urlscan.io logo urlscan.io
SecurityTrails logo

www.cyber.nj.gov Open in urlscan Pro
45.60.124.188  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Submission: On January 13 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 20 IPs in 4 countries across 18 domains to perform 55 HTTP transactions. The main IP is 45.60.124.188, located in United States and belongs to INCAPSULA, US. The main domain is www.cyber.nj.gov.
TLS certificate: Issued by GlobalSign CloudSSL CA - SHA256 - G3 on November 10th 2020. Valid for: a year.
This is the only time www.cyber.nj.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

18    45.60.124.188 (United States)

ASN19551 (INCAPSULA, US)
www.cyber.nj.gov
2    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
4    2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)
stackpath.bootstrapcdn.com
1    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
7    2600:9000:20e8:2c00:17:108e:3bc0:93a1 (United States)

ASN- ()
cdn.buttercms.com
1    143.204.214.7 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-214-7.fra53.r.cloudfront.net
d33wubrfki0l68.cloudfront.net
1    2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)
cdn.polyfill.io
1    2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
1    2a04:4e42:3::621 (Ascension Island)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
3    2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
6    104.75.88.112 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com
s7.addthis.com
v1.addthisedge.com
m.addthis.com
1    99.86.7.62 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-7-62.fra6.r.cloudfront.net
app.artibot.ai
1    2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com
1    34.204.38.77 (Ashburn, United States)

ASN- ()
PTR: ec2-34-204-38-77.compute-1.amazonaws.com
api.artibot.ai
2    2606:4700:3032::6812:3770 (United States)

ASN13335 (CLOUDFLARENET, US)
prod.artibotcdn.com
1    2600:9000:2057:ca00:a:e02a:3080:93a1 (United States)

ASN- ()
api-cdn.prod-aws.artibot.ai
1    52.217.74.54 (Ashburn, United States)

ASN- ()
PTR: s3-1.amazonaws.com
s3.amazonaws.com
Domain Requested by
18 www.cyber.nj.gov 1 redirects www.cyber.nj.gov
7 cdn.buttercms.com www.cyber.nj.gov
4 stackpath.bootstrapcdn.com www.cyber.nj.gov
3 s7.addthis.com www.cyber.nj.gov
s7.addthis.com
3 fonts.gstatic.com fonts.googleapis.com
2 prod.artibotcdn.com app.artibot.ai
2 m.addthis.com s7.addthis.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts.googleapis.com www.cyber.nj.gov
1 s3.amazonaws.com
1 api-cdn.prod-aws.artibot.ai prod.artibotcdn.com
1 api.artibot.ai app.artibot.ai
1 v1.addthisedge.com s7.addthis.com
1 z.moatads.com s7.addthis.com
1 app.artibot.ai www.cyber.nj.gov
1 cdn.onesignal.com www.cyber.nj.gov
1 cdn.jsdelivr.net www.cyber.nj.gov
1 code.jquery.com www.cyber.nj.gov
1 cdn.polyfill.io www.cyber.nj.gov
1 d33wubrfki0l68.cloudfront.net www.cyber.nj.gov
1 www.googletagmanager.com www.cyber.nj.gov
55 21

This site contains no links.

Subject Issuer Validity Valid
incapsula.com
GlobalSign CloudSSL CA - SHA256 - G3		 2020-11-10 -
2021-10-28		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2020-09-22 -
2021-10-12		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.buttercms.com
Sectigo RSA Domain Validation Secure Server CA		 2020-01-08 -
2022-02-06		 2 years crt.sh
*.cloudfront.net
DigiCert Global CA G2		 2020-05-26 -
2021-04-21		 a year crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-10-26 -
2021-04-17		 6 months crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA		 2020-10-06 -
2021-10-16		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-04 -
2021-08-04		 a year crt.sh
*.gstatic.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
odc-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2021-01-10 -
2021-04-07		 3 months crt.sh
*.artibot.ai
Amazon		 2020-06-17 -
2021-07-17		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2021-03-17		 a year crt.sh
artibotcdn.com
Cloudflare Inc ECC CA-3		 2020-06-15 -
2021-06-15		 a year crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2020-08-04 -
2021-08-09		 a year crt.sh

This page contains 3 frames:

Primary Page: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Frame ID: 68F1E8BB58D34FDAABB48C63D9BE4B9B
Requests: 54 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: A73E8F0D4B7245EBFD864642D9A81356
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: CCCC21F809CA5FD778253222FF83EA37
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server HTTP 301
    https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^Netlify/i

Page Statistics

55
Requests

98 %
HTTPS

63 %
IPv6

18
Domains

21
Subdomains

20
IPs

4
Countries

1154 kB
Transfer

2531 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server HTTP 301
    https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

55 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Redirect Chain
  • https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server
  • https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
70 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
4e61f234ac935adcab3f23735da30aac5c40efbb7b817b5252989ab8e3c82b9f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.cyber.nj.gov
:scheme
https
:path
/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
visid_incap_1613844=Zon4ZltVRpyBGJQtmZVSergi/18AAAAAQUIPAAAAAABxzItffUOxcPGizrdC8MXo; nlbi_1613844=lroXLxQ7UVEVQz3U3cr+KQAAAAD0GHob8Ru0phDeS6B3R4HK; incap_ses_689_1613844=eS/zMoNogiGMju9XGNKPCbgi/18AAAAA+5LHqNZqEBNIR2pXHmLBtw==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control
public, max-age=0, must-revalidate
content-type
text/html; charset=UTF-8
date
Wed, 13 Jan 2021 16:41:29 GMT
etag
"bfcc063d15d16789c733641db5455fdc-ssl-df"
link
</webpack-runtime-a939015598694077f1cd.js>; rel=preload; as=script, </framework-d07e798e75df4962e595.js>; rel=preload; as=script, </app-16f94bb620e9a8369a94.js>; rel=preload; as=script, </styles-89fd2ae28bdf06750a71.js>; rel=preload; as=script, </b637e9a5-e4fc7cc246e7fc8ae5bc.js>; rel=preload; as=script, </d722a0b62ad350f2f0241c9f58b3048aaa7ce11d-6b1aeda3a4371b811462.js>; rel=preload; as=script, </component---src-templates-markdownpage-js-1b2acd48cc2755b3867c.js>; rel=preload; as=script, </page-data/app-data.json>; rel=preload; as=fetch; crossorigin, </page-data/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/page-data.json>; rel=preload; as=fetch; crossorigin
referrer-policy
same-origin
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
content-encoding
gzip
age
0
server
Netlify
vary
Accept-Encoding
x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15733980
x-cdn
Incapsula
x-iinfo
12-3902700-3902701 NNNN CT(19 19 0) RT(1610556088820 0) q(0 0 0 -1) r(2 2) U12

