urlscan.io logo urlscan.io
SecurityTrails logo

adlumin.com Open in urlscan Pro
35.185.12.98  Public Scan

Go To Rescan Add Verdict Report
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aer...
Submission: On June 06 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 26 IPs in 3 countries across 23 domains to perform 154 HTTP transactions. The main IP is 35.185.12.98, located in North Charleston, United States and belongs to GOOGLE, US. The main domain is adlumin.com. The Cisco Umbrella rank of the primary domain is 712028.
TLS certificate: Issued by R3 on June 1st 2023. Valid for: 3 months.
This is the only time adlumin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 35.185.12.98 15169 (GOOGLE)
114 141.193.213.10 209242 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:9000:225... 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4860:480... 15169 (GOOGLE)
1 18.66.112.92 16509 (AMAZON-02)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
154 26
1    35.185.12.98 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 98.12.185.35.bc.googleusercontent.com
adlumin.com
114    141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
adlumin.wpenginepowered.com
2    2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2606:4700::6812:883b (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
2    2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a02:26f0:3500:16::215:148d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
2    2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)
ws.zoominfo.com
1    2600:9000:225e:f400:4:d7e1:700:93a1 (United States)

ASN16509 (AMAZON-02, US)
sc.lfeeder.com
1    2600:9000:20eb:b600:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.linkedin.oribi.io
4    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
1    2606:4700::6812:19c4 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    2606:4700::6811:826e (United States)

ASN13335 (CLOUDFLARENET, US)
js.hsleadflows.net
1    2606:4700::6810:89ce (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    2606:4700::6811:62ac (United States)

ASN13335 (CLOUDFLARENET, US)
js.usemessages.com
2    2606:4700::6811:6ac7 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hscollectedforms.net
forms.hscollectedforms.net
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    18.66.112.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-92.fra56.r.cloudfront.net
tr.lfeeder.com
3    2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)
api.hubspot.com
forms.hubspot.com
1    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
4    2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)
app.hubspot.com
track.hubspot.com
5    2606:4700::6812:8e65 (United States)

ASN13335 (CLOUDFLARENET, US)
static.hsappstatic.net
1    2606:4700::6812:f0f (United States)

ASN13335 (CLOUDFLARENET, US)
3431514.fs1.hubspotusercontent-na1.net
Apex Domain
Subdomains		 Transfer
114 wpenginepowered.com
adlumin.wpenginepowered.com
4 MB
7 hubspot.com
api.hubspot.com — Cisco Umbrella Rank: 4992
app.hubspot.com — Cisco Umbrella Rank: 5637
track.hubspot.com — Cisco Umbrella Rank: 2452
forms.hubspot.com — Cisco Umbrella Rank: 4666
26 KB
5 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 6022
294 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 390
www.linkedin.com — Cisco Umbrella Rank: 567
px4.ads.linkedin.com — Cisco Umbrella Rank: 6569
5 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 57
region1.google-analytics.com — Cisco Umbrella Rank: 1892
21 KB
2 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4924
forms.hscollectedforms.net — Cisco Umbrella Rank: 5117
26 KB
2 lfeeder.com
sc.lfeeder.com — Cisco Umbrella Rank: 15359
tr.lfeeder.com — Cisco Umbrella Rank: 26170
12 KB
2 gstatic.com
fonts.gstatic.com
72 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 75
159 KB
2 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2635
2 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67
2 KB
1 hubspotusercontent-na1.net
3431514.fs1.hubspotusercontent-na1.net
3 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 5056
408 B
1 google.com
www.google.com — Cisco Umbrella Rank: 3
408 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 121
346 B
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 5166
22 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2367
21 KB
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 4547
88 KB
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2369
16 KB
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1007
377 B
1 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 5046
2 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 942
5 KB
1 adlumin.com
adlumin.com — Cisco Umbrella Rank: 712028
20 KB
154 23
Domain Requested by
114 adlumin.wpenginepowered.com adlumin.com
adlumin.wpenginepowered.com
5 static.hsappstatic.net app.hubspot.com
static.hsappstatic.net
3 app.hubspot.com js.usemessages.com
static.hsappstatic.net
3 px.ads.linkedin.com 3 redirects
2 api.hubspot.com js.usemessages.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts.gstatic.com fonts.googleapis.com
2 www.googletagmanager.com adlumin.com
www.googletagmanager.com
2 js.hs-scripts.com adlumin.com
www.googletagmanager.com
2 fonts.googleapis.com adlumin.com
1 3431514.fs1.hubspotusercontent-na1.net
1 forms.hubspot.com js.hsleadflows.net
1 track.hubspot.com
1 forms.hscollectedforms.net js.hscollectedforms.net
1 www.google.de adlumin.com
1 www.google.com adlumin.com
1 stats.g.doubleclick.net www.google-analytics.com
1 tr.lfeeder.com adlumin.com
1 region1.google-analytics.com www.googletagmanager.com
1 js.hscollectedforms.net js.hs-scripts.com
1 js.usemessages.com js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hsleadflows.net js.hs-scripts.com
1 js.hs-banner.com js.hs-scripts.com
1 px4.ads.linkedin.com adlumin.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 sc.lfeeder.com adlumin.com
1 ws.zoominfo.com adlumin.com
1 snap.licdn.com www.googletagmanager.com
1 adlumin.com
154 31

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
linkedin.com
www.linkedin.com
www.youtube.com
Subject Issuer Validity Valid
adlumin.com
R3		 2023-06-01 -
2023-08-30		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-03-19 -
2024-03-18		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-02-01 -
2024-01-31		 a year crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3		 2023-04-04 -
2024-04-03		 a year crt.sh
*.lfeeder.com
Amazon RSA 2048 M01		 2023-03-22 -
2024-04-19		 a year crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01		 2023-02-24 -
2023-08-06		 5 months crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2023-02-05 -
2024-02-05		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
www.google.de
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3		 2023-04-10 -
2024-04-09		 a year crt.sh
hubspotusercontent-na1.net
Cloudflare Inc ECC CA-3		 2023-01-26 -
2024-01-25		 a year crt.sh

This page contains 2 frames:

Primary Page: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Frame ID: C9DE06077042099EE67199BCA0CDE486
Requests: 144 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: 15870D6BDD87B7B7D76AAF8926A45B22
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

PowerDrop: A New Insidious PowerShell Script for Command and Control Attacks Targets U.S. Aerospace Defense Industry | Adlumin SaaS Security

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • /flickity(?:\.pkgd)?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

154
Requests

99 %
HTTPS

85 %
IPv6

23
Domains

31
Subdomains

26
IPs

3
Countries

4959 kB
Transfer

7953 kB
Size

23
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 126
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4470834%26time%3D1686066391045%26url%3Dhttps%253A%252F%252Fadlumin.com%252Fpost%252Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true&e_ipv6=AQI-JbHltDlc2wAAAYiRY2okHHaYNUxmiqdeUo7HWHrY71QMx2YfAyVHt1EP9a4CoBwkx2wL

154 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ 		149 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.185.12.98 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
98.12.185.35.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
e2345a1eca5c17bc3be78a9f70681a1db0b725f846179633da2fa53c9a28e585

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=600, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 06 Jun 2023 15:46:29 GMT
server
nginx
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
HIT: 7
x-cache-group
normal
x-cacheable
SHORT
x-powered-by
WP Engine
grid.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/grid.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f263adc7aa1e2753fa89385c468485645f3076acdcc8f0cd81edf00677c7dd4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513062-2c3b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l8KtiiP06aVMfM9xhE1kvBx%2By9Az71zBJHH0Vtcxw2a88IAOvFF1MYcAWjK2ylnKwkYu63aLQh6JcG8RsYaFWaKpYdBgh9Ed06DlJDW26Z27lsgOHDDj5W35Xpc4Ej9ElnU%2FLH2IAwMBgbSH%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d5fbb65-FRA
alt-svc
h3=":443"; ma=86400
base.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		20 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/base.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bf5262d2b65c72708c054c0e5d9fd374295547d0f1ee4dcb082d11ff7fc8a42

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
388507
etag
W/"64513062-4e7e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I%2FfW250egbsK4fKjpFmuGyoujYAGWjQzkW2oSJXhNmALBdZzQotWhr%2F24Ua6HQzxbMBJO%2FdhGz3yV329drJ3KndeT0LhkeW%2FkcG9BKYN5IQHHBn0iRVvu2uStn5w%2Bk%2BJhmufYEhZl0KB5yHGXg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d60bb65-FRA
alt-svc
h3=":443"; ma=86400
layout.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		89 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/layout.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9348fa7f55ae75656a1c330fea76789f4ac1f5a05e338902af8b05210e7ef61c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513062-16273"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PcTIABW3%2FRTKZ9%2BztsoiNPEqWab0w6u2ynk9lYnwv2monFFRB7p0XnU5nw3r3%2B3jQMKCTClbV9%2BGhtLMBUr3gC1djHndDGlNSKWzcryvnuSrV76RUULfRT8ycsyaX30aeXj%2Fm5RO6vIUPoqA6w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5da1bb65-FRA
alt-svc
h3=":443"; ma=86400
buttons.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttons/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttons/buttons.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3252dd0b99f05fca9861c280ab9df2949ea88206b207a770a8fa8a42dcd3d0c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"64513063-1b62"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rVDaAa0AvvWVdTZ4osV67YIJl%2B5rhrtiiBS0243MD6hM1qhHY2YlTvbWqjEF0Dy9m4FHuzy64YJs9zCussu13yMndjZKMo%2BZXvTmBtmnAbbrvt2UqXf67g6Nll5USKAblgnDGZRI0busgAc4gA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d9fbb65-FRA
alt-svc
h3=":443"; ma=86400
buttonrow.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttonrow/ 		472 B
443 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttonrow/buttonrow.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0276ecc6eb34688965af8f6b186f9d79f97505a31dd0cc983c3a3c6182ce97fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-1d8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HoIxxLXpcXwi%2Bd2rt8MKKpwKYdrOEc%2BBUHPVvKGmDDHEDAsfMXZmoyaONbv4fLjSpPSYDRXq8cdsRT2eLLykVKIpgY3hdHMxxmv1ZxF4kC55kAO6Ov7wj2iaGByifqgqshFsh6SOmWUpKj6roA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d8fbb65-FRA
alt-svc
h3=":443"; ma=86400
ep_buttonrow.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
547 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_buttonrow.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
df5520815d1855bbe6788df257595be644bf27b1662e485605b2784c70e499b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6455b665-435"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vp8prkhAbXd6PA2QSS1gk2NCaCPJVUVjOk%2B2eaPPtZCeZjwX%2FSv%2FzP2qU%2F8kZsQLtH6vPgpjKXydEivDSiZXjXAgstwJPxs7bFlQpxswMuq2BzFD1jPmNl1PQdjcMUJr41Yaoc1I%2F6bsba%2BY%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d6dbb65-FRA
alt-svc
h3=":443"; ma=86400
ep_buttons.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
543 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_buttons.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
587927ba416073d732643851c80a8f73f202fbdaf2d409e3bef44a48a8fd6e26

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"6455b665-517"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U4GtEvmvU1CVGJnmWLjiWC3tXZlCbcmxQpxvLrVOlJAsLEfT3PL1vDV77UKgGnY%2F6IDUYKbG4Ev28xtCAnxgiw9NSdR4e0%2F6iqSnE1SiKSkt1%2Ft8jV91upULXYn%2BfFSqFBlx32m92UzZZSLpMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5da5bb65-FRA
alt-svc
h3=":443"; ma=86400
bulma_grid.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/ 		18 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/bulma_grid.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9c5b1987a9c832d022b74eeeb75ad59e6d5192cb85584932da668f9d7f6f5c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-472d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q8RQBnkEDNzaGCpL5ArQb999hvGC1pCVzGrRxYvTNgrc9C2uO2wIkYau8FUIgCnnFjK6%2FWryGsbzhCsvT0vQWRyD59H3vBDSBx6cYqYWH34GjQ6mJZd00Al602%2FDHs5syobJnftLVRPqhIedtw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5da4bb65-FRA
alt-svc
h3=":443"; ma=86400
flickity.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/ 		2 KB
977 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/flickity.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2a6fb021027df3628a394d95bb217f31bc1739932c0d581cdbefe88c78eebbd0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-7c3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OKWiM8DS2mBMZ7WpjCs7%2FlR9GFrP3GwpVBXqYdVZ7uU2eAthnOLH1YlJO3bw%2FoulPUx9xPne6QheU6gyyoqPA9z5gKBEsZtQyKsLQWDx%2FjdHODfLw2Sn7KbI3XPaJaHYr8vTbNTSy8hV6irOaA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5da3bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_flickity_slider.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		458 B
483 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_flickity_slider.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
12b42fe6d39673c1e85c63df6ef2906ce0120d5fb1010142b49e9bc09f1bb68a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-1ca"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EJWHvfG02X7Div4UMt0nwwGscigapzVg3tNAGZW8jpc4%2B2VUi7PKlBEqAnc8rTkrgAcNOgf2tw0mrYaZ38d4%2BltGI9M4DqlL02%2FhcAeJ52boaHYiFfWxn2nG5dCCh35Y2x1QYNWIyFAe4iQ04g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5da2bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_custom_menu.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		280 B
418 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_custom_menu.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9a3829921f030601d923482197968bd87d9e00904316282225e02756ddf3014

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-118"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lwm0sm%2FVk7XiVXyhyYKfhhtdu8Q6YtoUC9sD1y%2BkOXSGLvGRxGF2cU9thLpSw5Qx%2FT48SLh0YoLXTqJpsBsQWenzR853Rft2czyhYM1v6Xp%2BekS%2BBQfDjXORoWoYsbBUUPyoBJxCaeUXzIMErA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d7fbb65-FRA
alt-svc
h3=":443"; ma=86400
grid_row.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/grid_row/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/grid_row/grid_row.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
22790dd93a3e568eccc84db1a236e0bbf21007eb10a314ed8a364396649edfc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-bb9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ZWNI61N4XKQnN498C3mY7HfJNSnoJlr4NL7CqpsLK2cZXgpzBWPXsnqh2xlsJV24GT%2B4thUzao3ojTjBzgiR%2FmKGAvIHa3yWRqrAds1bo%2BchA8xp3QDaIlxO5mdMjq4vub0GxuWYUqCsrKvRw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d75bb65-FRA
alt-svc
h3=":443"; ma=86400
heading.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/heading/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/heading/heading.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
217c9ab482899dd907452152ae6b87ea26e5fc0ee107d4a4ddc35bf239727436

