9a0a77acbe1f3bd6389d
3c25b077a6d92cd9d3576660b68c4c0bd135b78b3cd3b66491ff2c7aa0eeaad3
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f18aeab9b9baa3e61c4bc2cd0372e3946f494bd03bff3cad740e5ea817fce2b
4101a7d45447d50e29f61f57dd05dc801bacb58d9a84cabfe5fce345c927c879
42f2f65a52347bf6ed6c0633b5458c48ddc1b439923c92caec18c6d6f111afe3
4ceaac0057298644fd3fd7f2a4ccb13837823f4d63658d62e73be0cdf7b1d9c0
4d84802c2cc3550892199289d28a046c4e1d011964c7c7f9d43bdeebecf107de
4e01c98e627574457dc4a7251f0b5a3d8ca22fc72fe7127db1ebd63e36a06a70
4e5ab440329cd7d94538bc256cd00097682d6dcfb803cc0e9e64cfab683831dc
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5615de849cb183806fc73839e8794e965d563d0ac22b20529b1bff2b6630cfeb
5948fc8f016a175f6dc4b0e00bc4dbbc93875315d7af4469ab7e4c0c47f4c269
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
5f8bc26c4789780ae3a330a2d348a7c806e3e019f852d543937745e0512d4e62
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
631704da3b9efddcf53ac90d032ba3b0df74cd997adf6e9cb8d2745a153908cf
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
68e318c58c5a8e85cf16359b0897e1766a64528353a5db53843a4dffbf097baf
68ef234d3e989dcdfb6bfc9e7f2a14a6d2638181575d2cf7a820ab52ee6452b8
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b27db9a7ed1c92ffb635d474249023209341291b21dea9da8e0b636dbae288a
72766f736186eb5c7c6d08502f3bf28da0092e8ea85cf3b5413c9daf8dc2d94a
752d16411f4866d01a2fc6c8f984da8104367e264a8865a63714e2f8181f5a73
77cf16e1867991ea4ed7fb6d470e613528693de636fb0f1352936cc480e180ae
7b0ef13b754c456f5621d74ca260e49b061f759bcaeb9223e0eaa78ff4359189
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7cdd1ac485682bdbec3acd13ad2f7121dc33a37c8b1b9e295dccf11cab871a0a
7f148a333a7585ab1391cceb303d946f5bf1b38ba6bb8eae863125ccde728bb3
8032d79deba14b8b207f78489b5cb3b7dd8c39e3519688988e075c30aa128157
804489be180651865e9d058dbbacfa6bb294075415c70c3bb7f75f44be8f1b00
809765ad9401369a9a87159ade197a7893be54c78de5e0c1995f77efbde4a286
80afdcdab5af95e11f8edac404947668a91582b9799723a8d5272483a010f23d
81c6d71111c799f222de79bd233811437f9970ac702306fb402f3de576c7cf54
81ca1f14c472917fc81a9c10ad36994b8a79b65334d8bd9f2728d35e50ce0048
85617163a0d798f5865addd9cb026438b1096093b4cac1838630ad93ebfdf4b4
87289efaf9cc62bd74432c4048229f1f1f1108973a99460d5676c4caa4fb4923
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8df4e2508308452516a8972eb7d993d970eefeea6705487b0e100c0fa7b4b447
9178d19c46b5a36fc8d4de24aa7fef3b62e7f69c259f4e81ee3f2d5aba263216
932082305544d3426acaefac13815f07c276046aee77847071d1dfc1754636e4
945621ea8bca0474945d87e6bb8fd741a33492c56446666a007ae09d6c6ba228
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
98e67b7c00d3ed50871865e8acf0381d72b909eb2360b56261061c9be60bde9e
9998a28912966aa8ae78c7bae4b70bce32095ac4cafb972428f96c60bf374a98
9a2b09b1bd7190df58b8462804537f71a64e447921a03e62dc16148f9c433511
a4c6f490f7db151fb0dd9ce3339d17fdc511dabe0252f5b73bdf67b20268b107
a6843d5ffd9052e631f84994401389694fd86b7cff2f9910ec6a28814cbb6b03
a76b2bc12b0e3c9536c8c0c3af4170cc66c19ff44fb96326aa6b542ee272365f
a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
aa355c393e03f831dbdbcc678ba16396aab95930b1bc5b0549695d40cc955ca1
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acb597f6847f2877c81754fdb6a4b483cc05516c2a87865c8d0d02307b670c65
acef92feebd51825074dd2144d4e75e36e6e880faebe6336b7f9ccc205e03c31
ade67c971739ab79fbedbc35fe91c27160b196308c28e544ead290df364b35c9
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b016380c1e5281bf5629d39c1dd2d79d1d8eec45e77f69d7f101105b93e813e0
b0f35cc025dc27ea345536d4eafc13e52fe2b1c237fd6c4150d4dbf85c323c27
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b53419cecf347820d8fec7a6300d98dfe17fbb325d74683a8010e0a96f888e5d
b5e5c5c8b9ebe9fb7f4a8cde7f2ff4f6652e6beb87585c18e99fb446fbb301a4
b87c7ea9a9fa02e7868c8a0ed7de074c906f15837c28f3a991204938078cbee8
b9833a558a67d159aa6139bb0b9168560a37f580ae04654ccc7b6b1ce0d75ea6
b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b
cbbd42bb1d88693e6805bd9d676840424af5ecf3e13d874fd06e6b57d53d8d40
cddda5bfbb5cfd3c61a5ae0075a6b5719d1eca08ce1575fe1bad14fe7f79a5f8
cf7008a1bb1e7dcffa096b3f0c782f3dd610f847413ae4861a5c03006f093553
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0c233d327541d2961f1cde9e53a6166279655f4d4041c1bc458ac1701827719
d55ad3bc35664e6ce9dc3e6a71bb6d3a4c8fddeb6af1a195727c0361ddd92a2e
dbc438358bff6d1933a1bf280a0c0bd2f4f30864487a12cc0526acd877a9e636
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e103929dd758126ea4a090ff0e33b620f3ceb1b81ffad1345023c95661c84d8c
e2167b750ec6c628236ee97382f751a23f2eef0f27067492e2f51d4cadd1e66d
e284ec9da0c8c1d6e7e991fbc111b1cbb682a0bc40b084c176ac1ebc43b5aab0
e2b9de667ed27a028d643fce70755ad477a649d10d516a9cd0fb0b567e9b16d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1
ed3a69e3267f056582ed012f7252319adb227fed203a4781eb820ea732aa4594
ed8376e9badc551507bafcee5df98369b04c2091086bd161f641209d558e603c
eec92db3906701a283982a9ea481e806b6fd01fb2efb2c802cba1c376b19c2f5
ef1874f11501aa7118cdfa7af21a9ef1c87301e917881dc941831b122d82b34a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f82624464e9e95dfae29e0e54c360aff84dda3c419fc8c3bd10ef668bbe7df9e