Redirect headers

cache-control
public, max-age=0, must-revalidate
content-type
text/html; charset=UTF-8
date
Wed, 13 Jan 2021 16:41:29 GMT
etag
"bfcc063d15d16789c733641db5455fdc-ssl-df"
link
</webpack-runtime-a939015598694077f1cd.js>; rel=preload; as=script, </framework-d07e798e75df4962e595.js>; rel=preload; as=script, </app-16f94bb620e9a8369a94.js>; rel=preload; as=script, </styles-89fd2ae28bdf06750a71.js>; rel=preload; as=script, </b637e9a5-e4fc7cc246e7fc8ae5bc.js>; rel=preload; as=script, </d722a0b62ad350f2f0241c9f58b3048aaa7ce11d-6b1aeda3a4371b811462.js>; rel=preload; as=script, </component---src-templates-markdownpage-js-1b2acd48cc2755b3867c.js>; rel=preload; as=script, </page-data/app-data.json>; rel=preload; as=fetch; crossorigin, </page-data/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/page-data.json>; rel=preload; as=fetch; crossorigin
referrer-policy
same-origin
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
age
1
server
Netlify
location
/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15733696
set-cookie
visid_incap_1613844=Zon4ZltVRpyBGJQtmZVSergi/18AAAAAQUIPAAAAAABxzItffUOxcPGizrdC8MXo; expires=Thu, 13 Jan 2022 12:09:10 GMT; HttpOnly; path=/; Domain=.cyber.nj.gov nlbi_1613844=lroXLxQ7UVEVQz3U3cr+KQAAAAD0GHob8Ru0phDeS6B3R4HK; path=/; Domain=.cyber.nj.gov incap_ses_689_1613844=eS/zMoNogiGMju9XGNKPCbgi/18AAAAA+5LHqNZqEBNIR2pXHmLBtw==; path=/; Domain=.cyber.nj.gov
x-cdn
Incapsula
x-iinfo
12-3902691-3902692 NNNN CT(19 153 0) RT(1610556088166 0) q(0 0 2 0) r(2 6) U11
webpack-runtime-a939015598694077f1cd.js
www.cyber.nj.gov/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/webpack-runtime-a939015598694077f1cd.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
ba8241d61ea163d34977e3e3d8d1ebb2b25af4fb764c155848270524ce8e4d0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734234
date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
2
x-iinfo
12-3902706-3900355 2NNN RT(1610556089128 0) q(0 0 0 -1) r(7 7) U18
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"d1bd0f8c5dae3e19eecc181c5c519504-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
framework-d07e798e75df4962e595.js
www.cyber.nj.gov/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/framework-d07e798e75df4962e595.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
dfdc5f5bbac471e6205f5d0371621a3ba44090604abb289d978b4f7642fab0b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734236
date
Wed, 13 Jan 2021 16:37:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
233
x-iinfo
12-3902707-3890120 2NNN RT(1610556089130 0) q(0 0 0 -1) r(2 2) U18
strict-transport-security
max-age=31536000
content-length
8032
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"5c9e5c63306011073f5a0b784b1adf54-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
app-16f94bb620e9a8369a94.js
www.cyber.nj.gov/ 		56 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/app-16f94bb620e9a8369a94.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
bd9dabb9f6c8915564d3a3343299079c6f3c05e7fd0402b1e20c1d145fddf6c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734237
date
Wed, 13 Jan 2021 16:37:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
233
x-iinfo
12-3902708-3899757 2NNN RT(1610556089131 0) q(0 0 0 -1) r(2 2) U18
strict-transport-security
max-age=31536000
content-length
15923
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"424bdc9e0c2a7f3ffeb6754b1f66b662-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
styles-89fd2ae28bdf06750a71.js
www.cyber.nj.gov/ 		61 B
256 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/styles-89fd2ae28bdf06750a71.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:28 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"ff3bedcc6844fb7f291cb7f061de9b23-ssl"
content-type
application/javascript
x-iinfo
12-3902709-3896289 2CNN RT(1610556089132 0) q(0 0 0 -1) r(0 0)
cache-control
max-age=86400, public
content-length
64
expires
Thu, 14 Jan 2021 16:41:28 GMT
b637e9a5-e4fc7cc246e7fc8ae5bc.js
www.cyber.nj.gov/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/b637e9a5-e4fc7cc246e7fc8ae5bc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
bc88f3eacce909d8c8bbd609e539ff1e54ac78950d70e341ed9b0e5e4b702447
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734238
date
Wed, 13 Jan 2021 16:35:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
388
x-iinfo
12-3902710-3900829 2NNN RT(1610556089133 0) q(0 0 0 -1) r(3 3) U18
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"2849a41c72cdbbaafbcbb95952f27ecf-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
d722a0b62ad350f2f0241c9f58b3048aaa7ce11d-6b1aeda3a4371b811462.js
www.cyber.nj.gov/ 		68 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/d722a0b62ad350f2f0241c9f58b3048aaa7ce11d-6b1aeda3a4371b811462.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
1f0c7441f74e00d960abc404a5725fd07b6af5482333fe46f29848f7f14b162d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734241
date
Wed, 13 Jan 2021 16:41:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
1
x-iinfo
12-3902711-3897102 2NNN RT(1610556089133 0) q(0 0 0 -1) r(5 5) U18
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"07b9c9010048b1e7d479dcd92f37114e-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
component---src-templates-markdownpage-js-1b2acd48cc2755b3867c.js
www.cyber.nj.gov/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/component---src-templates-markdownpage-js-1b2acd48cc2755b3867c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
53d4c90fc706a40d00ebfa18f16c6c8ac97b67f602dbb05982c200afe0edea55
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734262
date
Wed, 13 Jan 2021 16:37:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
233
x-iinfo
12-3902712-3899096 2NNN RT(1610556089134 0) q(0 1 1 -1) r(3 3) U18
strict-transport-security
max-age=31536000
content-length
1140
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"4d23d62535c807036da67c45184496fa-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
app-data.json
www.cyber.nj.gov/page-data/ 		50 B
263 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/app-data.json
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
1282bafb3ecc3a0f4b3395431317e5a15abf2d90e5178fd3735e87b546365480
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734370
date
Wed, 13 Jan 2021 16:20:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
1232
x-iinfo
12-3902713-3902701 PNYN RT(1610556089135 0) q(0 2 2 -1) r(4 4) U2
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"b3754796f2a79d4cd9ee13f56dbf4021-ssl"
strict-transport-security
max-age=31536000
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
page-data.json
www.cyber.nj.gov/page-data/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/ 		3 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/page-data.json
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
b5f7a3cf571c7c0f28de227c1983b1763a21bd1be994051e21c58479ddf60e85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734396
date
Wed, 13 Jan 2021 16:41:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
0
x-iinfo
12-3902714-3902722 NNNN CT(20 20 0) RT(1610556089135 0) q(0 2 3 -1) r(7 7) U2
strict-transport-security
max-age=31536000
content-length
1648
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"08031dab6c6b132b54ac329228de3c25-ssl-df"
vary
Accept-Encoding
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
css
fonts.googleapis.com/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
eb44351770766acbacdbf18621074a995f3db9766f5bd3533a2da4c27ac4f489
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 13 Jan 2021 16:41:29 GMT
server
ESF
date
Wed, 13 Jan 2021 16:41:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 13 Jan 2021 16:41:29 GMT
2001626772.json
www.cyber.nj.gov/page-data/sq/d/ 		6 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/sq/d/2001626772.json
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
8c93c91a88cce024ff3ee16ff346aa8b4bbb401504162634dab00df69ca9af57
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734413
date
Wed, 13 Jan 2021 15:56:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
2699
x-iinfo
12-3902717-3902725 NNNN CT(19 21 0) RT(1610556089248 0) q(0 2 2 -1) r(2 3) U2
strict-transport-security
max-age=31536000
content-length
1293
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"8542314d9bdf9dc5d6460ebdd1e8de1b-ssl-df"
vary
Accept-Encoding
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
2628674228.json
www.cyber.nj.gov/page-data/sq/d/ 		719 B
497 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/sq/d/2628674228.json
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
022278202b62f09d48ced661ad9d8116bf0bb72aecf1d4c06fc15377e8d99334
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734459
date
Wed, 13 Jan 2021 15:56:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
2699
x-iinfo
12-3902718-3902701 PNYN RT(1610556089249 0) q(0 3 3 -1) r(4 4) U2
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"9dd3e28fe347ac95938ae143e74de449-ssl"
strict-transport-security
max-age=31536000
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
2769593191.json
www.cyber.nj.gov/page-data/sq/d/ 		8 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/sq/d/2769593191.json
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
fc15c8cc0362c2bdfff31836712656a9380e29015482afbe5fa5a16bf516b56d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
1917d5e3-e0e8-497e-ae5d-2ca36165c3d2-15734489
date
Wed, 13 Jan 2021 15:56:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
2699
x-iinfo
12-3902719-3902728 NNNN CT(19 20 0) RT(1610556089249 0) q(0 3 3 -1) r(5 5) U2
strict-transport-security
max-age=31536000
content-length
2076
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"2cb0cf686a1763df2388c3a81fc2c73e-ssl-df"
vary
Accept-Encoding
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 		157 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Aug 2020 16:43:41 GMT
etag
"1596732221"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
23876
js
www.googletagmanager.com/gtag/ 		96 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-162455942-1
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0fd93184159b1c4b17ccea613131e024ef927366d0f74b73802273df3490d5f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39019
x-xss-protection
0
last-modified
Wed, 13 Jan 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 13 Jan 2021 16:41:29 GMT
kWwPshCMTHmgpFkQuK4Q
cdn.buttercms.com/ 		50 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/kWwPshCMTHmgpFkQuK4Q
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:2c00:17:108e:3bc0:93a1 , United States, ASN (),
Reverse DNS
Software
nginx /
Resource Hash
a6ea5009d0ef07479970cc3bf6e6012d876d3f35bd8b5102f801c0d4ca826b71