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"64513063-1294"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zXmNMHSLlxzPf5nm5OLLPoW5uS8fiG3nf%2Bzt8IiIsgbAGkWkSJ2HUYakyzZ3QzgQCJ%2Fe1VSFxU6Kon%2BpKYakrC8NZ8XckoG6PWSbaP9V71eyaBqfWFReQQXswlZMH5rIXOVIVDfnal%2Fqtexxpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d8bbb65-FRA
alt-svc
h3=":443"; ma=86400
hr.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/hr/ 		2 KB
1006 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/hr/hr.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc2fc51fc5ade58e3350056a062f6817c41544909061ca953f4aaa41c1ea6d1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
388507
etag
W/"64513063-8d9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5lciDSr%2BEh115A0KW5lqLmy3y2DlojJ5JWub0hEoclrp7DOd0ZwTQ%2FoH8ed6feycURiwhVrrrNojnhlJJaLmMCeSA5%2FcLasbF7yt0xEJ6nxVuyiceVTtH7i4NaOZd2L23qKFvGjmDxqHTSB28A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d84bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_hr.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
636 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_hr.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d480d8c899f7bae61b8985b1b73a92b828bb087f57e0c5902f11942ea96750b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-42c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5qzTypK%2B%2F61HKLraXGadlUUtqU6KAzxxuSaQ7%2ByBzA30LXh8VqfP%2F%2Bq%2BKQmlfiEGM4Y6bmwGGjrIQmjHNGlALWt6YwFp4WUmnPZbNQEmpNrUVodsPN8u%2F5Fk8JhisXLDjTHH%2BbZ3GpJeZkEV1A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d90bb65-FRA
alt-svc
h3=":443"; ma=86400
icon.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/icon/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/icon/icon.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f0310c1ab27ea2a728f8d5adcc98460dfe171f20e96f03e43593338eda99acd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-a11"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9b9KWiaXyxECm0Rxn%2F7pSfO%2Fc%2Bv7vfKPJUOQUFeQUF%2FPCME8Dwb1Gll4Jc%2BXpqPabEtGY1w9wKI%2FWk1FZ%2BGJs50mD%2BfsMpduN1EYx7W8OjPADTdIjpxwe8ASlQHy3mUJ5DkdcRSuaqg1Y2m2Lw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d6ebb65-FRA
alt-svc
h3=":443"; ma=86400
ep_icon.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		409 B
480 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_icon.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9369f01b809edd4c69b4b8dbe586c6fa0fd737e801d485b11f3ba0a01518e43b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-199"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YJcTjAgI5Xg6YunnlU4tD32HRHGgsxESuXtSKvCLHDBw9xC6V3xy5Rwep08kGGw%2BJlPnBqmPsAKTjfWrZHA8GjMISyzZLV%2BYtugHGsiJ1K5Tj6CNWaCyPal5NhQEFsFFr%2BYfZgym9FP5tVAv7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d9bbb65-FRA
alt-svc
h3=":443"; ma=86400
image.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/image/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/image/image.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c054c233ba0597c8d83a9f54fa67bf318ec262c588d2086ac4245f2d16a1ea4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"64513063-1cec"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AatYwHMC9g%2B63CB8O%2BAPPgH4fVjND8FaDtZf%2B8qIWW5VNw1u8TaWhESvaXmwOeIgnCaSaEcMmN1CONAbHLTTxlvGy97Tk4gAIyGu0aRF6ss6%2B6VwHR2OMmLqTPAh4PVelmhiuS5uaiADB6vX3g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d8ebb65-FRA
alt-svc
h3=":443"; ma=86400
ep_image.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
565 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_image.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
444a2d579e0730495e430d37ba6f4aa4dde136665b5a565749462dfdbf4f207a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-496"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bt1pJihlGBYENuE2jz5UARe%2Fef%2BMBtcrYM1l5HIvaFp78%2FOUbhi8ObfDLjRQtHpGGLOr8gKYDMkT1B4JN3ov%2BCmxJ%2BfxS%2FzpNqyzGQKz546Zbd2jXN8G1ng7jQAnN2Adwdelgw0WcOma7nrftw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d96bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_grids.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_grids.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d016509bcdceb392c3b04f2b3691b706b35c649046fe249b2dd9efc14b9e26b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"6455b665-1468"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rB1QqQ7XpfrXk7d4dI5f08fjLcCziMERIfZKIoanXpVD2fHqdV6ajmNZOTRf%2FmcS9wUa8Ld3Q9%2Bmav7poO0Z%2FjIenV%2B7ekFPgVzm%2BmX6s%2BsJeCg7LRenG9JrtOkmy6gXldIB9EUR%2Fiyh1HpUhA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d7ebb65-FRA
alt-svc
h3=":443"; ma=86400
ep_item_grid.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		374 B
487 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_item_grid.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d9ccc96ded6b593317eced6f7dcf8b6a49cb2d7f9632d7b64df1bee868eac11

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2716998
etag
W/"6455b665-176"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bQ2O4O%2Fbe90q41U9C0vO7y8OUd22t7c6kNtAOAutv%2B%2FRVeR78xSmZOEe6%2BL9%2BhAwJ5b4HaojWZeLamMmGxfl5zr3Vg8Cf%2Fz7EzSnckAnlW9kXGooqpwNiiKoM5Sl3H4tcJRxcrnNP87YLVk3mQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d9abb65-FRA
alt-svc
h3=":443"; ma=86400
ep_posts_grid.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		366 B
483 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_posts_grid.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b243ae266676dccee611c6ed9eff868b5c1425110010164b31fa120c1fbf26b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"6455b665-16e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8btjOX8S%2Fd6L1%2BtL02ic%2FZKFQkwFYB2i%2FLlzTDkgYy6B7mJGq16VlR0Q6jcgPaQxJKjpuVKwgLdh3wJ%2BQlGbXhexwW%2FDRhftP2bsjKjC1MZ3u3tVs0PXozbD4PGR0a%2Fqb81INyFlRwaftxaa6w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d66bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_social_profiles.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		472 B
499 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_social_profiles.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d489ed7659a9807cebb71e700fb6ae6ae8b8be566ea5d116be3c4470f57cf1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-1d8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1a8XLNBVD97CIeczYocAYS%2FqX4J370t1j81bwb9pnxXckXui8gZVU957eTJDpGCk5zVhIF%2BNozhLVUPwmP9S32alEhzROJw5otFvuZq4SPbgrMgUsh38kXBbrlkNQA5uM6bBraV74zPlEMCbCw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d7cbb65-FRA
alt-svc
h3=":443"; ma=86400
ep_tab_slider.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		5 KB
900 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_tab_slider.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
95965900d54c7e7f0ca243ae8770ed860f2eded07a9a2e873e29cc4c44ab486c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2716998
etag
W/"6455b665-1285"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AjPTzTBlxuKSt7AGPbAgkacbH67wgSbGA5D2yPGugbFtPG4Dhqxj3GvDyoiwhFVGGlwfKlRi1NZxovNQyu44oHiQBHvwxOM7wdB2V3fCrtJcZKrp0sE3YQaVrnrg32JoGtBGjexFTWQL9oKO3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d89bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_textblock.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		52 B
365 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_textblock.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c5db6ce4dc5dd7260f21f7fcde1b035cfcca54224da6b394cf15e97096d8c80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"6455b665-34"
vary
Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Uwjdxmu9%2Fgv0mz7tHvAbaY%2FQWlM6FkWxh3MY5K7arVhcvBJv%2BrT%2Bk%2Butjm2jjttCv5bqwVmjXp8KFY3ERtq%2FdEh1%2FmW%2F8GFhmmGfSS%2FtY1%2Bi3RVNFNrehh0Ag5OEcL%2F%2BvB8UVfYyF0aZh0vy6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d71bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_columns.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		660 B
773 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_columns.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
23c18d5450819b3f10a57f7ba33819719dafea8daef0bf4f4c81cb467dc71c89

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"6455b665-294"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UPGe%2F0NMwKn3ta3%2B2TCiav1IFWuhVmHiaGN97Q5CC09jAqEOKaLjtoCDES8Nbme6kIVZzqRMsp6JmV6PJUdjM6e4G4V4%2FOiLfsAbqZEupAACENtFeTZz3AXRvJV0B0gPuJwbuacuo0lJXSOrsA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d69bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_section.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		3 KB
741 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_section.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
715b3f8974434ad1f23845b14088738f2d3d484b77a510559e022ec3ad592216

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"6455b665-b6d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z95N3MV1gTWAAaYGVsJI%2B3FLz4AfBBUYo9MIy%2FshriRFxnNc4ODNVEGCk%2Bz%2FXihrGoEpGriqhnYz7%2BfqLm7gi7FJUKxk%2FM4tuixoPp0X7wvnWKU9P9fiCu%2F8ZNaiei24MuMF2a%2FnlUb%2B6TzFTw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d7bbb65-FRA
alt-svc
h3=":443"; ma=86400
lottie.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/css/ 		936 B
585 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/css/lottie.css?ver=1.2.9
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cb59666c173ea6887d2c29f37c3d2c5ac95d648aad9ad6493a9247af3215192

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
388507
etag
W/"64117054-3a8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c9yj0zTIT%2FLT43LuOATpoEVuVVMRWLqdrZu2%2F%2Ba3I0lYijscAWLBJT4rbki8TYK5wKB8kSwqeGH2FsW9xR%2FY9EhgY%2F5ZJytAPUPEiYUSNpOnA9tnJehgf1Oe%2BATyvFqElp6glQXQRNRgHj2w3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d6bbb65-FRA
alt-svc
h3=":443"; ma=86400
blog.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/blog/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/blog/blog.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1049fae50c8abfe96ebcf379914f9c2691aaeab24ccdc9654acf9930fda7a4bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-5525"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6Barwy5lGX1vKTpxKwWAqJhzzhHoV5uSv8WSHJfoNxSNmDsxvyZ%2Fd44XEHjhucAUo6cvkxgWEq4EhjaRXbHWte%2F%2BFaUDUEOgSgCdAFZ9bTXN3pBdZC7IvyFLaZE4gIGojHLBlUrLV%2FUZYEEYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d91bb65-FRA
alt-svc
h3=":443"; ma=86400
postslider.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/postslider/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/postslider/postslider.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec595c4c1f819f1b18211993b250c2deb88918d06db5b8292f2de9eda0cbd83a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-1004"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OPPhEfjgrMGRooU2A7M2dCeiGtojDc8hi4SwZvIjUtW7UxCVHNY5TVBlAeJ8Jv0Q83L%2FvreqCOtvzwKHzzk716n593uMd8ooDzfuJw%2BGYr4uh4IZf5BPNC7gNnQl%2BoqbJF0HoBUuA2E3aDgbBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d72bb65-FRA
alt-svc
h3=":443"; ma=86400
comments.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/comments/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/comments/comments.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cacbbb7f3cef11f7c7285558291685348abab2396fc8da6ef1388792942cb724

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-160a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ae%2BniJJ0GYDGRMoIdT5pRqZ5YYwkJdQ3Tx5kdtqfmp9M6Lv67xH6sl3E3msDOImQ6nm%2BfNTpF7AW949xHSyp%2F0agkjDLO5TTjFuIMre%2Brc8y%2FG5YynRdo5c5rWqXcTzqdWABj2FKbV8S81Pyog%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d8abb65-FRA
alt-svc
h3=":443"; ma=86400
slideshow.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/slideshow.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7082f515e51ca981be0d22e9647f586770d6cba06de2f73d3d29c47d60918758

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-367e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bz40mnbguGunW1DkY262xqTifiKby34OC%2Fh8cvqOGWKXnfsMbwM3%2FiBJ4d0IKaKs5KB41%2BdBX1p9bpYGWSJp0zT%2BxoSoxReZtquZUANtOBKC9MkG5Qo0fuaiCRvdf%2FKKS4l3x8GsLAhCk9RzQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d7abb65-FRA
alt-svc
h3=":443"; ma=86400
gallery.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/gallery.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad664e38b3726ad7583729d98cbc9cdf4200bb8a9f7d5fd2edee2c164275e98a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2930575
etag
W/"64513063-f2d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5STENlrU4X4U%2FjmU4UzSKa28SiSr550VUMK5e%2BYvuI2YC7nZEdOOu%2FKPZL52Bp9tqWVFA%2F1OItsHM4850Tdoq3MDkFFlWIUY%2BvaET%2Fjvh%2BmN2%2FDKiz2o%2FbbxYfxg1MHElm2nkPgrszmv75xT6g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d74bb65-FRA
alt-svc
h3=":443"; ma=86400
masonry_entries.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/ 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/masonry_entries.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1b5e616447d7dd30bb411495b4d2772e6a13f9dbfe917a7211dd8f367cd87bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
388507
etag
W/"64513063-51e8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cvPgzcW%2B%2B5T1oULpeVio7ItcXHkKBZVnne3v7Hf%2Bg26or0YxC06RXdlmOVb8%2FiHa1BIjeFCJYRpeiGqLSveMuNdiErKJ3zj1mXjY52BkZV7PSQHIJPL5OYwQ8TxOiAJOgl0NxPCM%2BLxP9VnYQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d8dbb65-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-site-preloader.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		2 KB
1014 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/avia-snippet-site-preloader.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bcddae7c91da7bd97a182b850f395405f8345e360f631b475ecf09dfe1068dd4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2804002
etag
W/"64513062-858"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fpQmTEaNwd9swTfCAbe4%2FGeHp6Xql3iwtipHBQZY2AuzN8pzsYgFHyBRltoJc9D0HI26BVtH%2B61%2FfEa%2F1zAkownB%2BIddT7qPs966r4Jy2loC7Y9w4itKD93SEHCnqbjBUGx5b8KFVQ5mpNHsyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d80bb65-FRA
alt-svc
h3=":443"; ma=86400
slideshow_fullsize.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow_fullsize/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow_fullsize/slideshow_fullsize.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd09b4ba242a8b4e112ac76ce830dd343409d09e39815b24801672c68e46b311

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-1a1c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pa1rZ7A4UGE7IPQ0Qxma5AWogpFWitfIZzShOUdR90q4U8XU8kWpHi%2BOK1UCDABUk8Ee0%2BMXwcys%2FUMLAb9cMy3fPA900l74U3sbAXzhHpU5V7l9%2FxJ9gKSfImiGtQZMM985S%2FrCDNej78sgUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d67bb65-FRA
alt-svc
h3=":443"; ma=86400
social_share.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/social_share/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/social_share/social_share.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ee6bd4bd09278d65d934110778277ff7f43039d2625930ed3c657049fa00475

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-26e7"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4iOfgUiGJ%2F7Mn725lVH26X7%2F0EXqINC%2BS2LjjZM3mSHS2AzLz7JqPuQ9UTpDHlYEa9vvY4PgUy%2BZN5Qh0dzmbYKxocAIzuNZxNkUVIZuFH0Je5rF%2BiDeyFB7GqUp1Tq1zfSf2Hf8g61wEspXvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d9cbb65-FRA
alt-svc
h3=":443"; ma=86400
tabs.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/tabs.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ecdc3e1733b4465431016227c1c31cd75bb931a284b9728a4478217e8a57eee0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-e6b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VP1kuBZRc70MsAZ0dfekgED7NO1ksFBweNCTvMt5gdR5hNWXb2gkNHKwXVqrRohTDvbbhtsACDGoOVmQDPnxJeyiZxIHnITFzevVPcqVaCiPeJd05pMxBoXHlkPhnxsJeTdHWw%2FBEgeeheb32g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d93bb65-FRA
alt-svc
h3=":443"; ma=86400
testimonials.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/testimonials.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1bd651cea184b004cb55a78dbfeabd2768ce75576af8114f4185b640520c06a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-2373"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6mG%2FRCXRhcNU0zPNq19mmGWuXGYcgjnM1LiGXEiDrVr%2BDEpQnPldxk3w3%2BsDqPBWL145KULWEcZ2DwDp4K4PkKbj0i1%2BEMj8Z2ftJSFgVF9zmAqnnckFDCLvmvvq%2FR0d%2FIA8KRSY0SqMHQ76GQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d82bb65-FRA
alt-svc
h3=":443"; ma=86400
toggles.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/toggles.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b438219488cb104cc30a2e5ce6dc29a0bc3fa7ebe6d101d7fab1feec1952b06

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
388507
etag
W/"64513063-1397"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x3oaljZaJ5%2BCS8WXTk3d4WToneGRF%2FSa0%2FeqYg0iF746gNn8khnRfCdilXG86GQMnP3MOIX9uxqXrczVSzle4N1XTgbUmhAsdzNCxuy5Gzq80ioZsD2Nsr%2FNU3zBRgEDefmePtAJsuUPruN6eA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d6fbb65-FRA
alt-svc
h3=":443"; ma=86400
video.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/ 		2 KB
878 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/video.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5ec3b8830ed916eebffd15f4518f9a87333b50c3b0c10d108ed239b795c0b2a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"64513063-785"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T8Lc10Zu40Y%2B55cy4xnbP9fKFre8XVV6zGiaaFQTsbVqM%2BTZgtb2xeT302%2FwsQQR2mfTVvA6OvNG53fgpUbAKh1jBPa%2Fe7dnhzdQ9Mv2S8jPlqfZTyaRm826QaavT6Qy8CPM065NnYJ3gOFfYg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d94bb65-FRA
alt-svc
h3=":443"; ma=86400
style.min.css
adlumin.wpenginepowered.com/wp-includes/css/dist/block-library/ 		95 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-includes/css/dist/block-library/style.min.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 12 Apr 2023 20:18:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
388507
etag
W/"6437121c-17ced"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0xsSORcLNSircghwkK%2FYpBptDxtYy%2B2MGhIK5NCLSWT%2FrbekIKnKGr9wD3U9BgZJzMgfw8Vlw45s19Skqip5dtu494ITPn8ZKlzyOK2sBb9eHy32za2ikzbejzQJY1SAGBEaNssJlDTj0CPbaw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d78bb65-FRA
alt-svc
h3=":443"; ma=86400
shortcodes.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		45 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/shortcodes.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
36c200dc8adfd56fd5d1ca02e882d27ea1921e4ae06e88da926df6148c068d80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513062-b2de"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CXhYwXmq5mcVP%2BZOrfUrE0ExGvNXhCB9b67K0%2Bipnb%2BMUaafZyV84XFImivPD4ehUhmdlHodXRf3tNSf6dCRgw%2FBb9WTbLu4qcdmWalnJ2r%2FkXTZPPym09zyLpLICoVuoXeqbumDbei32iGmUA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d64bb65-FRA
alt-svc
h3=":443"; ma=86400
ep_shortcodes.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_shortcodes.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
203a8a704d1c184b461f12e49f4ef3374f2a54af046381826f90739bf67c13dc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2716998
etag
W/"6455b665-16ea"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KpSTnnQ4HFSFScy79lV%2Fi8i%2BelBH6JD1BCIS8BWE8H33kAQgmqUHV8tWriLfvhUpG1RhgmHJN%2FWSwbHEH8zfZV4fBL4sDoz6bld2R%2FpBNr36Ovq3BZFXnCC10htPDts1vaLL5HcLEuSCDTm2Kw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d81bb65-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-fold-unfold.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/avia-snippet-fold-unfold.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
073a6079fa5c55602c328617cae71c68556c5ee1d5980ac51aab8bba61ffd929