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 21 Dec 2020 14:54:40 GMT
via
1.1 varnish, 1.1 varnish, 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
age
2165902
x-cache
Hit from cloudfront
content-disposition
inline; filename="Cream & Gray Massage Logo-seal.png"
content-length
51068
x-served-by
cache-bwi5138-BWI, cache-hhn4032-HHN
last-modified
Sat, 23 May 2020 14:48:06 GMT
server
nginx
x-file-name
Cream & Gray Massage Logo-seal.png
x-timer
S1608562480.460018,VS0,VE1
etag
"d6b6dce3a65b92bd2b046af24e07f7b5"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1608390187-DFzGrTp9TD
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
zQoW52IrRfog1oDjCkp3-mSN1LF2mZIz__wLeH1DQ7rjmy7OjjcYFA==
x-cache-hits
1, 1
logo-e2523476d5c388367cf15d2e17790e83.png
d33wubrfki0l68.cloudfront.net/dd8b5edbb242e98deafa5dea15abba4853b89569/be0a0/static/ 		130 KB
130 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d33wubrfki0l68.cloudfront.net/dd8b5edbb242e98deafa5dea15abba4853b89569/be0a0/static/logo-e2523476d5c388367cf15d2e17790e83.png
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.214.7 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-214-7.fra53.r.cloudfront.net
Software
Netlify /
Resource Hash
de988cf3b2597025a198470b1f9982215468dab475c2ca81c7d1119793980d2e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
d8e72eb4-e642-4919-b0ad-9c1b3c559f06-51410763
date
Thu, 07 Jan 2021 03:56:08 GMT
via
1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
server
Netlify
age
564322
etag
730dc17fbc1430b27032ba02fd2615545b3241c9
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31556926
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
132694
x-amz-cf-id
qjPCTznzsntbrBOor0A-sc9jRGHyYuRIruvJtUZu0VMQksfPNXvDDA==
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/ 		157 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 May 2020 17:29:51 GMT
etag
"1589304591"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
23841
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/ 		59 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 May 2020 17:27:09 GMT
etag
"1589304429"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
14885
polyfill.min.js
cdn.polyfill.io/v3/ 		72 B
531 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.polyfill.io/v3/polyfill.min.js?features=fetch
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
age
596544
detected-user-agent
Chrome/83.0.4103
server-timing
HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length
74
referrer-policy
origin-when-cross-origin
last-modified
Wed, 06 Jan 2021 18:31:49 GMT
date
Wed, 13 Jan 2021 16:41:29 GMT
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
normalized-user-agent
chrome/83.0.0
access-control-allow-origin
*
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
css
fonts.googleapis.com/ 		0
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 13 Jan 2021 16:41:29 GMT
server
ESF
date
Wed, 13 Jan 2021 16:41:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 13 Jan 2021 16:41:29 GMT
jquery-3.5.1.slim.min.js
code.jquery.com/ 		71 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.slim.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
nginx
etag
W/"5eb09f0f-11abc"
vary
Accept-Encoding
x-hw
1610556089.dop219.fr8.t,1610556089.cds237.fr8.hn,1610556089.cds240.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
24606
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
4760134
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
7503
etag
W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q"
x-served-by
cache-fra19176-FRA
date
Wed, 13 Jan 2021 16:41:29 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 		59 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Aug 2020 16:43:44 GMT
etag
"1596732224"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
14811
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8304827477215b517f051f116d5581a5e030e7f29df69061cb9cf108aa9cbc90

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
1962
etag
W/"f35a2111ffcc2dc2fded1fe3c98a7bee"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=43200
cf-ray
611090a9ba41d6bd-FRA
cf-request-id
079e38be110000d6bdb4bf9000000001
expires
Thu, 14 Jan 2021 04:41:29 GMT
_Incapsula_Resource
www.cyber.nj.gov/ 		125 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=2&cb=848679174
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
03643528bb64b650159061683ed6e5c3e9fb8505be5d9ca6c7437c08fb77d590

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-encoding
gzip
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
18232
content-type
application/javascript
XRXW3I6Li01BKofAnsSUYevIWzgPDA.woff2
fonts.gstatic.com/s/nunito/v16/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/nunito/v16/XRXW3I6Li01BKofAnsSUYevIWzgPDA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
57d8856c7c69e9f64c198cf86ef7117164496ce7c8b179a7c82fe03764f2dce3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 08 Jan 2021 00:03:56 GMT
x-content-type-options
nosniff
last-modified
Wed, 25 Nov 2020 02:44:29 GMT
server
sffe
age
491853
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13056
x-xss-protection
0
expires
Sat, 08 Jan 2022 00:03:56 GMT
flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.woff2
fonts.gstatic.com/s/materialicons/v70/ 		96 KB
97 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/materialicons/v70/flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
47663194d7d38716a59e702f42a8494d099a24a8f84ad940e0db38938c8a4956
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 02:37:10 GMT
x-content-type-options
nosniff
last-modified
Thu, 17 Dec 2020 02:35:37 GMT
server
sffe
age
137059
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
98812
x-xss-protection
0
expires
Wed, 12 Jan 2022 02:37:10 GMT
wlp_gwjKBV1pqhv43IE7225P.woff2
fonts.gstatic.com/s/cardo/v13/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cardo/v13/wlp_gwjKBV1pqhv43IE7225P.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8204d955949011c5828e9abf4d8b96d072565c688aef0b35b502e5c41529a7aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 10:10:30 GMT
x-content-type-options
nosniff
last-modified
Thu, 24 Sep 2020 23:55:39 GMT
server
sffe
age
23459
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14860
x-xss-protection
0
expires
Thu, 13 Jan 2022 10:10:30 GMT
cakxYvKXSJmgSxAaf1rY
cdn.buttercms.com/ 		33 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/cakxYvKXSJmgSxAaf1rY
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:2c00:17:108e:3bc0:93a1 , United States, ASN (),
Reverse DNS
Software
/
Resource Hash
73eff60cd37bce6d7248069c1caacd8938e8bee44db2ebe6aa72e9ad07a051c1

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 08 Jan 2021 21:50:03 GMT
via
1.1 varnish, 1.1 varnish, 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
age
414765
x-cache
Hit from cloudfront
content-disposition
inline; filename="N CCIC.png"
content-length
33869
x-served-by
cache-bwi5141-BWI, cache-fra19175-FRA
last-modified
Fri, 08 Jan 2021 21:28:45 GMT
x-file-name
N CCIC.png
x-timer
S1610142604.668133,VS0,VE184
etag
"9fce757b55937ba33cea07ae6d2d4766"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1610141325-vctS4T5EQv
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
33FMUR4dyvCeqKCyz6uQQLg-rHYos1jA2al_HjAl09F77MrtCcAmsA==
x-cache-hits
2, 0
Qn0dlkOAQhO8adwRg2C0
cdn.buttercms.com/ 		88 KB
89 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/Qn0dlkOAQhO8adwRg2C0
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:2c00:17:108e:3bc0:93a1 , United States, ASN (),
Reverse DNS
Software
/
Resource Hash
39fc3cf190b011ab899a8f5d5ba9e2442dfebb1bcaf4c87289ca98c05cc29b63

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 05 Jan 2021 20:16:54 GMT
via
1.1 varnish, 1.1 varnish, 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
age
1993792
x-cache
Hit from cloudfront
content-disposition
inline; filename="icons-footer-5-21.png"
content-length
89868
x-served-by
cache-bwi5121-BWI, cache-fra19130-FRA
last-modified
Sat, 23 May 2020 14:41:30 GMT
x-file-name
icons-footer-5-21.png
x-timer
S1609877815.618967,VS0,VE2
etag
"741c6511ab9ffd6544063467cd0742eb"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1608562298-5vrvu3fzQ3
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
dFIlSXjEqqpZWT-70TznN4Fazv_PH_N6Yc-B3wALRafni6VZxlUxcA==
x-cache-hits
1, 1
yPnhycftTNGAh5m2V6uD
cdn.buttercms.com/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/yPnhycftTNGAh5m2V6uD
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:2c00:17:108e:3bc0:93a1 , United States, ASN (),
Reverse DNS
Software
/
Resource Hash
b8e8a5e125fc685f61004c304e204222ed9f66b50eb663d812ebfb5ec0142f98