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513062-be8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=970U1JcAUrah7MmpnOkyaOSHhmKjEBYHHk8cny30X7QVMxDcgm2Rq1CW9ywiMr8kHwz04Y%2FRdXTQOD527PoZb7HfqVt627%2Fzx6nvdy9apg6ChBPkosTleTP8aLX1BSXCSD7R2gJpXLqCOS84CA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d85bb65-FRA
alt-svc
h3=":443"; ma=86400
magnific-popup.min.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/magnific-popup.min.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
73d6e5d1826e94ad196ca526bf3e0a373c3309520bb2b7fd4c2fb43d0c259466

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513063-1470"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R5L%2BvnRe672cumpVEhppf7TJoIk1eecr9raNY3sSEeeXoSZlefllXi2kmF7Wt4Ofc0k2FiJrq4HjwCl3islLqjqyhZc0O1k%2FaNWc58d61xAVZB0Quhvr8BdFo54Hxg1vTXIw1w6WVE1i8vQerw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d92bb65-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-lightbox.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/avia-snippet-lightbox.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0297edafcd54f53621088094296941c6a77cfb019026eee169349f32ed7af4da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513062-e6e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ddr0xk6yLe3uCugBUBuIg4wlhmSvxdrzA%2FAbSRU9R4chEctkaTCerArPA4KiZA85N9uFmsDlEdmbMnRsFShJqMB2Bmcsex7wCqH6G2gkuh%2FVL%2BIfqK5kh9Jh3HWiHejEw4WSF2puDYKaq8r0jw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d95bb65-FRA
alt-svc
h3=":443"; ma=86400
adlumin.css
adlumin.wpenginepowered.com/wp-content/uploads/dynamic_avia/ 		145 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/dynamic_avia/adlumin.css?ver=64653f035dffe
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a54ad83059bb321221bdac36b08d6806f4de4d5db1695080ffdd80815205c29

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 17 May 2023 20:54:27 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"64653f03-2427b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hs8nCUIy%2FPFR8FUqZgZ0TxsMFwN5PJYy4v2vQ0p6V7Hv8NmZglCfoqpYVchidBKG5bNAWmtjXDSGvKPGT0ZTdm2rkVJoMc4vwYL7wPQv0nEkQmBQ%2Bs9279zw8LqguSS45IQV%2F%2FCD61KFSJcLnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d86bb65-FRA
alt-svc
h3=":443"; ma=86400
custom.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		707 B
598 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/custom.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb04c84b625847684f6b428b2acc5772b549e12d18acf8ca9b6a356cdb661fbc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64513062-2c3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BNC22pO%2BlAnpJ4C3O7VPru7ejLl87K9iSD6BSY03y06YNWI1ylxHHp7xMIhM6%2F9R8zKO1lSydHUDGWL4%2Bp6oj5r0K17miihcQDAHp4LPffrwYhTot6UCFFgns9F3qLbnIdqSy0mbCO0EW2smPA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d63bb65-FRA
alt-svc
h3=":443"; ma=86400
style.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/ 		127 B
417 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/style.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
626a1b45dfb726aa02dba6eb4015b75a221174f91f5371b913a60c3a86b92424

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64117050-7f"
vary
Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BIjdWxZQS3I7ldAavkiaWEsXOo54hek3YqCpZUg585Px4tkl4qMvkKSnJPhgMfhSYCR3lrW8obuK0CGbKwEYeK2izhJBdjB54dMaq8ZO96H1lGpyX4Kz0YFMt3KyzUxiBnJ4eEqGUQYZJ7uNeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d79bb65-FRA
alt-svc
h3=":443"; ma=86400
offsets.css
adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/ 		46 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/offsets.css?ver=0.0.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9ba04e90ac17399077da403dcec63d6cd544ea42152828539571c0b5caccfea

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64117055-b955"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=77Q1jotRf6dCvEj8rm6BjfFtZbrOP5Hlcd%2FEI00jQ%2FERcFVdkXClJ5FhnGIiRnnmT%2Boc1zo1%2FqMq0IYYDdO12BzWfDxtxG4GzkuVUOvYDFbL3Ns1DR3ea8hZlPTpwWCZ%2F7c2ceaecKM5PlfCuA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d61bb65-FRA
alt-svc
h3=":443"; ma=86400
gutenberg.css
adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/ 		12 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/gutenberg.css?ver=0.0.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
112a239ebcf5597c720d13075140da5250b8b33a8cbd07a9b6f46e455a112e82

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
145112
etag
W/"64117054-2f0f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c8fhhAo%2FCDZ1vCMZF3eb1HePP%2FniT1Cv9vjM46uzDvCulGJSyyDeht12E0QeCNmSZkKpDL0A7YEJRUJzEleyUaMvl5hGEHzMUVbHrkL3VnUNo%2B42nXqM9OiL7N8nHjEb32iF3EF%2BaOPL8%2BV3Qg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d70bb65-FRA
alt-svc
h3=":443"; ma=86400
main.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		54 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/main.css?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7668e9a8ee3f3506685b2269a26f589ef6ada1fdea931242003f1e7db5ddc152

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
477771
etag
W/"64117050-d66f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EtCXZT44GNQOeIo1mOvkrHKfZ6Hd0eHYrmEOk%2FHkihfsX5TvyQ%2F2lFl6dcWSvg74QpTWgV6VFFKf8rAMad4tCR%2BWzM5sKW0iGyzlv2C2A6VkY4pG33yFAqBnkzSZE4UDA3Os419tpxiSEL%2FNFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d83bb65-FRA
alt-svc
h3=":443"; ma=86400
single-common.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/single-common.css?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef99bfee0210da514c96937252ea791f0a0552e0aaf5e18513221bec3cd10cca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
145112
etag
W/"64117050-1d54"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kwD4eZJPAtiGhQt7Q5DbsdG1joAD3VgatK6UBenZ1wLd9C8%2FHOfwq760pCZpeIDWHZkZRuYPWmfw6HyyjIM9RZKDXVDZ%2FeXvUdi8owy22aC4B%2F4GGJ3vln4FFNWHcvFiqpb4RQyuicLUzqSR7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d6cbb65-FRA
alt-svc
h3=":443"; ma=86400
gutenberg.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		330 B
545 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/gutenberg.css?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a6cc7acf572850a7396cd004598b7d9585fc4cb4256eedcf36472df9f63c24b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
388507
etag
W/"64117051-14a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sc%2FabpyHZAaS%2BY2q8TxDbUndrPxqEOHKg0bYngWk%2FPK5Q2Fo0AA6bUA7EVrapQbLPb4L43Vgqm%2BRT6UoVHVfxf89%2F8ybOSQ5RvynE4gHuMYDF2otSAlN7%2FABdqplV2KkpcXRLmd%2BogoCeDxspQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5d87bb65-FRA
alt-svc
h3=":443"; ma=86400
avia-js.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-js.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
99e15e21fe8fead546f6621fbc85685a0b22d77da44231a7a50fdf508731caf9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034302
etag
W/"64513063-839"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6gITQy5u5D2zTv%2BFRkgY5BKe8BK3AdkKw72F7hXCht28sWhIXHNAuIOrVFbN2snSj%2FpEnI3xmmyRRq3XjDEHGqueHidumWF%2FXMk5yZEguggs1NjwMSmYnGjPimrjtu9M749m6sBQH4mX5qdjw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5da9bb65-FRA
alt-svc
h3=":443"; ma=86400
avia-compat.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-compat.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f0aa888761e5eef0bf608f1c73787ae9a925a762932ba393ebd387627a0ad897

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
835024
etag
W/"64513063-8ed"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S2NUr%2B%2BTvpaafgXuAOqXgBXFOXFScEt5aje1bX3%2FsN8rN5Q0PYqZH8I2YKvQ2asrosOrg8YBp0PwXQOVUidrfE%2Ft%2FV6ekc87EodY17t2xt4JC9ryDoaXtwZaVzsAv%2BbzMXHXPfhGEWb2nQaMLA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9da5da8bb65-FRA
alt-svc
h3=":443"; ma=86400
css2
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Manrope:wght@400;700&display=swap&family=Open+Sans:ital,wght@0,300;0,400;1,300&display=swap
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2380e58b96bbcc7a29d91a0b6cc4b6c9e78294b4eeb2b707670a22ae553bac07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 06 Jun 2023 15:46:30 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Jun 2023 15:46:30 GMT
PowerDrop-A-New-Insidious-PowerShell-ScriptBlog-Post.jpg
adlumin.wpenginepowered.com/wp-content/uploads/ 		195 KB
196 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/PowerDrop-A-New-Insidious-PowerShell-ScriptBlog-Post.jpg
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb6d369417c05fcafb12428480c1df5c3662aae9982339e8d4228a2171ac8422

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Jun 2023 13:55:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647de96b-30d33"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jljiJ773VcXVhS0eQiHeA779gAkPCqwxkZ80Voe26ImkVGvaBV3mpRSr8%2Bia1aCN9929t7eUKK%2FL4kD50%2Ba2F6qd%2BnRMlyWC%2FaxNpU2gUdgySGjyj9U4shvpp17eCekMMNPvWFdQJ7Ai0mbhvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf03667-FRA
alt-svc
h3=":443"; ma=86400
content-length
199987
1.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/1.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a73f82214e6aa9bd554f0c894fa57d7fe152170c7f4157d610614d088137a41d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51e9-7035"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8PtGhh5suTYU4j3d2DmySlxtkBK6ZhWSl%2F26yrkUCCH4MEMo6AkYdDlztZ8TDvWPUMBjIG09yoGTvJxDPaF54u3AiejnyfNYFXKR3QncrXQlMdCfmlAPo0tL8pk4JVPJ8yFfdXqVq%2F%2B0vZLfiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf23667-FRA
alt-svc
h3=":443"; ma=86400
content-length
28725
2.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		330 KB
330 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/2.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
33d48d0f2713a68436e4e2d8726adc2541c2950e648b88c50c7bcc4d0c788bdf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ea-52697"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nj24dHiWIHiXgjlI1jhPpZaCJkE4UjUnFwFfWNuoVfJtpb6OFsgf7zQfPvv5Unua4UvP23UeNIwagJL81h7d6DeYJsYgxHZSNy2WUj8Pn6lTn9EKXzm1Z9lmZij6MyOnlooJ5zn9ttetinYE5w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf33667-FRA
alt-svc
h3=":443"; ma=86400
content-length
337559
3.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/3.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4977c0573a102dbccc34e80e55c4822d4adefd5361c0095a45e2f28443c49d53

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ed-142c9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q4Ly9BFKEAIR9qjb5S5T8tivB%2BeGOmMEiBi5G6AKrYqMaPIXHoak06QD75ex4ZvmVqOczXQahFUzNKCbK86PPhbxMUEJ5JZ2Qvh0In0vDKn%2BNmXuMhGV707%2BE1a6Zdp2%2FwqEvkWJfSxXIYugfg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf53667-FRA
alt-svc
h3=":443"; ma=86400
content-length
82633
4.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		97 KB
97 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/4.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ec7c042190a170b4826bb36099933781563c611bcaaa5a5e9d406c63124d699

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ee-182c2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=59dbW4bos6%2BLmzTu1OmplflNPSydBWXSWFBBl4BMI7r2mwsS%2BiU0INxp2SaZEdTHUjnYaIOeJSvcWenOPZ1MirmKInEcUwui9r%2FiEL2WWmvpnC0C73nKtxqwnHbcpB%2B5nwKdXxfd9sc99jw86g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf63667-FRA
alt-svc
h3=":443"; ma=86400
content-length
99010
5.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		173 KB
174 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/5.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c1c1e89fcccad125bb71e5e795545e1c19735ee63cfcb4e2df99e19cc14e8d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ef-2b5c7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oEntSS9k8AO7mSUAtf2XDbiR%2FUMEaknmjlAspMiY%2BZmBcCfDv6UqUo45e45T0eRpUzvJXOC2gk8TIUOM8kvR2rXmGVg0CL5PYY3TI6VSjHUkfrrvWJLsZN4rkP5Foi%2FwX2boq2Ac9v64NwJOCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf73667-FRA
alt-svc
h3=":443"; ma=86400
content-length
177607
6.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		342 KB
342 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/6.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1293e61be98cca98a373d776cff9b16a8637ea75e273e8aaf90a3b3b372705bb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51f2-55759"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vT7Houp%2F3AzLgNpsXAzKVke3nTiXk1qsJEYKGX7SUQncpGxwiCBmchmUK3aAzCpNz78SG7761Ru8qfRzcSD818Nl%2FREA5VvOf1Nybh%2Bd3WixVelxNp7B5q0w2thg40s0XzpU4GVkmpfkPYykVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf83667-FRA
alt-svc
h3=":443"; ma=86400
content-length
350041
7.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		782 KB
783 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/7.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfd63a3670df6dabce2d1982ee7e058d763cb2fc3fdf4922fc8df7ebad69b151

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51f5-c3951"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qegotc0l4Qk%2F8DOJNFmAgNy4Hs6bJ8duDHQJP4CvpUe%2FgP4Cy%2Bh0vIaVZEoBHVIwFheJG3sjTW%2FoBhPcKb0UMoVHluiErRkn8Lwiu8Nb5ejoWdbQmPKjseDObYz6i9umhn%2BCmC7IzyDa3WulLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bf93667-FRA
alt-svc
h3=":443"; ma=86400
content-length
801105
8.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		483 KB
484 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/8.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0543d1876bd859425bd8984ac11f0eac32834426eedc15899cb277b84511fd9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:57 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51f9-78c9b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bPoaSPne1%2Fyh4zR8ukUCoE7QG65Js5C8jlr4Tnhkz0m2aFhg1tYnMQ1Sizyab6m%2FcwQui47zNUi7AaEOykF3JAAkfkxdzprle9Jk5jGukjgTJsGz4SINVS1bksZ0UYlyIEUQOBQB%2FnYg1zI06g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bfa3667-FRA
alt-svc
h3=":443"; ma=86400
content-length
494747
9.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		57 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/9.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae892a0647d1a73896aea016960a1060fec53ac0898a51d5d95d0fe169bc32e9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:59 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51fb-e3b6"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3oaMenvjyOgl2Hhio40E3pyMl86prcsqJhepNh6CP8nXKta9snR9%2BalulMtL0fiMiHjLWhFAeHG2W0ULrRrZ6HW62mZ8yapjTCpKihlAUdxPz48KKbXKXzb%2FUvKIhyLhja%2FC3LzxVCpWCqI9oQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bfc3667-FRA
alt-svc
h3=":443"; ma=86400
content-length
58294
10.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		443 KB
444 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/10.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ce14806bc51adaa71c9b8832f7c57f18ca8cbfea36fbf94ddf5eec194182ac9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:33:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51fd-6ecfa"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XtGx6ByfVQzzXnZ6FFjkqch2y9WDqdqhMksdPkbe3yNeXLmew8N6myuj2%2FxH0%2B%2Bl8243XaZ2YtzSiudImvfuOjfbCLlRJqBo8VnFH7tpSwqNkCugl80zu0ZF5ANw9ZTJGsgYLvZwv%2FVMGdYuuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9dd9bfd3667-FRA
alt-svc
h3=":443"; ma=86400
content-length
453882
numbers.js
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/dist/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/dist/numbers.js?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
af8586fb875a51c0b7a6fdf14d75d3ddf0497771a461d6e852c5375da7f1249a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2930575
etag
W/"64117050-127e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tes5CCIup1jEOkFS1z38OsmXgD8SQxSpovUFY421hAFodUKZ%2Fl6yQGbGqY57Zc4DlNbhEct28lFKSiJ5QAI3m0pJXMquuHkMZI8t6r%2Fhmr%2FfsGZc%2F7bM%2FbwpRbASjT7668ng1kNNuyVjn%2FiB2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd18debb65-FRA
alt-svc
h3=":443"; ma=86400
flickity.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		53 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f559133e795138a9e4836a6c22f45a9192d8f60bc51d58648840e8150c760a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776655
etag
W/"6455b665-d357"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kOwfIfo9VwONEQIG4k5iNg7xdbfb%2BZLbhFWpUHM%2B2Sv2lFfiiWn4B%2FPwysDGcAyKm7S1y5IIlmPCG0ruDNEA1O5ZEySflCABxUY9tIiZRg6bHZ1jxxEFHuC4fZKl5%2FL2RVQChCKOtPjwpO37Vw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd3b523667-FRA
alt-svc
h3=":443"; ma=86400
flickity-fade.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-fade.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d637dae1aa80d0dd5ba985ac364cf9d541e3152949a4f234c010319c8e1f0a02