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 03:46:23 GMT
via
1.1 varnish, 1.1 varnish, 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
age
421358
x-cache
Hit from cloudfront
content-disposition
inline; filename="3.png"
content-length
14324
x-served-by
cache-bwi5136-BWI, cache-fra19162-FRA
last-modified
Mon, 06 Apr 2020 19:56:24 GMT
x-file-name
3.png
x-timer
S1610509584.547896,VS0,VE89
etag
"2440d61115634bdba11e5d627c94753d"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1610134732-kv1vP02ARb
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
UQxmNAPuYmPUd0TnPDh4BvTBtnmWTxrxou6b13CBUUhKR-NetLDvsw==
x-cache-hits
1, 0
Gy9nQewnQIOPbCe8DGPF
cdn.buttercms.com/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/Gy9nQewnQIOPbCe8DGPF
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:2c00:17:108e:3bc0:93a1 , United States, ASN (),
Reverse DNS
Software
/
Resource Hash
46b24625f14216fcbb72db91af1aec8cd72a69513dfa48d1cc8cd62c91435d1a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 12 Jan 2021 19:35:13 GMT
via
1.1 varnish, 1.1 varnish, 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
age
419372
x-cache
Hit from cloudfront
content-disposition
inline; filename="2.png"
content-length
6114
x-served-by
cache-bwi5136-BWI, cache-fra19181-FRA
last-modified
Mon, 06 Apr 2020 19:56:33 GMT
x-file-name
2.png
x-timer
S1610480113.121915,VS0,VE88
etag
"41c819e5f85b125ed5f42393f675082d"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1610136718-MnbJOufKTc
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
MiVfaV8iBQL16U9IfptgIJMit-lWupA3-S3M5SWRhNwOYaBSL5Xqqw==
x-cache-hits
1, 0
W6tvy9nIRsu45tiOUO89
cdn.buttercms.com/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/W6tvy9nIRsu45tiOUO89
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:2c00:17:108e:3bc0:93a1 , United States, ASN (),
Reverse DNS
Software
nginx /
Resource Hash
b31da6455e725fab3e9a95eeef26dd077d327824a00c28b797123096499c200d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 21 Dec 2020 15:48:06 GMT
via
1.1 varnish, 1.1 varnish, 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
age
2271608
x-cache
Hit from cloudfront
content-disposition
inline; filename="Cream & Gray Massage Logo (2).png"
content-length
14313
x-served-by
cache-bwi5146-BWI, cache-fra19134-FRA
last-modified
Fri, 25 Sep 2020 14:45:26 GMT
server
nginx
x-file-name
Cream & Gray Massage Logo (2).png
x-timer
S1608565687.858594,VS0,VE1
etag
"d7c9f28e093031db7e9106bd83ef8ff8"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1608284481-XV9qztchQ7
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
TIeQU4Yhj-XwTBbdg2yoHwp1b1gouLAc_0OjE7cIPd5cihwWXu2a2A==
x-cache-hits
1, 1
QSZCMoTS5OvR8soCNfWP
cdn.buttercms.com/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/QSZCMoTS5OvR8soCNfWP
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:2c00:17:108e:3bc0:93a1 , United States, ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e800bcd0513a356d83750467536b76b377e1a3620c69a0f32b25355c8959dd50

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 15:31:07 GMT
via
1.1 varnish, 1.1 varnish, 1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
age
301580
x-cache
Hit from cloudfront
content-disposition
inline; filename="Cream & Gray Massage Logo (1).png"
content-length
11666
x-served-by
cache-bwi5122-BWI, cache-fra19144-FRA
last-modified
Fri, 25 Sep 2020 14:16:14 GMT
server
nginx
x-file-name
Cream & Gray Massage Logo (1).png
x-timer
S1608189535.813704,VS0,VE89
etag
"e595313d4e0e164cec67b83a0786161e"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1607871247-HoswtdfFQq
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
Wp0r3dU088Nqu83vHiLGRo2ECCkxxpI2SSyZK1I9xVOnILcb8hzOyA==
x-cache-hits
1, 0
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-162455942-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
4189
date
Wed, 13 Jan 2021 15:31:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Wed, 13 Jan 2021 17:31:41 GMT
_Incapsula_Resource
www.cyber.nj.gov/ 		1 B
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyber.nj.gov/_Incapsula_Resource?SWKMTFSR=1&e=0.622297901053652
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
1
content-type
text/plain
collect
www.google-analytics.com/j/ 		1 B
67 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=224754192&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cyber.nj.gov%2Falerts-advisories%2Fnew-malware-campaign-utilizes-google-drive-as-c2-server%2F&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=96049953&gjid=1665148886&cid=491727977.1610556090&tid=UA-162455942-1&_gid=403621279.1610556090&_r=1&gtm=2oubu0&z=773145941
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 13 Jan 2021 16:41:30 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cyber.nj.gov
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
logo-e2523476d5c388367cf15d2e17790e83.png
www.cyber.nj.gov/static/ 		130 KB
131 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyber.nj.gov/static/logo-e2523476d5c388367cf15d2e17790e83.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
de988cf3b2597025a198470b1f9982215468dab475c2ca81c7d1119793980d2e

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:30 GMT
x-cdn
Incapsula
etag
"b286c63ea1210e3946cb8e0db5086aa6-ssl"
content-type
image/png
x-iinfo
12-3902774-3897102 2CNN RT(1610556090194 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=604800, public
content-length
132694
expires
Wed, 20 Jan 2021 16:41:30 GMT
addthis_widget.js
s7.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/d722a0b62ad350f2f0241c9f58b3048aaa7ce11d-6b1aeda3a4371b811462.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Wed, 13 Jan 2021 16:41:30 GMT
x-host
s7.addthis.com
content-length
116325
chatbot.js
www.cyber.nj.gov/ 		500 B
560 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/chatbot.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/d722a0b62ad350f2f0241c9f58b3048aaa7ce11d-6b1aeda3a4371b811462.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
99b054bbf28ebb11f60fba7fa59854d940564492598afdb0c28c7e9110580e51

Request headers

Referer
https://www.cyber.nj.gov/alerts-advisories/new-malware-campaign-utilizes-google-drive-as-c2-server
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:29 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"4e6f754355609a34649812ede4b0c31d-ssl"
content-type
application/javascript
x-iinfo
12-3902775-3890120 2CNN RT(1610556090196 0) q(0 0 0 -1) r(0 0)
cache-control
max-age=86400, public, must-revalidate
content-length
337
expires
Thu, 14 Jan 2021 16:41:29 GMT
loader.js
app.artibot.ai/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.artibot.ai/loader.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/chatbot.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
99.86.7.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-7-62.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2a49c08c9a5a4e2636db8f1f3c11f7e49d177bb8be87a432414ea30e2ddb2802

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
null
Content-Encoding
gzip
ETag
"486ae3c31d0f430acafd42539b3f98b4"
Age
7653
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Thu, 09 Jul 2020 18:41:19 GMT
Server
AmazonS3
Date
Wed, 13 Jan 2021 14:34:00 GMT
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Via
1.1 9bca546700a965c9c77ef5b8dbe65cc4.cloudfront.net (CloudFront)
Cache-Control
public, max-age=14400
X-Amz-Cf-Pop
FRA6-C1
X-Amz-Cf-Id
mTXHM-Ev-BX6tmzJeLKk9QU9If2Fz8FtWjP42VHjnYBBzFXcw2-J9g==
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:31 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=56159
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-5e263a6ccdf8622d/ 		1 KB
911 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-5e263a6ccdf8622d/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ba804fd763c5bb7b453d45e8fe61afa5f2c8ee4bd0828dc4e50c8f86aaf07826

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:31 GMT
content-encoding
gzip
etag
128670746--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=59, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
736
300lo.json
m.addthis.com/live/red_lojson/ 		90 B
250 B 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=5fff22bbf4d4b78d&bkl=0&bl=1&pdt=2217&sid=5fff22bbf4d4b78d&pub=ra-5e263a6ccdf8622d&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.cyber.nj.gov&fp=alerts-advisories%2Fnew-malware-campaign-utilizes-google-drive-as-c2-server&fr=&of=1&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1610556091032&jsl=1&skipb=1&callback=addthis.cbs.jsonp__079588197544337550
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3cec206d234328fb8666f63fc1f7f6ba9416445373a21c69450918031d15825b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 13 Jan 2021 16:41:31 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
90
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame A73E 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame CCCC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:method
GET
:authority
s7.addthis.com
:scheme
https
:path
/static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx/1.15.8
content-type
text/html
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
etag
W/"5ed917ff-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
date
Wed, 13 Jan 2021 16:41:31 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
version
api.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/ 		90 B
203 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/version
Requested by
Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.204.38.77 Ashburn, United States, ASN (),
Reverse DNS
ec2-34-204-38-77.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
215bc18f93d5ce559e953e942460a1996c3911b09dcea4d446f75a92e1bc7def

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
date
Wed, 13 Jan 2021 16:41:31 GMT
server
Kestrel
content-type
application/json; charset=utf-8
custom-messages.5799ddf75a30812a3d49.js
s7.addthis.com/static/ 		114 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/custom-messages.5799ddf75a30812a3d49.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
e08ee0a0555b2527719a5d5581fb11ae492e0a111be1f89ceedd3b51e995c7c5
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
server
nginx/1.15.8
etag
W/"5ed917ff-1c9fc"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Wed, 13 Jan 2021 16:41:31 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
28521
300vi.png
m.addthis.com/live/red_lojson/ 		0
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.addthis.com/live/red_lojson/300vi.png?cad=shba%3Duim1&positions=uim1%3Dbottom&goals=uim1%3Dshare&first=1&rv=0&uvs=5fff22bbc824db83&pub=ra-5e263a6ccdf8622d&dp=www.cyber.nj.gov&rev=v8.28.8-wp
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 13 Jan 2021 16:41:31 GMT
cache-control
max-age=0, no-cache, no-store
expires
Wed, 13 Jan 2021 16:41:31 GMT
truncated
/ 		98 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
02a3d2b1c51fa7c978d0ceeabb1253da4b02194d2f4e3c83ce840aa26306b242

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
_ArtiBotLauncherCB_Manifest
prod.artibotcdn.com/manifest/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prod.artibotcdn.com/manifest/_ArtiBotLauncherCB_Manifest?_=_
Requested by
Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6812:3770 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7f23db44eff87a2e41aac89798c0031f3bfacae38eeacc489297b5e07c5809b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:31 GMT
via
1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
age
425
cf-ray
611090b3f9dad6e1-FRA
x-cache
Hit from cloudfront
content-encoding
br
cf-request-id
079e38c47d0000d6e1a2299000000001
last-modified
Thu, 09 Jul 2020 18:41:20 GMT
server
cloudflare
etag
W/"10f7dba4b59666c1375e931a82d99285"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oCkE91sDZ6YHwnCbPjKvVYmf5%2BXg4J%2BsSYAyVohXe3lzh3yDFG1438QB9%2FGaqGTcm4jMLV2CCB2GSeqXR4464AFcmbr%2BdeJnbX0Y6zgl5avOaI471FqD1fY%2FL9oQUEAy"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
null
cache-control
public, max-age=900
x-amz-cf-pop
FRA6-C1
content-type
application/javascript; charset=utf-8
x-amz-cf-id
B5Jx2skR9ocL6uTURE9xf-7HXgTxbIzZM7ktsNJJv_bVy1zqfs7M2A==
launcher.4449.js
prod.artibotcdn.com/ 		287 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prod.artibotcdn.com/launcher.4449.js
Requested by
Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6812:3770 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fe7d4f7f202f5218f44b4576266a20cb105b3cb3500a7ae69b8ac092a3f682e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 16:41:31 GMT
via
1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5926050
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
content-encoding
br
cf-request-id
079e38c49d0000d6e13dae2000000001
last-modified
Thu, 09 Jul 2020 18:41:15 GMT
server
cloudflare
etag
W/"82d281dd05ae9a5476267c10f5640be2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=llS%2F05xe6YLyrxBOsOzbbXOvnyqxNko5vz%2BpMjPh7EbOKdgqmFddC%2BfjQ%2FHTf%2FSmkVdDefzXMiOgSx3YplFHTL7PFJlzeJXjNMDDam%2ByzOdNSTs5wkpKuLsXpPO4t4%2FI"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
null
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA6-C1
cf-ray
611090b42a67d6e1-FRA
x-amz-cf-id
ulfznQcPfQg0VTMVAQ6Fi5cu1F_VqoXaxuIm8f5HuNf4cx8HvjYryg==
settings
api-cdn.prod-aws.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/ 		622 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-cdn.prod-aws.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/settings?settingsVersion=22&botVersionId=11044ade-a5c4-4aaf-b98e-4bcf9066cf0e
Requested by
Host: prod.artibotcdn.com
URL: https://prod.artibotcdn.com/launcher.4449.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:ca00:a:e02a:3080:93a1 , United States, ASN (),
Reverse DNS
Software
Kestrel /
Resource Hash
25aeafb858b51380250511c4f9b20e652d597b9966eb7d73549f6ee450b7864b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 26 Dec 2020 02:42:17 GMT
Via
1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)
Connection
keep-alive
Server
Kestrel
Age
1605554
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public,max-age=2147483647
X-Amz-Cf-Pop
FRA6-C1
X-Amz-Cf-Id
Zs_mcJF5IZ41qFWt15gBoMQGm53CGA_idoqKo3etjHpPUsYM6FJu2Q==
botImage
s3.amazonaws.com/artibot-account-files-prod/ed/ed970824-bdf0-4739-9bde-cec1af330a41/021304d7-ea6f-4035-bec0-698b42ca0a81/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/artibot-account-files-prod/ed/ed970824-bdf0-4739-9bde-cec1af330a41/021304d7-ea6f-4035-bec0-698b42ca0a81/botImage?v=637344160031844726
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.74.54 Ashburn, United States, ASN (),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
9bad9ac5e80d98acbb10f67395739bcfcf9141b1e23c4549f68f04e6358c8d27