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1628617
etag
W/"6455b665-1c2e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AE5SSbIRX4ouYMFZ9h5ruMkZR%2FBlXqIrOpyTyMAQDpbliSvvLkxQcWcqwsKq0l6lzSObl0ISgq%2BT0ujADXVs0%2Bl73I%2F1zar4D6WcrHqBmpSYgOBkn%2BeMNTn8vql2uAuB7FVkUCHI39WnY%2BV5lA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd5b783667-FRA
alt-svc
h3=":443"; ma=86400
enquire.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/enquire.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfb99dee1e029d51d6cfb672d847929890b1585402de17f5ed092edd72a688b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518911
etag
W/"6455b665-c2b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x%2BFkp1csI%2FheFAubIAeE8eck6w23bQ18fkj0lUm6TvY1o%2Bz9W3doXJUARvVhKxYf3lc%2FIMGuDu40VKWjKGd7nfNsqBh1qDJHWqBWrtL8M3x4SeN1i2Lws%2BPadh210autKB1KA5Z6ECrjgps54Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd8bb03667-FRA
alt-svc
h3=":443"; ma=86400
flickity-sync.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-sync.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
29ed674055ed51be81f36c84c23c87a911775bcae6f8d158f4ec43b6f2bd606b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518911
etag
W/"6455b665-c85"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FySvVOuwMIVgqILuCcmAWiG0ytxmioT36Gez%2Bc1nlxlHTEw06PUbjJbOKOu4Q2rzGPixhTTxfimkOyHy2e4ZbkuxzXTVewbQcKeI6trbM5PG%2FGSq4L%2FOe47BPSjGeEaqUFhb4Qv8ICVI1c8H6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bbe3667-FRA
alt-svc
h3=":443"; ma=86400
flickity-as-nav-for.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-as-nav-for.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
645c85c47a096414f80fb2a589c4086ea33b22204c08c2c2db86f45d3bda9ad6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1255438
etag
W/"6455b665-101a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rXV6EqeLun3OjokN6%2BkIRbF0iqOnrjgmGxzFiHwqkwHLSYAeW4ShpHGPoRcYhjRn3GCWJpfoS2e%2Bx3T0V0uFfcJK2yoPW4IaOWDVHGgMNjsGmToDQlOJE4639qEEkfo83vo5WA4td3cFdxe9Hg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bc13667-FRA
alt-svc
h3=":443"; ma=86400
flickity-prev-next.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		644 B
766 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-prev-next.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d77f2bc29b21dcd3e2656f073dd09cc1a658da77bd8d9ab0fcefda0a21fa7fb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2347239
etag
W/"6455b665-284"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g%2B21vlGOHBAuA3WCPJwTFGtxYU9ARCBWDk1v%2BF9hlEni8zI9%2BCEYAm9p%2B1VGPZK3TvV4UwY1aJOea20X2DLPESyLvMEZJKWoE7JL1QIdf3uUhD%2FfGDNVjWfLWdWuPCS9VDj31E1ym81Fv17hPw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bc23667-FRA
alt-svc
h3=":443"; ma=86400
flickity-hash.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-hash.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
200d1514b6b8b14cec7f01edbe31a348ca8716022772c1936facf61a338aef0c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1628617
etag
W/"6455b665-b58"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ajleBIj6YFHtBmwz7AERMfqoaUa90d6h%2FzfH%2B2WKAp8Oo2nk9h6Ot%2BGDzm8WuSKGhonX8qVR0hw6iS9xHmf9E8koEmCPKCCu1EKmWLrCXhipWVvUWQFt7xuemiVGOOsdKVoRp1xx%2B9cm%2BTHmyw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bc43667-FRA
alt-svc
h3=":443"; ma=86400
jquery.min.js
adlumin.wpenginepowered.com/wp-includes/js/jquery/ 		88 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.3
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 12 Apr 2023 20:18:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518911
etag
W/"6437121c-15ed7"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xYxZKgAtjgTaC3a7pFXREJLDpVYK%2B4r6KkiyERXriIEKQ03I56ssmKOxQlWKKgt1XZ86ZscHiIw7tUUtXIpylmh7szACvqk3ymSNQctMWBIWxlV5g4PPebPyDSly2boEOcug7myV9cjqWaqrDg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bc73667-FRA
alt-svc
h3=":443"; ma=86400
ep_shortcodes.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		326 B
671 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_shortcodes.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de9dcd951b7dd88f17da2fd7a573b3bf63dd16c9ecada6b61a93acfba7fc299d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2691207
etag
W/"6455b665-146"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qFF4PxRLSNA5sjqtf9%2BBhU0uyYTJyAhNUgXhW03pJlqE8O1jsy9Nbqynk4rMqDHko%2BfmqWZVgdN6di9SK3RDaaX0jZGEYPIivB%2BdpLushxA4uxFm9eJ6drVEZA6Kno7uKY6peD40JdlUAuIVKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bc93667-FRA
alt-svc
h3=":443"; ma=86400
ep_flickity_slider.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		2 KB
945 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_flickity_slider.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcc8a30d38eeacb30158d0d90764bb7a725996874d5884b5017b10cc9ff14a34

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776655
etag
W/"6455b665-750"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7JnFzLywTNOvoxghOR5PFkwNFHCtkSuBW75EZPiBHqssv1RHxUTcT5qFX%2FSjGg1LDsgQabp2zae5aOlqnYhIwpBg53Qzvj8gQi9qgiA4EjYmpNuphsmQZYKvNoG2u1MY%2F3Bx8O5WPrhI1mApnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bca3667-FRA
alt-svc
h3=":443"; ma=86400
ep_item_grid.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		1 KB
907 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_item_grid.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfced0621406b56297852f394a4b93825c69defcd20ce9e67b439bea504405cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1283902
etag
W/"6455b665-4d2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mm99jjeGgzZEbljQ2jog6qpJUYUKtyHRt9yJJeAq67ib4NnC8uZ7SxspFELakla4PfRS4WqQPCbqfHSzb%2FoyCO0RTsK64VOVeKct03HMPgZEg75PtZt%2FduQOFjnZ7Bu2aijJTLmw%2FMQbtoPSqg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bcb3667-FRA
alt-svc
h3=":443"; ma=86400
ep_posts_grid.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_posts_grid.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
288bbc61b1fd7bd02c2b83b541df031df382cefda06ff841f1649e5af83201fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1283902
etag
W/"6455b665-c5b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fi8h8TKnCxnnxXIa7ZnGtpEffznnnBSlo8Hp4OcMllBZ4j3enReJVhDb2DsrPdhdMyxXY%2BaRZowIOFkLRWw6tO1v9t9J%2FdBR2oFdHAGNBJYth0wDxzOwRV1pGbVEiKJilzg6hfqU9NivUMpN2w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bcc3667-FRA
alt-svc
h3=":443"; ma=86400
lottie-web.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/dist/ 		246 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/dist/lottie-web.js?ver=1.2.9
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
41121032744ae3e098d01b42d02ee46b3daccb5f691d97c1bc0fe62a514fea28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1283902
etag
W/"64117055-3d85b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l5qNJPIjBeLagwahAhiMUSudfr50ICe7FoUK8bjAXt4pq%2BBV3C3wtm7GiRTLXFbUUfYxkGLv21PJTtWjRQ7W7xEu9udMWiwvOC6JCAeIhUN%2F%2BXwEqZsbIeUBD0Ah68I9HJSx1ODKCOTPPa4M7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bcd3667-FRA
alt-svc
h3=":443"; ma=86400
lottie.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/lottie.js?ver=1.2.9
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3832e82ea699d49c21735de895113445cc59f618fe265473a4bca421527844a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776655
etag
W/"64117054-672"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rN8%2Fq%2F5x5HE91TEmlgkjcqL%2BxEJD2NHzTpEtYmv2ZXm1E8Cca6VVQ5vGzCR%2B%2FEPMjlNWtsIpyJ2Qy7HZUPYmBJwBwMDilbfQ4cXtBHO4Tq%2FGhLelo%2Fnyu7f2UCIVhIoFOCv0qdhVKYIBvEcCdw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bcf3667-FRA
alt-svc
h3=":443"; ma=86400
waypoints.min.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/waypoints/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/waypoints/waypoints.min.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
083d39b7748a145d540f729bc5d7e75301a1aed0b943e69ef2fd5fca2acb6ef2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776655
etag
W/"64513063-2307"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VoORVXzzcfHramumwCzLiXeLVE%2BH6Kt35PjQBZk6RGGZQOBoFuy5x2ujkawYfT0WcwqPyK%2BO7z7X%2Bhc2TPQ20tB3ySs21uIooaBt1DPqxvW78JtlrZ7cv%2FP2ikYDxxOwuvdP6w%2BHbDgwTU5y3g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd03667-FRA
alt-svc
h3=":443"; ma=86400
avia.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		56 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f63669d5736e8a7e1cbc565d3fe5542cd740af555683ba036b081dde590e21fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518909
etag
W/"64513063-e1b6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SOgKgBI3P3nO4zhN3JgcbzJEUmWlw7QPYvjUsw99CH9CNIspuCEjQRks0717Bxfk2ZpAT26y%2B8Es9%2B4zarHQpCtfHl%2B1ZW8uQ2OyPNa9XZVx6EZ9xrb0GMq%2FwlFFddAjNL3GGjh1A2iAF7YgAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd13667-FRA
alt-svc
h3=":443"; ma=86400
shortcodes.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		45 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/shortcodes.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f09972b6d95a87c5ee3b1e96ddfaf98090fc4229df485fb868efe318644de756

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1599645
etag
W/"64513063-b468"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mgiEh%2B3q5hg0QaKHrMJvO8%2Bs3cpzfuFYjXw1f4RAODMxRc8UOtj8zdwuI3Vqlh9ZL9rydxqwc3%2BX3lAbTx7YUCnOfpazt6zyaTcCRubcT9pF6QlNX%2BiKCpUIqaTd2t1gw%2BWRCcEHmOYsIIjpXA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd23667-FRA
alt-svc
h3=":443"; ma=86400
gallery.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/gallery.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6893c5cd767bf16f8814ae4b820a8996ed49895f2e9a59fe18a587c094fee8fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2866690
etag
W/"64513063-136b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sIkFfvgnMZ3eN9UcD%2FtNAqXIVh6Kn0Xr6eaTIw93hhUwjeOeDObIWalwkBaNUgYAf1MnXZTlmNPpaxWfpawG0TTYbB8884SlNoy2cnBDuqOP92ge7NfaPqwzxx6yfiFK4Jzprkkr751%2BCo1NUA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd43667-FRA
alt-svc
h3=":443"; ma=86400
isotope.min.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/portfolio/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/portfolio/isotope.min.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
11787a8b7542fbe98867b211d0e9cea087163816cd3ec38ed231bbc41dc38479

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518896
etag
W/"64513063-bfb9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YuSoEN1uCNo1DM%2FkWZ4mbeCK6XE%2BmAu0xvT87auH4nQs3TlDZIBM65xhqS6ASHz%2F4IKZC6ejd8T8MqEeUdeOUN96eCJEPsQ0ooEFSqs%2F8jgvaDly%2FuVvOOK%2BAWcCDHedfNER0qisJEvjck7Gog%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd53667-FRA
alt-svc
h3=":443"; ma=86400
masonry_entries.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/masonry_entries.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
315f0c14fd6545931f5a916462fb2f07d4b984731db6da38eb0a204097b9ffa8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1283902
etag
W/"64513063-25b1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FjYlDq2AsDSr4MyA7AqKZ6h2qPkXCSuUK15J05zv1zh1OvqUVDPnfMH5ajmA%2BWj6lZBUcLVofE4SkFIGgQO8bJlc%2Bz38mK%2BrCIKCa3%2Foh2jts1U0VTKHdoVVRDXLBXsVFtlqO9LtMxT6qZWBZw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd63667-FRA
alt-svc
h3=":443"; ma=86400
slideshow.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/slideshow.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dbdcd13c7b6cefee26516ae098ea682009d06d6054007368b788312b5d03f6e6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518896
etag
W/"64513063-9199"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9jjW281X8vR3wPfBkOdCtlKLmSlVEfWjZQimrWkXBGYHC1AYXjHU3sfGtYJ1J7Gk4E85xImm%2BP80F61MJNmzG5AaucQ3HmdAZAQKthmkPWgdko6yMZj53kelmigaOCET5teM0CpGDh8WQD9RGw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd73667-FRA
alt-svc
h3=":443"; ma=86400
slideshow-video.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/slideshow-video.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5c7eb7503144f6cd57bbddb0ad78d77bcad37d88ecf46585dd340a61449661b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1034385
etag
W/"64513063-5cd6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4TAAy1F5fOsNkF%2Fsp06%2B7LXcP9AIihwOIvsvJPn4g3UB%2FJ%2FRkAW2TTfcelzHwvz12dICNejs7FS1vI4IUqkYlzcnaOlep8A5QGOAmKSKa3iu%2FsztxJ1Yr%2FAgWgpmktjkVGWnwOZLcqSadIudig%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bd93667-FRA
alt-svc
h3=":443"; ma=86400
tabs.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/tabs.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f15165c519a5b39ca782e60dbc18b9d40f4c79ef56b39102ee91f2b8666792f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1599645
etag
W/"64513063-ea3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h1Yom4kHFypwA5YFk7bHGCeyJSsrz08n%2BDlzqLhLAcdNd7iFvX2HwnKgCg15dOnLTNshQtL02t7CRmtT8ORV%2BsemF4Zf0boWGSAMqo7VQeQv7b3EieLGb1%2Bhm4%2FBmsyXFRwjH%2BGnQ7PTxEPHKg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bdb3667-FRA
alt-svc
h3=":443"; ma=86400
testimonials.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/ 		709 B
781 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/testimonials.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
42b0903c54be2539d57e2b47bcc2ce6970a484eaf1081d712ad40a637f567134

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518893
etag
W/"64513063-2c5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aFLU0QBqooENqmdUAhZ3%2FSo0QN44RZ9gTgR23FMqmVUe%2BxltdQE0Sdh5aNizKTGYBut%2BJqTviXVyqtYUHmrca7xi7yTtXMxHIRHDdtRMbp%2Bv0IESP19fGHcAHsNwp4YN30I8cavNxgzNNa%2BFJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bdd3667-FRA
alt-svc
h3=":443"; ma=86400
toggles.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/toggles.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5db82c8597446f4cf4eb225f222a0249538d12ebefa8cc7d33833c062fd56ded

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
450339
etag
W/"64513063-10c2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lzNAsEh165B59cgH7mxUda58SXKu%2FlAqv7rDH2j56QbaMQ%2FyihmHEfSOyrDQ1tpuLXRzf8wpt8Tl2GEprOJCHNZg1%2FYaDeDMz7HnRiJUlsZkkyXGDFAzxI9t%2Fv6F7IYqglNR9Xd%2FnhkF8xU4wg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bde3667-FRA
alt-svc
h3=":443"; ma=86400
video.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/video.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d900c5255ac8e336b38606f70a16748693db8f6cd5a374f4af5ab1e37c9eb11

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1599645
etag
W/"64513063-8fc"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KdKxxdCYjHRU%2BxD5oWJT8fgSI3c6T5FuA5cKv6zaPSgwnINci2tnAMJKKBrVLlbws7gaMGPxKLXJRCOvinJ40Suv%2F0ezw6JUAUbhojjZ37a%2FfsCbFArajXgi6jxPAIloYLmk1iTc67mG6A52Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bdf3667-FRA
alt-svc
h3=":443"; ma=86400
3431514.js
js.hs-scripts.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/3431514.js?integration=WordPress&ver=10.1.24
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:883b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b28084ca900142b8d7154d6d07334577387f9357255eb14991a1ca71a171509