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 13 Jan 2021 16:41:33 GMT
Last-Modified
Sun, 30 Aug 2020 20:26:44 GMT
Server
AmazonS3
x-amz-request-id
1B2C60974AFD67B5
ETag
"2cf68ca7d0143e0cc480accf3541ebe1"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
23490
x-amz-id-2
xyxXnJAtSBraLYpk2emlvu0m867oAcAddQamS1T62xDkSjs/jfhHDB3VhFj9IdxztTqE0TqpdDk=

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Domain/Path Name / Value
.nj.gov/ Name: _gat_gtag_UA_162455942_1
Value: 1
.cyber.nj.gov/ Name: incap_ses_689_1613844
Value: eS/zMoNogiGMju9XGNKPCbgi/18AAAAA+5LHqNZqEBNIR2pXHmLBtw==
.nj.gov/ Name: _ga
Value: GA1.2.491727977.1610556090
.nj.gov/ Name: _gid
Value: GA1.2.403621279.1610556090
www.cyber.nj.gov/ Name: ___utmvc
Value: 3AJ6UsZM78FPjz9Uwhgb8YgBIWvGpXLF+rDtvPzwJjKBCtnb7sfKoRUpJ7/R3G9Ans5gn43aRvrE5xRIeE92qY2AwlVjkkArWrQAH0xmDuY7eLKvL5UFqqChmp3ZToF6vqEsvcd/77enEdmL7hJu9/PrEmDZ1g7QM0d+/65AspF/J721O7DyLtLfr12g4bNSeqqvQy2L2fKLCQYuGR3SY637p+V6/toXEYFWvvAdDLdmE4TkvPHos36Rc/b5Fq+MCX8bUuQu2kZ0vEgOVWlNNG7FE/c9KN5d2KEkYMzyqaAy3UkAT0k1WVEVv77NxA4Hx28mV9iuH+XYjudlxcuNoNOJ2qvisQYePijwqbhLsigrGRTKjlrN4YFLaTpaL5mQNIu6qNt0t0M5a1R4tYxh18WKy1faMhWPpN5p/zXa++ea9juX/GkoknjjWCH5uwl3iVSgsD+FTo5ab/RphEISaUHKidJ4SBWnLSaLbg6i51afLVu3cH9PAiZDy0b8VDTYiEjeaUSm2EvkJlOLVo6iYY2OhSqoRFw12TPNNxtQGXfwrXdvvwjc1sGlQTaHAHqiKTbjjURD8dX8RnQb7sqYpOFKM3T7mLwJgNMma9fXRTG59MPxkvMgWZ3EhYQOLw/3Fzu/SNO8z/vKGJaqrke2IDazR8UPIt3dp4rdVHGUgM/dl/+ayLza2fIpXfaPKM81e9fJyGcV1KIo2fbpFmwd/VKOhn8KZfnoCU9EgNnxx50Tns1XsHvFjoI3j73e2WK307b2HfvOzRjouuqx6CBIVgZn++EpBoQPPrmdMqsI2CAWr5M1x6291cfdzSDkC5eH39x3GmgqqrwiiNX5ntjqo25H7w+svd2U2abqJrRbyESDWtS0lrySBhalF1ry+PFpChbXLNXmzf/BxdmIXWwmLrVL41auCh0C3dASX9/YyI0VzDXEbxWuQNI3PtkSWf07tXZZc4fPx7StND0dRu6A2aQ5V8iouodYh6pR3Bl5MDfi40MeuHGhTUl487ZHnxp5B9zAvPEyDnSa3GKH7BWTk8eujhvrmwuzA3FyS88St9jYf49Tgo78QYdZADXfUF8QffPGHp9k7W6ZXM+5q2BtlLl+8jV7mNFSXuQZjbjzkKtI1rz/MavQ3D0vDYlUuMZJ+lDxipxXr8nkwHGVbk6Orjr9kIMJqO7FX1/n6Xsn9RdrwpgVglQnCDhlWKV0NDA5W1okI7XNqZ2RZc9AeWUqJnXDBi4tZItUtqdWb2W4l3VPeg7dXY5lhQy7d/9jdjUVpV/cTAXC9bjIVQa/9woPXzlCW8p7IAUV5O1AUpdY0Tm5H1P5j6/6F7aroWMV7KVrAKXPnYY9hi/Xdgaq+QjnzxJI0EoRgoQ2Q/YEQ3oR2Ge6RXPLYPXkQwXdguNkG0PDRiiF6JBkU5dJa5N06JFPlbFHmP4zVkDcPZaAJ8HSANMlF/hiwVWzaq5/cg3tpSupmbwVmaxfmqZS6+NOjrMG0X7S9fYxFyB2hPFudspsWZym8px+ps9eozg3hE9ZUFLHmEWtUQmuDBcGIBWtu0ht19FYJfWahFPgPyds9x+RbQr6lGBAaQR7bjNA9G5djiLicqy0g7hnEA4PCnbq8LfR8xFHA1UrX2nUyBodEDnY8gySjHjsYi4jlVJ5FkuZMYMXpKNjCt11+NN55oxEQjnUo8q+tM9cSrvj/9o7AlYgRoh2NKpOF5cWMQmXXxQn1FdRes/MB7qVTtPIj12fywOsXCEnpXPEDJP3Ti6EUG6JPbkx7CT28N6awLze+/n/3gGov36d4l/JwE4b2q4RNjeafjZ7voH5SFLvlTj886+Hk+Y28Jhi/rdjotxczfNPYf04UuAawhg+ivVRD4w0uu4/Fr1PX6v4O6yRsA8lLeqy13D5cs3ogeiBU/xTJSd5bQdVonyI2nu4r1xLwo76cVqvvHFDaffr2tmG2Lh3nAjBwoBaJwE99G8uhVAiIL441Sb2NPacS6ZbqMj+p4s2ytlaRVey4Kx+UO+C0RHxmZn0l31rs7d06JBhyM58M4uFnyJ/LGRpZ2VzdD0xNDEwNjIscz03Mzc3NzU1ZjdjN2U5ZDhkOGI3MzhhOWI2OTZhOTY3YTZkNzk1YzhkN2VhNzdhNjI2YTc2N2E5ZGFlOThhMTlmOTU2NjgwNjE4Yjg1NmU2ZA==
.cyber.nj.gov/ Name: nlbi_1613844
Value: lroXLxQ7UVEVQz3U3cr+KQAAAAD0GHob8Ru0phDeS6B3R4HK
.cyber.nj.gov/ Name: visid_incap_1613844
Value: Zon4ZltVRpyBGJQtmZVSergi/18AAAAAQUIPAAAAAABxzItffUOxcPGizrdC8MXo