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
br
cf-cache-status
EXPIRED
x-hubspot-correlation-id
28e247c3-549b-434e-ae5e-9195189d2591
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
9
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
56b9b150-9a73-41ec-99dc-fdfb73bba448
last-modified
Tue, 06 Jun 2023 14:08:45 GMT
server
cloudflare
x-trace
2B70EBA2FA0E6CE64AE8A9045DB9CA3DA2AE86990B000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
cache-control
public, max-age=60
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-2ndn5
cf-ray
7d31c9dddb62bbaf-FRA
expires
Tue, 06 Jun 2023 15:47:31 GMT
avia-snippet-hamburger-menu.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-hamburger-menu.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a36e939c7f4f377f2517e46f736a16f3699054935d671db0cacf3e854252c5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518894
etag
W/"64513063-3f05"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=saPRyPcgxt2jfDnfYnzk3FpoH7J%2FDIpmPVzKo86sulLOo3qd6FesMXMz3p%2BIInv%2Ff6NWGkTAnikbuhXxWFGFcNrbEpvliSVsIx1xLTMlY6hsaP8VMY%2FElpBYUhP6fVeccW20fCApmyzvb7zCzg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9be03667-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-parallax.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-parallax.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
07df6e8fe1d38912af3b18403253680bacbb6c58bff226707f0aac4d6bce8e02

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776655
etag
W/"64513063-3aa6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=toc8LxTJ%2FVhTMaAOgE8Ck11tBcN1D%2Fi5iYnAYzVsk9KS5lcyH%2FQzo8NKg5jT%2FmVKJk%2BK%2FaBrXwc7gmqLpfoO5NsIArFYnkcOeaYLyuZcehbxnslJr8evdKfcjfojzD1x0wm60nasVh2s558MsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9be13667-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-fold-unfold.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-fold-unfold.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bdfc85d0363b58d6a764d24b7fc6e76b3d42e7a1da5122001232776a17d8f916

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518894
etag
W/"64513063-216e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o8il11IUkceHKog5MzKBKaVrFAwW2J3AaKngn7%2F1yFbiydBvvXnzZDP2qQ%2BIBgutzoPCjK%2FpzCVY2H5PxurFqk%2FGl2BhdqmEAROZttLqhERFqFIL4gIXjnPT8vACTs%2B6%2F95e8lIZoERSOCY%2BdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9be43667-FRA
alt-svc
h3=":443"; ma=86400
jquery.magnific-popup.min.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/ 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/jquery.magnific-popup.min.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf9f44c82cdea699d3a3937cdd8a7caf60ca84cf3d87adfc9fd49fdb84f35261

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1599645
etag
W/"64513063-50d3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ibChWUqDVNrfRbsxFWBOEH2kzKqzKgTVp%2FTgtfkhRmEHUpHIDwtuHYGQb4%2FsQSGmi401ktItHnfBs%2BvY1VbxiGx%2Byvetg7Am4FAEIz5LrlUVPPX9wIqnElv5l04j5vDgWDXqjuoIFU6%2BjUYSQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9be53667-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-lightbox.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-lightbox.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb290d74839b8966e9bce909665d8df6261aec38566f0888b4650fb105ef6e4d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
518894
etag
W/"64513063-1c0c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UXKmcorrtXqSDHCOwxleg6lqm83IT3PxPjIFyxy%2FEoBNSmuUHoTYBFz9ER5tC%2FOyUjZqNhDSrNAO%2FiBYrZ6mu9bj7W5GfFktQbVTf4uFiGXsnlsYbaUWUuytykUNSKE2K%2Bb5JToOR9WnnDjhFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9be73667-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-megamenu.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-megamenu.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a105ff63907ec0bf35e5fd98ff61b59ad0ae49fd3d4aecce22f45783633d443

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1599645
etag
W/"64513063-19b0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IqYd6KGIYIDzjfi5KFkk2LURBhwgpdV34w3low%2BujVfWHUrdayzBw%2FixPr7ofW01XSbn0vKshPnVEejVRrWjjgl2khB9DENv22RwRq8qAoJx4ayNbn1UCqfY7qg8bPCmDXmksoQ2r%2Bjf8opD9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9be93667-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-sticky-header.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-sticky-header.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a89b0568abfaed7f5443f87ac130aa2d3f3be2551c7281a2e8abe05aa17ce2f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1043649
etag
W/"64513063-f2b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5O4BwEiakwbC85DzF0vfwBchxeVbnaYsz2DQ1XYvysPs7vREteMx7oxtFpg2rTTx4GNOdoNIGHFGGdtXKeEEstLDWL9QwRVVxbVZaNwOViniknUoBVI1HTA2VPGD7qsp7T%2F%2FEz59vlTRrSggkg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9beb3667-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-footer-effects.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-footer-effects.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7befea011c9462df08a59bb28962c266a595bc8776826f15c9dd098b621c9fb0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1283902
etag
W/"64513063-6bb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TRbWcwlhfV691l6ZWNramkddEo2KvNSalL4Zhjc5YRlF%2FYB%2FzagCj45ErbkTMIulIknyum2dt6K6lVn%2BTu4P7qIrxQCJ5Tx1MWEgSYsiYrBR%2BEHGqj0%2Be6skM6rZDAcGs%2BWCSYRJaJJ8frjbmA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bec3667-FRA
alt-svc
h3=":443"; ma=86400
avia_blocks_front.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-gutenberg/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-gutenberg/js/avia_blocks_front.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8882fb82e7ca754fe6c804688bb79940d2a5096e01a1a84a13aaec6b4229d65

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776655
etag
W/"64513063-a9d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rGQ2v5RHfNzRHBytj8KjJLrY7jxvmVllai7eitmdD8aprP7AtMaiRc9guS5Jk5brAXdyQruMM%2FGdqNL6NUYo23tPMjsoD00EExKtIiw1YXAqVLv6TC0Lh3IlQnbSD5LEFqlrUsOfkpURYvB9sQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bed3667-FRA
alt-svc
h3=":443"; ma=86400
main.js
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/main.js?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
66f7fe1471de5f92502a38fcd2c796e92d3eb0154ec74be74195d93d79eadff6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776655
etag
W/"64117050-125b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4YARncGrQcezfbdRRG97P0%2F6VHsiiyFPmAOp0O1IsXmrbhYiqUaPovHLFg17VtPPPqMfYnOPeszx3MHYPAnVDrZ6h6xAu6Ra%2B7oVT58246QXMNxSh79%2BgWP3oTZDxq9oLD9atBYrC087YmPKPg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dd9bee3667-FRA
alt-svc
h3=":443"; ma=86400
gtm.js
www.googletagmanager.com/ 		208 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
96b6b6f3918652c52c8a27e2f11a849dfaa3e28721db0ec65c69c59925c3122b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
77654
x-xss-protection
0
last-modified
Tue, 06 Jun 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 06 Jun 2023 15:46:30 GMT
Adlumin-Blue-Gradient-Background.webp
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/webp/ 		285 KB
285 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/webp/Adlumin-Blue-Gradient-Background.webp
Requested by
Host: adlumin.wpenginepowered.com
URL: https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/main.css?ver=7
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
579fc24acea0994521f241400c4a1a511932951a8cedda191380f4a8ad67d467

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/main.css?ver=7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
138154
alt-svc
h3=":443"; ma=86400
content-length
291426
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
server
cloudflare
etag
"64117050-47262"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L0CkwSXpWrlz%2BkNlBMiZ%2FWJH2VK9xjSa0z8CUJwOqbP8DhbE%2BoYKCg%2BqsdlegwGz9TPVg0EkYc5HJ3h%2BkOQOGhnkzIkxhrgE03xFHbGDtnMK7JRB0YDhKgydGso8WdQ0GPh8BIXySEi5BmgssA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddbc233667-FRA
Adlumin-Single-Dots-Overlay-@2x.png
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/ 		227 KB
227 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/Adlumin-Single-Dots-Overlay-@2x.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9346f80745c549014461e4175c748cf7fb795544f2be0fe2c45dd0eff9643244

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"64117050-38bdc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dyPlwCBmYLHKKsgiO3v2V90Q2IMRrV5OgCZ6zJn%2FUirFp8tnla8l6BxBpMpHvcnpiVXJ%2BumNENbJj0mCVCLgnzLM01d2%2FwUwdCakqOy2Oh5ijXcnOCA5jRayQ7WwTdrgS1cBs%2BcWduqnxGsuvg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddbc253667-FRA
alt-svc
h3=":443"; ma=86400
content-length
232412
adlumin-icons.woff2
adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/adlumin-icons/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/adlumin-icons/adlumin-icons.woff2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
28ed5a75e655731a96ba917679810a9d9f22d5b0d33cd860235e3b82608763c2

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
477770
alt-svc
h3=":443"; ma=86400
content-length
27380
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
server
cloudflare
etag
"64117050-6af4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vU96frzgG8XW5MdzL0k1MIg8j7xUF59pqLj4L64kJxScHzgoKFX4%2F81bmyaPbywABTHC7RDqfvFqW%2ByeGrn3JEUU2b5hP64MuSiFKp4V00mqgceQtCed2ii4CGa%2Br4kIjSSg56ze1Vlrkg4MOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddde6b3a49-FRA
xn7gYHE41ni1AdIRggexSg.woff2
fonts.gstatic.com/s/manrope/v14/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/manrope/v14/xn7gYHE41ni1AdIRggexSg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Manrope:wght@400;700&display=swap&family=Open+Sans:ital,wght@0,300;0,400;1,300&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
14be4114dcfde74652f19f9ffae8c9bb50707e9e88bd2b1fcd86fb50224109e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sat, 03 Jun 2023 00:57:13 GMT
x-content-type-options
nosniff
age
312557
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24376
x-xss-protection
0
last-modified
Tue, 02 May 2023 14:50:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 02 Jun 2024 00:57:13 GMT
fa-fontello.woff2
adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/fa-fontello/ 		4 KB
5 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/fa-fontello/fa-fontello.woff2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
82c512c982d75150bb51f97cb89c9aa15f84dff4fa6a079e844e6e3578aef839

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2930574
alt-svc
h3=":443"; ma=86400
content-length
4528
last-modified
Wed, 15 Mar 2023 07:14:23 GMT
server
cloudflare
etag
"6411704f-11b0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9u9KrgI%2FLK3CxDrfwpdApQNfsrhN3YdqS84CSJbFx1HH9s%2BSvDCkye3pDjHFeilH%2BVgD5D7AJKvna9xcJK5LeLmryBzqhyzJ3V3l4ykBPDO7rrSlcse62rW5WEvTd%2BFpYUhNfR8LVQZJoF3wNw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddde6d3a49-FRA
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Manrope:wght@400;700&display=swap&family=Open+Sans:ital,wght@0,300;0,400;1,300&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sat, 03 Jun 2023 05:45:28 GMT
x-content-type-options
nosniff
age
295262
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 02 Jun 2024 05:45:28 GMT
entypo-fontello.woff2
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-template-builder/assets/fonts/ 		38 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-template-builder/assets/fonts/entypo-fontello.woff2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f260ff280b2e54e84e6f9c2790da49cc9abadc457b77d1df4dea121a8c8ab6e

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3237401
alt-svc
h3=":443"; ma=86400
content-length
39220
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
server
cloudflare
etag
"64117050-9934"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XPZkpVD9bjB3je2O1FtYyv9iZEEr5k3PEn8l7EQ%2Ft%2FI9wNPnfj4lMJzKfb4knIglgc1ZSzUcqmBsIBZmJb3DWZuC3oa%2FfPsFavIgyQORK4C%2Biaq%2BOdulxUJGytXNAKPJ8U7djkDBXvDuKyG80g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddde6e3a49-FRA
adlumin_logo.png
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/adlumin_logo.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
706b248caca138a45eb2f0420d1fa38ff9dfceef584c20d7162638d038d403e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
138156
cf-polished
origFmt=png, origSize=11101
content-disposition
inline; filename="adlumin_logo.webp"
alt-svc
h3=":443"; ma=86400
content-length
5412
cf-bgj
imgq:100,h2pri
last-modified
Wed, 15 Mar 2023 07:14:25 GMT
server
cloudflare
etag
"64117051-2b5d"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9fGX0nyu09YeneWfKo8Og%2Br6LEdJJmdMOvgH4pIlGc56o%2Fir0rYH4x6B5RNdnaOeyshUBxNI1E%2FQh0VwdaHnqpz0kP9MyjlQlaZyncEyr1u2863pB5h4ddge%2BeV%2FTMgzQLpOgBH%2F1WG%2Btvp0RQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddfc7f3667-FRA
Women-of-the-Channel-Stephanie-BroylesBlog-Post.jpg
adlumin.wpenginepowered.com/wp-content/uploads/ 		108 KB
108 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/Women-of-the-Channel-Stephanie-BroylesBlog-Post.jpg
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a4c7540c0c3c51feb2266f148848ce27adc65e717ef3bdb8a671411e93a2045

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
138156
cf-polished
origSize=139251
alt-svc
h3=":443"; ma=86400
content-length
110085
cf-bgj
imgq:100,h2pri
last-modified
Mon, 08 May 2023 15:02:41 GMT
server
cloudflare
etag
"64590f11-21ff3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pef%2Fqh5MW%2Be%2Bd0MCO7zSgk78iqs1sFkAQ4Cgd3Y40VaJiA48sUClXv%2FBbkoVlnsKTY%2FNKCUdhzzOt%2F7I8Y7BMq6VbdK%2FRuhSCYjiwIvL2kDEqd57OAEvVCg%2FN2XDHRIawP1UaEwC4aYuN3AcfA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddfc813667-FRA
How-AI-is-Used-to-Detect-Lateral-MovementBlog-Post.jpg
adlumin.wpenginepowered.com/wp-content/uploads/ 		71 KB
72 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/How-AI-is-Used-to-Detect-Lateral-MovementBlog-Post.jpg
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
997fd65f1ed0b8b235a55f09192fe202625dbcea91a68bffd73dc7d1abcadc19

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
138156
cf-polished
origSize=101625
alt-svc
h3=":443"; ma=86400
content-length
73186
cf-bgj
imgq:100,h2pri
last-modified
Thu, 11 May 2023 14:06:28 GMT
server
cloudflare
etag
"645cf664-18cf9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0GmbOqK1Cx6sIXup%2FIjuA7J78bYwjDOWDTPz79XxYKGRLmcylh9CmLICMFSGpnBQL7bVF%2FEKN11PX0fIsvNnV687CgOfrRmHU6jvK879Yeyz9IibqclyF42FtI73ArdEZJuwVfqQ5gQcuy65Yg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d31c9ddfc833667-FRA
insight.min.js
snap.licdn.com/li.lms-analytics/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=47875
server-timing
ak_p; desc="1686066391015_399430925_85607865_16_655_5_16_146";dur=1
accept-ranges
bytes
content-length
4777
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Jun 2023 15:04:48 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
2503
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 06 Jun 2023 17:04:48 GMT
3431514.js
js.hs-scripts.com/ 		2 KB
814 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/3431514.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:883b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76cb90d5ac11b6f9777b8aa88d63e04e69110e152514daacc62390fc2cecbbde

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
br
cf-cache-status
MISS
x-hubspot-correlation-id
25dc2c9d-bc44-4c40-b571-00d675589889
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
8
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
06bfe8fa-681c-434b-8dd5-5dcf905abf18
last-modified
Tue, 06 Jun 2023 15:46:31 GMT
server
cloudflare
x-trace
2BAD8E30D28E173CCD806C5564ABBA87CDF2843197000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
cache-control
public, max-age=60
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-fj87l
cf-ray
7d31c9dfcdcdbbaf-FRA
expires
Tue, 06 Jun 2023 15:47:31 GMT
628500581c800e0014526cc8
ws.zoominfo.com/pixel/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.zoominfo.com/pixel/628500581c800e0014526cc8
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
1cc5ab38a82ee6ca4ab9544fdd283181dae4da7daaca47884ab2b21b98c9358e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
7d31c9dff8c01911-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok
alt-svc
h3=":443"; ma=86400
lftracker_v1_ywVkO4X2ngW8Z6Bj.js
sc.lfeeder.com/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sc.lfeeder.com/lftracker_v1_ywVkO4X2ngW8Z6Bj.js
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:f400:4:d7e1:700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a9e6567358df53f9b31e7eccc1e537dcf6a99cb5924024f1b9cd015bd0c35a9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
x-amz-version-id
1yuxTgLtN2UWFIYIO6_GO3dpBBjcsvDD
content-encoding
gzip
last-modified
Thu, 18 May 2023 07:05:31 GMT
server
AmazonS3
via
1.1 cfa647edefc0769e715b9781478b0626.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P4
etag
W/"71ccb70348746d2ab1b2153681ec86f3"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
cache-control
max-age=3600
x-amz-cf-id
hpAzow7aBOOvtqJdM5YQbka0eIzy_oyFHDS-UJrX2H9kdSF6Rks75g==
js
www.googletagmanager.com/gtag/ 		239 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-8LEMRP9CBR&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
839a20e35ce5c65a470d0df91dc083b94e6df06bb3162faaae7b8cb400a219c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
84215
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 06 Jun 2023 15:46:31 GMT
body.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		76 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/body.css?v=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9038dbea3c17e614c865c4390694bbc9b2e453859496e709a97d37d9e0866c0b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
776656
etag
W/"64117050-131f4"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U0P6WhUBIunuycitlhaIK3LN6rPT29rwr5cQ%2FI4ATNe0vcnHbAbC0H9wIzy%2F365YrBDXWhyo7qIzt3xTED0j8HhlYAwhio%2F%2F%2BFYp7sC4eAfKCSOQ0L7UTmZPd6gc4T5RSJtMcLjAT%2BVF0t9KSA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d31c9dfdeb83667-FRA
alt-svc
h3=":443"; ma=86400
token
cdn.linkedin.oribi.io/partner/4470834/domain/adlumin.com/ 		36 B
377 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.linkedin.oribi.io/partner/4470834/domain/adlumin.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:b600:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 12:18:34 GMT
content-encoding
gzip
via
1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
12477
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=39098
x-amz-cf-id
ca7OwRD-KRt8BXCHZIG-KxOLSsm0Prw2diHUWJo_P3Istst9KoUSCA==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targ...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targ...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4470834%26time%3D1686066391045%26url%3Dhttps%253A%252F%252Fadlumin.com%252Fpost%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targ...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-tar...
0
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true&e_ipv6=AQI-JbHltDlc2wAAAYiRY2okHHaYNUxmiqdeUo7HWHrY71QMx2YfAyVHt1EP9a4CoBwkx2wL
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: C7EC30BB1958498EBB29415784BE9A01 Ref B: FRAEDGE1918 Ref C: 2023-06-06T15:46:31Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX9d+xaPMZvSsRnFU4IMw==

Redirect headers

date
Tue, 06 Jun 2023 15:46:31 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: A1066CF504894BD19ACAB623C0A1C5C3 Ref B: FRAEDGE1905 Ref C: 2023-06-06T15:46:31Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686066391045&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true&e_ipv6=AQI-JbHltDlc2wAAAYiRY2okHHaYNUxmiqdeUo7HWHrY71QMx2YfAyVHt1EP9a4CoBwkx2wL
x-li-proto
http/2
content-length
0
x-li-uuid
AAX9d+xWZcpDqMV6VFiDKw==
css
fonts.googleapis.com/ 		6 KB
812 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d3743c6f1dd7dbe1a3677bc1304a36ea74dca1aeb1c5a687cfd4cdf5574e9925
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 06 Jun 2023 15:42:02 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Jun 2023 15:46:31 GMT
3431514.js
js.hs-banner.com/ 		60 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/3431514.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66c3443dee1a703e927e8269976d576393b4b86e551c859b4bebcc45cef6f663

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
x-amz-version-id
u17G_TGE2NekeilBvsrO8P9gfgT.A8YA
content-encoding
br
cf-cache-status
REVALIDATED
x-amz-request-id
45R7TJDETSYRPB6D
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
17
x-amz-id-2
xp+XwkdZLWHu5N3x07v7RHJKG/YTWX/+Qu2/OcFwKTO0ywM7/NvIv49btB12/T5hssk3G6BdkMxHIl743ROGRXmIeEZeNL4B+qHbAHf4+g8=
x-evy-trace-listener
listener_https
x-request-id
30f10152-4502-42af-abfa-46f80710e14a
x-evy-trace-route-configuration
listener_https/all
last-modified
Mon, 17 Apr 2023 15:13:48 GMT
server
cloudflare
etag
W/"bb25eb05bea9e9ad56fc55349e803baf"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-v9vn7
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
7d31c9e1ab373615-FRA
expires
Tue, 06 Jun 2023 15:51:31 GMT
leadflows.js
js.hsleadflows.net/ 		545 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:826e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53c6e25ad853b5a6ad922795465a0e178c87af06b8a7ab3bde53b7b6939902c8

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

content-encoding
br
age
12478
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1213/bundle/main/lead-flows-release.js&cfRay=7d3099403e1a9186-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"e0a28490756bd60883ddd702b459f472"
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=86400, max-age=0
x-hs-target-asset
lead-flows-js/static-1.1213/bundle/main/lead-flows-release.js
date
Tue, 06 Jun 2023 15:46:31 GMT
x-amz-version-id
8pz0uDcBGYlrsmWQyDnHbF47HkG8cM.I
via
1.1 1f1067e4f193aaabd2c24b99bcdc4e88.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
6
x-evy-trace-route-configuration
listener_https/all
x-request-id
89f8dca2-8ebc-4d7c-8d09-66eac32e8480
last-modified
Tue, 06 Jun 2023 12:07:08 UTC
server
cloudflare
access-control-max-age
3000
x-hs-cache-status
MISS
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-8rxrz
cf-ray
7d31c9e1ca829bb3-FRA
x-amz-cf-id
vYbV-fXqiF725u1M9m4w0A70GFraoMppLZWNz1TbnqYonbx10fEJXg==
3431514.js
js.hs-analytics.net/analytics/1686066300000/ 		66 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1686066300000/3431514.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:89ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
21e9d17948a7b309d6fa4d32665e5dbb35656d796b55f02144a373de1013e9df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
C0JC7E7BC4WS2YPQ
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
23
x-amz-id-2
gS/ntMuj4A7aGWobMAoK7BX7JLfXTMCJ2cWthUk6apfna90LKUYsliqYlQIn95HVtkWfouUReQA=
x-evy-trace-listener
listener_https
x-request-id
f27011e5-3547-4a93-b31e-50362e9dc3b1
x-evy-trace-route-configuration
listener_https/all
last-modified
Wed, 31 May 2023 18:51:24 GMT
server
cloudflare
etag
W/"bc9738c39e8976f80d37f028b2483278"
vary
origin, Accept-Encoding
content-type
text/javascript
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
cache-control
max-age=300,public
access-control-allow-credentials
false
cf-ray
7d31c9e1bfe19208-FRA
expires
Tue, 06 Jun 2023 15:51:31 GMT
conversations-embed.js
js.usemessages.com/ 		75 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:62ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a39c3cdbdb987dee562a2de964a1d39e27e889fea5e108c3b4ba49fcea2fdc8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
x-amz-version-id
tpkjbFWgcaEMzfLPc7S4pq7_HxVMVYYE
via
1.1 bcfffcf7e0fc8cd9cfe4125369a9f036.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P3
age
452
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13373/bundles/project.js&cfRay=7d31bed79ad90408-FRA
x-cache
Hit from cloudfront
cache-tag
staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
f734ea04-9ec1-470a-ad93-61748129f833
last-modified
Fri, 02 Jun 2023 04:38:53 UTC
server
cloudflare
etag
W/"087fd2cd45ce20566625b1ec1f62b5c4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-frzj9
cf-ray
7d31c9e1be2b9195-FRA
x-amz-cf-id
IouzyWoIMqeHxrkCsoeanDow_TzBPVQwzmPRVFtgW2-qvsgPLv6Bdw==
x-hs-target-asset
conversations-embed/static-1.13373/bundles/project.js
collectedforms.js
js.hscollectedforms.net/ 		69 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6ac7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e1bce508370a6994bd3e0e67c257f06875e16ca2038c27f498616a0f0d55687

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
x-amz-version-id
SGo7xq5b6d1kUu6c8SU5YR.mobmUICUY
via
1.1 7c77abdf1c625c25627fe2a24e660a34.cloudfront.net (CloudFront)
cf-cache-status
EXPIRED
content-encoding
br
x-amz-cf-pop
IAD12-P3
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.370/bundles/project.js&cfRay=7d31c9e1bc9f9962-FRA
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
957f3045-bb74-461b-9256-239a4044bddc
last-modified
Tue, 09 May 2023 08:44:18 UTC
server
cloudflare
etag
W/"d1b16df440198d59c993c4956b7fded6"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-qrxbq
cf-ray
7d31c9e1bc9f9962-FRA
x-amz-cf-id
9rlJhQBcODF06MZZpNWSAbxshq1tNmNWpNVxy9eQPOQys1OQ4HRhug==
x-hs-target-asset
collected-forms-embed-js/static-1.370/bundles/project.js
collect
region1.google-analytics.com/g/ 		0
251 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-8LEMRP9CBR&gtm=45je35v0&_p=898881784&cid=1849861222.1686066391&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1686066391&sct=1&seg=0&dl=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&dt=PowerDrop%3A%20A%20New%20Insidious%20PowerShell%20Script%20for%20Command%20and%20Control%20Attacks%20Targets%20U.S.%20Aerospace%20Defense%20Industry%20%7C%20Adlumin%20SaaS%20Security&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8LEMRP9CBR&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 06 Jun 2023 15:46:31 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://adlumin.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		4 B
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=898881784&t=pageview&_s=1&dl=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&ul=en-us&de=UTF-8&dt=PowerDrop%3A%20A%20New%20Insidious%20PowerShell%20Script%20for%20Command%20and%20Control%20Attacks%20Targets%20U.S.%20Aerospace%20Defense%20Industry%20%7C%20Adlumin%20SaaS%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=87336740&gjid=1292971601&cid=1849861222.1686066391&tid=UA-96193909-1&_gid=1760043341.1686066391&_r=1&_slc=1&gtm=45He35v0n8154QK5F8&z=1934047451
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 06 Jun 2023 15:46:31 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://adlumin.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
tr.lfeeder.com/ 		43 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.lfeeder.com/?sid=ywVkO4X2ngW8Z6Bj&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTk2MTkzOTA5LTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLThMRU1SUDlDQlIiXSwiZ2FDbGllbnRJZHMiOlsiMTg0OTg2MTIyMi4xNjg2MDY2MzkxIl0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNjEuMCJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly9hZGx1bWluLmNvbS9wb3N0L3Bvd2VyZHJvcC1hLW5ldy1pbnNpZGlvdXMtcG93ZXJzaGVsbC1zY3JpcHQtZm9yLWNvbW1hbmQtYW5kLWNvbnRyb2wtYXR0YWNrcy10YXJnZXRzLXUtcy1hZXJvc3BhY2UtZGVmZW5zZS1pbmR1c3RyeS8iLCJwYWdlVGl0bGUiOiJQb3dlckRyb3A6IEEgTmV3IEluc2lkaW91cyBQb3dlclNoZWxsIFNjcmlwdCBmb3IgQ29tbWFuZCBhbmQgQ29udHJvbCBBdHRhY2tzIFRhcmdldHMgVS5TLiBBZXJvc3BhY2UgRGVmZW5zZSBJbmR1c3RyeSB8IEFkbHVtaW4gU2FhUyBTZWN1cml0eSIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiNTE3NDVkMTE5MDM0ODE1ZCIsInNjcmlwdElkIjoieXdWa080WDJuZ1c4WjZCaiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuMmMzZDMwNDAzYTBhNTczZC4xNjg2MDY2MzkxMzYyIiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-92.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
via
1.1 1fd323b9134f7d940dac0d007036a604.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA56-P5
x-cache
LambdaGeneratedResponse from cloudfront
content-type
image/gif
content-length
43
x-amz-cf-id
pxkzwhZtvK3LeOCAPzNjgq9ber79bBFJfwhwOP2y0GBkt9ShqzgVmg==
public
api.hubspot.com/livechat-public/v1/message/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=3431514&conversations-embed=static-1.13373&mobile=false&messagesUtk=1e639b048dc84e8689ccf03452490204&traceId=1e639b048dc84e8689ccf03452490204
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
135f155acbd38b6395468c197b7d152effa70c7b2626f17c024dcf7cd47ac564
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
4ce95e35-5979-48d0-83da-61c4c21e9e27
x-envoy-upstream-service-time
82
alt-svc
h3=":443"; ma=86400
content-length
1447
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
348b8f73-1ab1-4ca5-8a38-dac7576c20fe
server
cloudflare
x-trace
2B35078F7B01D8470B05DE400DD694CD2ED48009B3000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-ds89m
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yr%2Fnbrtmeu3RrS2OvCsoywcxClmQJfW3Fc1GomamF1ga3AZfxyQtI6f11dE%2FW27JBYIykHpsrJmfVqziUHx2NOPQ2YOyHIOlmd1Ad9MihbqV8zygNAlIHjtlgkv8Fg6%2BjY4SO4cH0CfD9Dvd%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7d31c9e37cc61d88-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
public
api.hubspot.com/livechat-public/v1/message/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=3431514&conversations-embed=static-1.13373&mobile=false&messagesUtk=1e639b048dc84e8689ccf03452490204&traceId=1e639b048dc84e8689ccf03452490204
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
x-hubspot-messages-uri
Access-Control-Request-Method
GET
Origin
https://adlumin.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin
https://adlumin.com
allow
HEAD,GET,OPTIONS
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d31c9e28ba41d88-FRA
content-length
18
content-type
text/plain; charset=utf-8
date
Tue, 06 Jun 2023 15:46:31 GMT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kc5aGNHecN8W0pkB0zuWE0neeT4ur9podTCh%2FLr8BADtTn1HncfjZVGZGq8lliGoy0bZYOe65wxBveFzjkuboEw%2BUySKVOfj4up8Ni07l6ez7aa7IRF1W0cKXH1pBH4YKlaNXqDvPJ%2FK%2F2ZCmA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
x-envoy-upstream-service-time
2
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-jknpv
x-evy-trace-virtual-host
all
x-hubspot-correlation-id
a02d1069-b115-4fe3-a021-0710f01e2607
x-request-id
4667b37b-8d2a-4ca9-8ed6-53b123ba6c78
x-trace
2B217235C9D0D0393653C151C80405218E52DBC58C000000000000000000
collect
stats.g.doubleclick.net/j/ 		4 B
346 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-96193909-1&cid=1849861222.1686066391&jid=87336740&gjid=1292971601&_gid=1760043341.1686066391&_u=YCDACEAABAAAACAAI~&z=606688472
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 06 Jun 2023 15:46:31 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://adlumin.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-96193909-1&cid=1849861222.1686066391&jid=87336740&_u=YCDACEAABAAAACAAI~&z=90018521
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 06 Jun 2023 15:46:31 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-96193909-1&cid=1849861222.1686066391&jid=87336740&_u=YCDACEAABAAAACAAI~&z=90018521
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 06 Jun 2023 15:46:31 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
json
forms.hscollectedforms.net/collected-forms/v1/config/ 		115 B
446 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3431514&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6ac7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f89193713a99ccc53de54f35294edd840a87e0c8021aec68a6ce3ad34d777110