1 Console Messages

Source Level URL
Text
console-api log URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1)
Message:
OneSignal: Using fallback ES5 Stub for backwards compatibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-cdn.prod-aws.artibot.ai
api.artibot.ai
app.artibot.ai
cdn.buttercms.com
cdn.jsdelivr.net
cdn.onesignal.com
cdn.polyfill.io
code.jquery.com
d33wubrfki0l68.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
m.addthis.com
prod.artibotcdn.com
s3.amazonaws.com
s7.addthis.com
stackpath.bootstrapcdn.com
v1.addthisedge.com
www.cyber.nj.gov
www.google-analytics.com
www.googletagmanager.com
z.moatads.com
s7.addthis.com
104.75.88.112
143.204.214.7
2.18.235.40
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:2a
2600:9000:2057:ca00:a:e02a:3080:93a1
2600:9000:20e8:2c00:17:108e:3bc0:93a1
2606:4700:3032::6812:3770
2606:4700::6812:e134
2a00:1450:4001:802::200a
2a00:1450:4001:808::2008
2a00:1450:4001:816::200e
2a00:1450:4001:824::2003
2a04:4e42:1b::621
2a04:4e42:3::621
34.204.38.77
45.60.124.188
52.217.74.54
99.86.7.62
022278202b62f09d48ced661ad9d8116bf0bb72aecf1d4c06fc15377e8d99334
02a3d2b1c51fa7c978d0ceeabb1253da4b02194d2f4e3c83ce840aa26306b242
03643528bb64b650159061683ed6e5c3e9fb8505be5d9ca6c7437c08fb77d590
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3
0fd93184159b1c4b17ccea613131e024ef927366d0f74b73802273df3490d5f4
1282bafb3ecc3a0f4b3395431317e5a15abf2d90e5178fd3735e87b546365480
1f0c7441f74e00d960abc404a5725fd07b6af5482333fe46f29848f7f14b162d
1fe7d4f7f202f5218f44b4576266a20cb105b3cb3500a7ae69b8ac092a3f682e
215bc18f93d5ce559e953e942460a1996c3911b09dcea4d446f75a92e1bc7def
25aeafb858b51380250511c4f9b20e652d597b9966eb7d73549f6ee450b7864b
2a49c08c9a5a4e2636db8f1f3c11f7e49d177bb8be87a432414ea30e2ddb2802
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
39fc3cf190b011ab899a8f5d5ba9e2442dfebb1bcaf4c87289ca98c05cc29b63
3cec206d234328fb8666f63fc1f7f6ba9416445373a21c69450918031d15825b
46b24625f14216fcbb72db91af1aec8cd72a69513dfa48d1cc8cd62c91435d1a
47663194d7d38716a59e702f42a8494d099a24a8f84ad940e0db38938c8a4956
4e61f234ac935adcab3f23735da30aac5c40efbb7b817b5252989ab8e3c82b9f
53d4c90fc706a40d00ebfa18f16c6c8ac97b67f602dbb05982c200afe0edea55
57d8856c7c69e9f64c198cf86ef7117164496ce7c8b179a7c82fe03764f2dce3
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
73eff60cd37bce6d7248069c1caacd8938e8bee44db2ebe6aa72e9ad07a051c1
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
8204d955949011c5828e9abf4d8b96d072565c688aef0b35b502e5c41529a7aa
8304827477215b517f051f116d5581a5e030e7f29df69061cb9cf108aa9cbc90
8c93c91a88cce024ff3ee16ff346aa8b4bbb401504162634dab00df69ca9af57
99b054bbf28ebb11f60fba7fa59854d940564492598afdb0c28c7e9110580e51
9bad9ac5e80d98acbb10f67395739bcfcf9141b1e23c4549f68f04e6358c8d27
a6ea5009d0ef07479970cc3bf6e6012d876d3f35bd8b5102f801c0d4ca826b71
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
b31da6455e725fab3e9a95eeef26dd077d327824a00c28b797123096499c200d
b5f7a3cf571c7c0f28de227c1983b1763a21bd1be994051e21c58479ddf60e85
b7f23db44eff87a2e41aac89798c0031f3bfacae38eeacc489297b5e07c5809b
b8e8a5e125fc685f61004c304e204222ed9f66b50eb663d812ebfb5ec0142f98
ba804fd763c5bb7b453d45e8fe61afa5f2c8ee4bd0828dc4e50c8f86aaf07826
ba8241d61ea163d34977e3e3d8d1ebb2b25af4fb764c155848270524ce8e4d0c
bc88f3eacce909d8c8bbd609e539ff1e54ac78950d70e341ed9b0e5e4b702447
bd9dabb9f6c8915564d3a3343299079c6f3c05e7fd0402b1e20c1d145fddf6c8
de988cf3b2597025a198470b1f9982215468dab475c2ca81c7d1119793980d2e
dfdc5f5bbac471e6205f5d0371621a3ba44090604abb289d978b4f7642fab0b7
e08ee0a0555b2527719a5d5581fb11ae492e0a111be1f89ceedd3b51e995c7c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e800bcd0513a356d83750467536b76b377e1a3620c69a0f32b25355c8959dd50
eb44351770766acbacdbf18621074a995f3db9766f5bd3533a2da4c27ac4f489
fc15c8cc0362c2bdfff31836712656a9380e29015482afbe5fa5a16bf516b56d
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f