Request headers

Accept
application/json, text/plain, */*
Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:31 GMT
content-encoding
br
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
238cef9d-6359-42ed-afa3-a3845c619a57
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
9
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
5ff0310a-d05b-4d99-b445-05815d473cc6
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
cache-control
max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-xjmf2
access-control-max-age
180
x-robots-tag
none
access-control-allow-headers
*
cf-ray
7d31c9e31e709962-FRA
1e639b048dc84e8689ccf03452490204
app.hubspot.com/conversations-visitor/3431514/threads/utk/ Frame 1587 		53 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca786bace1f36b0b1d1a2d25124d30eb6a30c7f51f71f3737635698e791e7365
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://adlumin.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
false
age
3403
alt-svc
h3=":443"; ma=86400
cache-control
max-age=600
cache-tag
staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod
cf-cache-status
DYNAMIC
cf-ray
7d31c9e4eda61e4f-FRA
content-encoding
br
content-security-policy-report-only
script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-visitor-ui/static-1.15825/html/index.html&cfRay=7d31c9e4eda61e4f&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F3431514%2Fthreads%2Futk%2F1e639b048dc84e8689ccf03452490204%3Fuuid%3Da0bfeabea9564b7992b96d860ed7dbff%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dadlumin.com%26inApp53%3Dfalse%26messagesUtk%3D1e639b048dc84e8689ccf03452490204%26url%3Dhttps%253A%252F%252Fadlumin.com%252Fpost%252Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%252F%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fadlumin.com%2F&cfenv=prod&pdt=2023-06-06&csp=ro
content-type
text/html; charset=utf-8
date
Tue, 06 Jun 2023 15:46:32 GMT
etag
W/"661a867d93501974cc7c96c4781ccb23"
last-modified
Fri, 02 Jun 2023 04:38:53 UTC
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
reporting-endpoints
default="https://send.hsbrowserreports.com/csp/reports?cfRay=7d31c9e4eda61e4f&resource=conversations-visitor-ui/static-1.15825/html/index.html"
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
via
1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront)
x-amz-cf-id
7x9BXfvEXrGdyyvJMlCYixkMj9TsbeGIqp2pPK2s7rVgeTB_JGYKTw==
x-amz-cf-pop
IAD12-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
wJrloj_F60dJKWh_zms736Mc9w2KFz4o
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
7
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-s8xd8
x-evy-trace-virtual-host
all
x-hs-cache-status
MISS
x-hs-target-asset
conversations-visitor-ui/static-1.15825/html/index.html
x-hs-worker-debug-mode
false
x-request-id
541cad00-ff83-4c16-baf0-991636af1d4f
bundle.production.js
static.hsappstatic.net/head-dlb/static-1.338/ Frame 1587 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/head-dlb/static-1.338/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
x-amz-version-id
uq4ahwTgbmdDVq3iqHPHE8OZSufTo1wc
via
1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
1791134
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 28 Apr 2023 15:18:57 GMT
server
cloudflare
etag
W/"d4a36ffcc533bcbae2a557884d3059e8"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X5Gf%2F9aCRANfhbdVJ%2Fxea10rTdYGyBr4neHmsGLKml45JrNA0rSCLNeV7LFct6CQigen8UxM3XRY9jVDMdICe6b%2F03Qz7yNSLrrmtNRiYa3MASk8QL3RpOS%2BB%2B4ZuOyE3ejFghxfHB78xngTTkRjfUsXLcw%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d31c9e688b318dd-FRA
x-amz-cf-id
djCh5PQgJFXiNGV3xFPdyuwAR5d1AbM4MkmRmJ04UARCBDQlz8mGEQ==
expires
Wed, 05 Jun 2024 15:46:32 GMT
visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/ Frame 1587 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/visitor.css
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
x-amz-version-id
eTttM9S_vWGkXsa3G13R54bOHuRyRlPL
via
1.1 59d5785a1d012a54118141e7e216a492.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
657751
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 06 Mar 2023 22:24:16 GMT
server
cloudflare
etag
W/"8b2053a9d9199e217c1f3e61d80f5d90"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pjy9U3bh%2F3T0OBQSlnJeRVr2fiXTIQ4i%2FleTQVmL8Sl8FYeBF%2FOvRc4c6EDGSFbjAgvOXNhdCLFs6QTUlQ9aNivFC7vw%2FB6Voa3%2BMpx494GvCuVPmJYnQqdM4HtH6%2B8vizwkb0gdbBL2tMU2OEmMZRoKV6k%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31536000
cf-ray
7d31c9e68d8a3819-FRA
x-amz-cf-id
d7Uhiq8cXKOs0j22esb_Lp6IVq64KBABI2XrjQot4bgS3dGiDtm0qw==
expires
Wed, 05 Jun 2024 15:46:32 GMT
bundle.production.js
static.hsappstatic.net/hubspot-dlb/static-1.392/ Frame 1587 		294 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/hubspot-dlb/static-1.392/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
x-amz-version-id
GyJQrIoHDRIfCuwwSVVsJwX13g1Qp9_O
via
1.1 49f259fbf0878ade02febf4980fecb18.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
CDG52-P4
age
1157690
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Miss from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 06 Apr 2023 11:56:47 GMT
server
cloudflare
etag
W/"90cd3e4c19469ce68f12da7dbe18af11"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9cRiYO0pilm9UojdWvGgAsbcBt3npDd4S1A4BenvarJN%2BKNvP%2FQccucfTilJiyR1mRFI2Gk5NIAReRozw9Xoq0CDkW6k0IEz6pz7SgXcSICZOn0LucOgPJ4ci3nJhYfIe7jpFSLZDDgpQKGIASu6%2F6mg970%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d31c9e688b418dd-FRA
x-amz-cf-id
O_MeBtLBcMu2yqoPQs9Iaku5SBxysnDhCN39BwNxRrr04r7Cj6EzUQ==
expires
Wed, 05 Jun 2024 15:46:32 GMT
visitor.js
static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/ Frame 1587 		609 KB
179 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/visitor.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96bffdfe121db413dae209a92d4f609fe19105176ac18131d9fce1c457dc2ff7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
x-amz-version-id
3a6Xw6UepSe4u.H7Oj9H8kmVoFO_v3Eq
via
1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
342448
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 02 Jun 2023 16:27:41 GMT
server
cloudflare
etag
W/"25632e87f7d9107e5279237e3b96a3b8"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lk%2BXiZOUdvI%2BDQ4zGa4AdDbIIknmWPDjucBAeLgYcQsnVj6yLk%2FHowCPUA1U8mHHHKssMk%2BjAn8X1BZXvjzieZQXFgxUIZctL6IHAa5JgYoj4AGfmQkmvVl2CupWMac7HanxavQJmGrP0Dw25hX9FKTVFyc%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d31c9e688b618dd-FRA
x-amz-cf-id
DzhjyBcrwxvl8LAPy0yx4ecwd3EeUxQjmYqQkK32lzPrKd8tA3Kclw==
expires
Wed, 05 Jun 2024 15:46:32 GMT
i18n-data-data-locales-en-us.js
static.hsappstatic.net/conversations-visitor-ui/static-1.15785/ Frame 1587 		776 B
862 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.15785/i18n-data-data-locales-en-us.js
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8e65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5773922958407876324a55ff40662ecd526f8829178ab8790a6e8dce853b3f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
x-amz-version-id
SpNiq4P9pGdDdfmtMtY74SmCGTt9GDKN
via
1.1 2af4ee189e50805a67bd62bbd51ad0dc.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
612357
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 26 May 2023 19:36:10 GMT
server
cloudflare
etag
W/"28c9a8bedc7c9bf5c53a75a4a0be86eb"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4pO0maGstQkS3b%2FAYKl8hRqqu4O879OlgEYI72k6%2FL2hRh1Ztw2mGXyJnSZPodqk7t24ggGzLXCWpalEXe1ef%2FNcuHEpQEhQJkbJ7HZMoF4AatbH0QCh9kApfB1f8rGqeNkz2VNTTtRFrnKDsawXCNtnGjA%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d31c9e7ea6318dd-FRA
x-amz-cf-id
BvbrpgqNPrBGyp_kL2dHqM_SaAkx9_WwmK4K5LXax2r9ygTjxjFJhA==
expires
Wed, 05 Jun 2024 15:46:32 GMT
__ptq.gif
track.hubspot.com/ 		45 B
717 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=78086756&v=1.1&a=3431514&ct=blog-post&rcu=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&pu=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&t=PowerDrop%3A+A+New+Insidious+PowerShell+Script+for+Command+and+Control+Attacks+Targets+U.S.+Aerospace+Defense+Industry+%7C+Adlumin+SaaS+Security&cts=1686066392372&vi=0dabb999cfaeed9156067fa87c07e9bb&nc=true&u=74644162.0dabb999cfaeed9156067fa87c07e9bb.1686066392367.1686066392367.1686066392367.1&b=74644162.1.1686066392368&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
f77fe420-fc87-495d-9eaa-bb8450e339b1
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
5
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
8d0386c1-c95e-4857-a33d-b2a21f28365f
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t1h84sLnYlW6wWwKMABuXsAqLcjOi5WnbiFc4lzSCWSpmnAk9mextCLzfg1ggHq%2BWQq9yVxYrqnLGjRA1tgOnjBfWBOH18AxTwrNpXa4lw3IFn2xU7cwIaG4JLcE2Dv%2B%2BahOOgdtzyMhOXMPDWG7"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-pwxm2
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7d31c9e85a9d1e4f-FRA
x-robots-tag
none
json
forms.hubspot.com/lead-flows-config/v1/config/ 		220 B
984 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3431514&utk=0dabb999cfaeed9156067fa87c07e9bb&__hstc=74644162.0dabb999cfaeed9156067fa87c07e9bb.1686066392367.1686066392367.1686066392367.1&__hssc=74644162.1.1686066392368&currentUrl=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e7ecf63b530f3b723eb6edc76d235eca342c6e052599eddb5fd922d3942cca3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
56fa6335-1757-4f4d-97dd-45a6b8915bad
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
65
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
111f5dde-beff-4cfb-9c93-5d0b303171b6
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O81TskbAKPTE3Tojk%2FpIFtw3mfwHYbrWg5RQ2nr4zQLByfa6uYm7MYx5eYXpxDBpVdCqOpLCLxduzUE9DAxwdFoenTicFmXUDJOrN1%2BKJ8V8QNvqyYGP51zUq4W5CGz0XLeY3LRqv0%2FpQrfnWwbn"}],"group":"cf-nel","max_age":604800}
x-robots-tag
none
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
7d31c9e87aba1d88-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-cxrpn
adlumin_logo_mark_RGB.jpg
3431514.fs1.hubspotusercontent-na1.net/hub/3431514/hubfs/ Frame 1587 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://3431514.fs1.hubspotusercontent-na1.net/hub/3431514/hubfs/adlumin_logo_mark_RGB.jpg?width=108&height=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e8cf947efecf3277213601e403872e1afd3ecd0c12595ed3c440a07802e8442
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
via
1.1 c59b5a542015c208c95d2ed3c65cdbcc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-81116586854,P-3431514,FLS-ALL
content-length
2952
cf-resized
internal=ok/m q=0 n=306+0 c=1+8 v=2023.4.2 l=2952
last-modified
Thu, 04 Aug 2022 16:33:24 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfKMbZSlRkDBGh3IqPwzh8f7C7Un9Bg2vL7Sxl6y2PDQ:9edea622d10e7b80320bd3d9000a6a2e"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7d31c9e9180f35f1-FRA
rhumb
app.hubspot.com/api/cartographer/v1/ Frame 1587 		0
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.15825
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
e5b0c91e-9621-4861-a179-3cf3382c899b
x-envoy-upstream-service-time
5
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
c9337284-9c22-49b5-97a7-0bc694f997c3
server
cloudflare
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jpe1YrWAvNlaSUD1QAXChAUiBoKxs4unXwNZJwSQ5qVSXuOiqjAH3yQt41kE4d4z0rJmv1Y2t6x0tuTLAhsvf3X4BHVTDrSOD3l%2BfYVIDVnm8u0iqIQ2kInhUpI4TKF6GiomgkE%2BuxW5%2BN%2Fi4w%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://app.hubspot.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-gh8bb
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure
access-control-max-age
604800
access-control-allow-credentials
true
x-evy-trace-virtual-host
all
cf-ray
7d31c9e8eb721e4f-FRA
access-control-allow-headers
Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
timing-allow-origin
*
welcomeMessages
app.hubspot.com/api/livechat-public/v1/bots/public/bot/1602098/ Frame 1587 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/api/livechat-public/v1/bots/public/bot/1602098/welcomeMessages?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.15825&conversations-visitor-ui=static-1.15825&traceId=1e639b048dc84e8689ccf03452490204&sessionId=AMOaWbKEw8LqHU8DRyHDOgi7wq2eZyYPfzxrcinCSTEL7_R62Ervl9tMgVX2wEtxljjzwSZaC4TW6qoerDyelvZez-AHTvBYvaOVxbJQsZME8aEE3OMvlIVfE0brxx-KcFFSexZjQu2xouSFvmyh1BzL04kJ93DRE13qKCcFTRoOAE__bFgeimM
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/head-dlb/static-1.338/bundle.production.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43f4234c0700ef67fe6207cdd014244cd187dae5c967967d99779da988aac2e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://app.hubspot.com/conversations-visitor/3431514/threads/utk/1e639b048dc84e8689ccf03452490204?uuid=a0bfeabea9564b7992b96d860ed7dbff&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=1e639b048dc84e8689ccf03452490204&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 15:46:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
a9c1d56c-b231-474c-8374-05448adc2c5f
x-envoy-upstream-service-time
26
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
c2a8315c-2647-4e59-a513-8fff54be5051
server
cloudflare
x-trace
2BEBDFBDE05B15620AB03A8E4036CA2F599AE126F0000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-ntps2
x-evy-trace-virtual-host
all
access-control-allow-credentials
false
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LRyggEMmQIjjnbOxMgZw%2FZ7yX9dYS%2FP45LMTUdk5D%2FLjZMQTre%2Fldm0lTy7V36xR28u0%2B8tzEPeuVSC%2FDJlSyZEyCU5N4dGSKQsfDyCVJwrcMBP9EpavcZOTQIArHC1GdxOCAdIZUus%2FdgBehw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7d31c9e91bbf1e4f-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

Verdicts & Comments Add Verdict or Comment

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 boolean| credentialless object| onbeforetoggle object| onscrollend object| aviaJS boolean| avia_is_mobile object| _hsq object| dataLayer object| avia_framework_globals function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Flickity function| Unipointer function| Unidragger function| imagesLoaded object| enquire function| changeSlideClasses undefined| $ function| jQuery object| lottie object| bodymovin function| Waypoint object| google_tag_manager object| google_tag_data function| Outlayer function| Isotope function| Masonry function| Packery string| _linkedin_data_partner_id string| GoogleAnalyticsObject function| ga function| ldfdr object| fs function| Froogaloop function| onYouTubeIframeAPIReady function| $f object| leadin_wordpress object| avia_js_shortcodes function| lintrk boolean| _already_called_lintrk object| _hsp object| gaGlobal object| ziws object| gaplugins object| gaData object| __gaConnectorEventsEmitted boolean| hubspot_live_messages_running object| HubSpotConversations object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows object| hubspot function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN object| __hsCollectedFormsDebug boolean| _hspb_ran boolean| _hspb_loaded object| _paq function| sanitizeKey boolean| _hstc_loaded boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| LEAD_FLOW_DOCUMENT_READY_RAN

23 Cookies

Domain/Path Name / Value
.adlumin.com/ Name: _gcl_au
Value: 1.1.1427603492.1686066391
.ws.zoominfo.com/ Name: visitorId
Value: 231486a15ab9c4f3c4f37201ecdc9b5f8b7274a8f6b5d3bfd8829203187ecd9f
.zoominfo.com/ Name: __cf_bm
Value: 7lIAiMCleJyN3NaJ.bih5VcPaEuO7mWeEYSyVeP89Jk-1686066391-0-Acqpif16uk5lt3eGzW4anbdyq3E4e8f+N2S3kSs3wf8ksv+xkQDBXtWctbw0V/iZG0GuI49IUkgbJVlIk3LkaFY=
.zoominfo.com/ Name: _cfuvid
Value: EaSIuvAZv6zjbiOjR1391cEq55WfnHavOruvyYfjy9o-1686066391182-0-604800000
.linkedin.com/ Name: li_sugr
Value: fde1be58-3382-4353-af53-520cf7038947
.linkedin.com/ Name: bcookie
Value: "v=2&cf9ff049-3094-4199-83e5-a268dedae3de"
.linkedin.com/ Name: lidc
Value: "b=VGST06:s=V:r=V:a=V:p=V:g=2686:u=1:x=1:i=1686066391:t=1686152791:v=2:sig=AQGVeKyjBTqAwoUOrB1di7gui_WsDXXF"
adlumin.com/ Name: ln_or
Value: eyI0NDcwODM0IjoiZCJ9
.adlumin.com/ Name: _ga_8LEMRP9CBR
Value: GS1.1.1686066391.1.0.1686066391.0.0.0
.adlumin.com/ Name: _ga
Value: GA1.2.1849861222.1686066391
.adlumin.com/ Name: _gid
Value: GA1.2.1760043341.1686066391
.adlumin.com/ Name: _gat_UA-96193909-1
Value: 1
.adlumin.com/ Name: _lfa
Value: LF1.1.2c3d30403a0a573d.1686066391362
.linkedin.com/ Name: UserMatchHistory
Value: AQKiizmfZ0Z6dQAAAYiRY2kXp1dAQP3iG6poB2obAxupVezavmf8Erp7GBQGNQ4QZJ_UpCNqjPwZ3A
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJbtKpWBfhzMgAAAYiRY2kXgIyMfTP_1MzH6cqYuXO6AkOM58IAIttL2qhjYpQrnl2-qq3Q2bGbKCdtKQM6Dg
.www.linkedin.com/ Name: bscookie
Value: "v=1&202306061546318d95c645-7f1e-487e-8594-7f9cee067fbaAQH4-1ewex2QbzEGsJ0BXI_W11nC82bd"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODYwNjYzOTE7MjswMjH03pKSvlufWPJN7jyM0dKu+0S7z6uJ2W7VzGK70ptx9w==
.hubspot.com/ Name: __cf_bm
Value: bBdQ8gqYqMOpNR_vGW1UjYUfDqs4A2VdHpjk2Nrn2tk-1686066392-0-AWvVPi2Dz1X7YPLqv/R8v3fPuLxvfuXu9b6C50WEurGRTK8FrBw/K9CWGbS0DM3/euKF3r5PtFVNq26NXMt9JTE=
adlumin.com/ Name: __hstc
Value: 74644162.0dabb999cfaeed9156067fa87c07e9bb.1686066392367.1686066392367.1686066392367.1
adlumin.com/ Name: hubspotutk
Value: 0dabb999cfaeed9156067fa87c07e9bb
adlumin.com/ Name: __hssrc
Value: 1
adlumin.com/ Name: __hssc
Value: 74644162.1.1686066392368
.adlumin.com/ Name: messagesUtk
Value: 1e639b048dc84e8689ccf03452490204

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3431514.fs1.hubspotusercontent-na1.net
adlumin.com
adlumin.wpenginepowered.com
api.hubspot.com
app.hubspot.com
cdn.linkedin.oribi.io
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
forms.hubspot.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.hsleadflows.net
js.usemessages.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
sc.lfeeder.com
snap.licdn.com
static.hsappstatic.net
stats.g.doubleclick.net
tr.lfeeder.com
track.hubspot.com
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
13.107.42.14
141.193.213.10
18.66.112.92
2001:4860:4802:32::36
2600:9000:20eb:b600:2:53b2:240:93a1
2600:9000:225e:f400:4:d7e1:700:93a1
2606:4700::6810:89ce
2606:4700::6810:a852
2606:4700::6811:62ac
2606:4700::6811:6ac7
2606:4700::6811:826e
2606:4700::6812:19c4
2606:4700::6812:883b
2606:4700::6812:8e65
2606:4700::6812:f0f
2606:4700::6813:9a53
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:80b::2003
2a00:1450:4001:813::200a
2a00:1450:4001:828::2003
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2004
2a00:1450:4001:831::200e
2a00:1450:400c:c00::9b
2a02:26f0:3500:16::215:148d
35.185.12.98
0276ecc6eb34688965af8f6b186f9d79f97505a31dd0cc983c3a3c6182ce97fc
0297edafcd54f53621088094296941c6a77cfb019026eee169349f32ed7af4da
0543d1876bd859425bd8984ac11f0eac32834426eedc15899cb277b84511fd9c
073a6079fa5c55602c328617cae71c68556c5ee1d5980ac51aab8bba61ffd929
07df6e8fe1d38912af3b18403253680bacbb6c58bff226707f0aac4d6bce8e02
083d39b7748a145d540f729bc5d7e75301a1aed0b943e69ef2fd5fca2acb6ef2
0b28084ca900142b8d7154d6d07334577387f9357255eb14991a1ca71a171509
1049fae50c8abfe96ebcf379914f9c2691aaeab24ccdc9654acf9930fda7a4bc
112a239ebcf5597c720d13075140da5250b8b33a8cbd07a9b6f46e455a112e82
11787a8b7542fbe98867b211d0e9cea087163816cd3ec38ed231bbc41dc38479
1293e61be98cca98a373d776cff9b16a8637ea75e273e8aaf90a3b3b372705bb
12b42fe6d39673c1e85c63df6ef2906ce0120d5fb1010142b49e9bc09f1bb68a
135f155acbd38b6395468c197b7d152effa70c7b2626f17c024dcf7cd47ac564
14be4114dcfde74652f19f9ffae8c9bb50707e9e88bd2b1fcd86fb50224109e7
1c1c1e89fcccad125bb71e5e795545e1c19735ee63cfcb4e2df99e19cc14e8d0
1cc5ab38a82ee6ca4ab9544fdd283181dae4da7daaca47884ab2b21b98c9358e
1d016509bcdceb392c3b04f2b3691b706b35c649046fe249b2dd9efc14b9e26b
1e1bce508370a6994bd3e0e67c257f06875e16ca2038c27f498616a0f0d55687
1ec7c042190a170b4826bb36099933781563c611bcaaa5a5e9d406c63124d699
1f263adc7aa1e2753fa89385c468485645f3076acdcc8f0cd81edf00677c7dd4
200d1514b6b8b14cec7f01edbe31a348ca8716022772c1936facf61a338aef0c
203a8a704d1c184b461f12e49f4ef3374f2a54af046381826f90739bf67c13dc
217c9ab482899dd907452152ae6b87ea26e5fc0ee107d4a4ddc35bf239727436
21e9d17948a7b309d6fa4d32665e5dbb35656d796b55f02144a373de1013e9df
22790dd93a3e568eccc84db1a236e0bbf21007eb10a314ed8a364396649edfc4
2380e58b96bbcc7a29d91a0b6cc4b6c9e78294b4eeb2b707670a22ae553bac07
23c18d5450819b3f10a57f7ba33819719dafea8daef0bf4f4c81cb467dc71c89
288bbc61b1fd7bd02c2b83b541df031df382cefda06ff841f1649e5af83201fc
28ed5a75e655731a96ba917679810a9d9f22d5b0d33cd860235e3b82608763c2
29ed674055ed51be81f36c84c23c87a911775bcae6f8d158f4ec43b6f2bd606b
2a6fb021027df3628a394d95bb217f31bc1739932c0d581cdbefe88c78eebbd0
2f559133e795138a9e4836a6c22f45a9192d8f60bc51d58648840e8150c760a3
315f0c14fd6545931f5a916462fb2f07d4b984731db6da38eb0a204097b9ffa8
33d48d0f2713a68436e4e2d8726adc2541c2950e648b88c50c7bcc4d0c788bdf
36c200dc8adfd56fd5d1ca02e882d27ea1921e4ae06e88da926df6148c068d80
36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66
3832e82ea699d49c21735de895113445cc59f618fe265473a4bca421527844a3
3f0310c1ab27ea2a728f8d5adcc98460dfe171f20e96f03e43593338eda99acd
41121032744ae3e098d01b42d02ee46b3daccb5f691d97c1bc0fe62a514fea28
42b0903c54be2539d57e2b47bcc2ce6970a484eaf1081d712ad40a637f567134
43f4234c0700ef67fe6207cdd014244cd187dae5c967967d99779da988aac2e4
444a2d579e0730495e430d37ba6f4aa4dde136665b5a565749462dfdbf4f207a
4977c0573a102dbccc34e80e55c4822d4adefd5361c0095a45e2f28443c49d53
4a89b0568abfaed7f5443f87ac130aa2d3f3be2551c7281a2e8abe05aa17ce2f
4d900c5255ac8e336b38606f70a16748693db8f6cd5a374f4af5ab1e37c9eb11
4f15165c519a5b39ca782e60dbc18b9d40f4c79ef56b39102ee91f2b8666792f
53c6e25ad853b5a6ad922795465a0e178c87af06b8a7ab3bde53b7b6939902c8
579fc24acea0994521f241400c4a1a511932951a8cedda191380f4a8ad67d467
587927ba416073d732643851c80a8f73f202fbdaf2d409e3bef44a48a8fd6e26
5a105ff63907ec0bf35e5fd98ff61b59ad0ae49fd3d4aecce22f45783633d443
5a36e939c7f4f377f2517e46f736a16f3699054935d671db0cacf3e854252c5b
5a54ad83059bb321221bdac36b08d6806f4de4d5db1695080ffdd80815205c29
5b438219488cb104cc30a2e5ce6dc29a0bc3fa7ebe6d101d7fab1feec1952b06
5bf5262d2b65c72708c054c0e5d9fd374295547d0f1ee4dcb082d11ff7fc8a42
5d9ccc96ded6b593317eced6f7dcf8b6a49cb2d7f9632d7b64df1bee868eac11
5db82c8597446f4cf4eb225f222a0249538d12ebefa8cc7d33833c062fd56ded
5e7ecf63b530f3b723eb6edc76d235eca342c6e052599eddb5fd922d3942cca3
5e8cf947efecf3277213601e403872e1afd3ecd0c12595ed3c440a07802e8442
626a1b45dfb726aa02dba6eb4015b75a221174f91f5371b913a60c3a86b92424
645c85c47a096414f80fb2a589c4086ea33b22204c08c2c2db86f45d3bda9ad6
66c3443dee1a703e927e8269976d576393b4b86e551c859b4bebcc45cef6f663
66f7fe1471de5f92502a38fcd2c796e92d3eb0154ec74be74195d93d79eadff6
6893c5cd767bf16f8814ae4b820a8996ed49895f2e9a59fe18a587c094fee8fd
6a4c7540c0c3c51feb2266f148848ce27adc65e717ef3bdb8a671411e93a2045
6cb59666c173ea6887d2c29f37c3d2c5ac95d648aad9ad6493a9247af3215192
6d489ed7659a9807cebb71e700fb6ae6ae8b8be566ea5d116be3c4470f57cf1b
706b248caca138a45eb2f0420d1fa38ff9dfceef584c20d7162638d038d403e8
7082f515e51ca981be0d22e9647f586770d6cba06de2f73d3d29c47d60918758
715b3f8974434ad1f23845b14088738f2d3d484b77a510559e022ec3ad592216
73d6e5d1826e94ad196ca526bf3e0a373c3309520bb2b7fd4c2fb43d0c259466
7668e9a8ee3f3506685b2269a26f589ef6ada1fdea931242003f1e7db5ddc152
76cb90d5ac11b6f9777b8aa88d63e04e69110e152514daacc62390fc2cecbbde
7a6cc7acf572850a7396cd004598b7d9585fc4cb4256eedcf36472df9f63c24b
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7befea011c9462df08a59bb28962c266a595bc8776826f15c9dd098b621c9fb0
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7ee6bd4bd09278d65d934110778277ff7f43039d2625930ed3c657049fa00475
7f260ff280b2e54e84e6f9c2790da49cc9abadc457b77d1df4dea121a8c8ab6e
82c512c982d75150bb51f97cb89c9aa15f84dff4fa6a079e844e6e3578aef839
839a20e35ce5c65a470d0df91dc083b94e6df06bb3162faaae7b8cb400a219c3
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
9038dbea3c17e614c865c4390694bbc9b2e453859496e709a97d37d9e0866c0b
9346f80745c549014461e4175c748cf7fb795544f2be0fe2c45dd0eff9643244
9348fa7f55ae75656a1c330fea76789f4ac1f5a05e338902af8b05210e7ef61c
9369f01b809edd4c69b4b8dbe586c6fa0fd737e801d485b11f3ba0a01518e43b
95965900d54c7e7f0ca243ae8770ed860f2eded07a9a2e873e29cc4c44ab486c
96b6b6f3918652c52c8a27e2f11a849dfaa3e28721db0ec65c69c59925c3122b
96bffdfe121db413dae209a92d4f609fe19105176ac18131d9fce1c457dc2ff7
997fd65f1ed0b8b235a55f09192fe202625dbcea91a68bffd73dc7d1abcadc19
99e15e21fe8fead546f6621fbc85685a0b22d77da44231a7a50fdf508731caf9
9c054c233ba0597c8d83a9f54fa67bf318ec262c588d2086ac4245f2d16a1ea4
9c5db6ce4dc5dd7260f21f7fcde1b035cfcca54224da6b394cf15e97096d8c80
9ce14806bc51adaa71c9b8832f7c57f18ca8cbfea36fbf94ddf5eec194182ac9
a39c3cdbdb987dee562a2de964a1d39e27e889fea5e108c3b4ba49fcea2fdc8c
a73f82214e6aa9bd554f0c894fa57d7fe152170c7f4157d610614d088137a41d
a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075
a9e6567358df53f9b31e7eccc1e537dcf6a99cb5924024f1b9cd015bd0c35a9f
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ad664e38b3726ad7583729d98cbc9cdf4200bb8a9f7d5fd2edee2c164275e98a
ae892a0647d1a73896aea016960a1060fec53ac0898a51d5d95d0fe169bc32e9
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af8586fb875a51c0b7a6fdf14d75d3ddf0497771a461d6e852c5375da7f1249a
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1b5e616447d7dd30bb411495b4d2772e6a13f9dbfe917a7211dd8f367cd87bf
b243ae266676dccee611c6ed9eff868b5c1425110010164b31fa120c1fbf26b4
b5c7eb7503144f6cd57bbddb0ad78d77bcad37d88ecf46585dd340a61449661b
b9a3829921f030601d923482197968bd87d9e00904316282225e02756ddf3014
bb290d74839b8966e9bce909665d8df6261aec38566f0888b4650fb105ef6e4d
bb6d369417c05fcafb12428480c1df5c3662aae9982339e8d4228a2171ac8422
bcddae7c91da7bd97a182b850f395405f8345e360f631b475ecf09dfe1068dd4
bdfc85d0363b58d6a764d24b7fc6e76b3d42e7a1da5122001232776a17d8f916
bfd63a3670df6dabce2d1982ee7e058d763cb2fc3fdf4922fc8df7ebad69b151
c1bd651cea184b004cb55a78dbfeabd2768ce75576af8114f4185b640520c06a
c5ec3b8830ed916eebffd15f4518f9a87333b50c3b0c10d108ed239b795c0b2a
ca786bace1f36b0b1d1a2d25124d30eb6a30c7f51f71f3737635698e791e7365
cacbbb7f3cef11f7c7285558291685348abab2396fc8da6ef1388792942cb724
cb04c84b625847684f6b428b2acc5772b549e12d18acf8ca9b6a356cdb661fbc
cc2fc51fc5ade58e3350056a062f6817c41544909061ca953f4aaa41c1ea6d1b
cd09b4ba242a8b4e112ac76ce830dd343409d09e39815b24801672c68e46b311
cf9f44c82cdea699d3a3937cdd8a7caf60ca84cf3d87adfc9fd49fdb84f35261
d3252dd0b99f05fca9861c280ab9df2949ea88206b207a770a8fa8a42dcd3d0c
d3743c6f1dd7dbe1a3677bc1304a36ea74dca1aeb1c5a687cfd4cdf5574e9925
d480d8c899f7bae61b8985b1b73a92b828bb087f57e0c5902f11942ea96750b1
d5773922958407876324a55ff40662ecd526f8829178ab8790a6e8dce853b3f5
d637dae1aa80d0dd5ba985ac364cf9d541e3152949a4f234c010319c8e1f0a02
d77f2bc29b21dcd3e2656f073dd09cc1a658da77bd8d9ab0fcefda0a21fa7fb3
d9ba04e90ac17399077da403dcec63d6cd544ea42152828539571c0b5caccfea
dbdcd13c7b6cefee26516ae098ea682009d06d6054007368b788312b5d03f6e6
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de9dcd951b7dd88f17da2fd7a573b3bf63dd16c9ecada6b61a93acfba7fc299d
df5520815d1855bbe6788df257595be644bf27b1662e485605b2784c70e499b6
dfb99dee1e029d51d6cfb672d847929890b1585402de17f5ed092edd72a688b4
dfced0621406b56297852f394a4b93825c69defcd20ce9e67b439bea504405cb
e2345a1eca5c17bc3be78a9f70681a1db0b725f846179633da2fa53c9a28e585
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e9c5b1987a9c832d022b74eeeb75ad59e6d5192cb85584932da668f9d7f6f5c1
ec595c4c1f819f1b18211993b250c2deb88918d06db5b8292f2de9eda0cbd83a
ecdc3e1733b4465431016227c1c31cd75bb931a284b9728a4478217e8a57eee0
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5
ef99bfee0210da514c96937252ea791f0a0552e0aaf5e18513221bec3cd10cca
f09972b6d95a87c5ee3b1e96ddfaf98090fc4229df485fb868efe318644de756
f0aa888761e5eef0bf608f1c73787ae9a925a762932ba393ebd387627a0ad897
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f63669d5736e8a7e1cbc565d3fe5542cd740af555683ba036b081dde590e21fe
f8882fb82e7ca754fe6c804688bb79940d2a5096e01a1a84a13aaec6b4229d65
f89193713a99ccc53de54f35294edd840a87e0c8021aec68a6ce3ad34d777110
fcc8a30d38eeacb30158d0d90764bb7a725996874d5884b5017b10cc9ff14a34