www.cybertriage.com Open in urlscan Pro
141.193.213.10 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://hubs.li/Q02HYMrh0?trk=public_post-text
Effective URL:
https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=so...
Submission: On July 27 via manual (July 27th 2024, 10:49:25 am UTC) from CZ — Scanned from DE

Summary HTTP 57 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 25 IPs in 3 countries across 22 domains to perform 57 HTTP transactions. The main IP is 141.193.213.10, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.cybertriage.com.
TLS certificate: Issued by E5 on July 24th 2024. Valid for: 3 months.

This is the only time www.cybertriage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:440... 2606:4700:4400::6812:2041	13335 (CLOUDFLAR...) (CLOUDFLARENET)
24	141.193.213.10 141.193.213.10	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
3	2606:4700:10:... 2606:4700:10::6816:47c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	45.79.188.33 45.79.188.33	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
2	2606:4700:303... 2606:4700:3037::ac43:8ef5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:8bd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:6ffe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:df98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:afc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:7574	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:22e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:46c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6813:afbc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:f26c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:480... 2a02:26f0:480:15::213:7e63	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6810:7674	13335 (CLOUDFLAR...) (CLOUDFLARENET)
57	25

1 2606:4700:4400::6812:2041 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

hubs.li	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.cybertriage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6816:47c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.79.188.33 (Cedar Knolls, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 45-79-188-33.ip.linodeusercontent.com

assets.basistech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::ac43:8ef5 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:8bd1 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:6ffe (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:df98 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:afc9 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7574 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cta-service-cms2.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:22e5 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:46c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:afbc (United States)

ASN13335 (CLOUDFLARENET, US)

perf-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:f26c (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:15::213:7e63 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7674 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	cybertriage.com www.cybertriage.com	401 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 669 px4.ads.linkedin.com — Cisco Umbrella Rank: 7330	2 KB
4	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 6145	29 KB
3	hubspot.com js.hubspot.com — Cisco Umbrella Rank: 8139 cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 8074 track.hubspot.com — Cisco Umbrella Rank: 5359	26 KB
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 252	396 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 104	21 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 9601 forms.hscollectedforms.net — Cisco Umbrella Rank: 9837	25 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	198 KB
2	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 5414	2 KB
2	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1950	89 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1884	14 KB
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 7580	1 KB
1	hsforms.com perf-na1.hsforms.com — Cisco Umbrella Rank: 8524	928 B
1	google.de www.google.de — Cisco Umbrella Rank: 6716	63 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3773
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 5067	26 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 5135	25 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 7189	4 KB
1	gstatic.com fonts.gstatic.com	33 KB
1	basistech.com assets.basistech.com	51 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	1 KB
1	hubs.li 1 redirects hubs.li — Cisco Umbrella Rank: 666163	759 B
57	22

	Domain	Requested by
24	www.cybertriage.com	www.cybertriage.com
4	static.addtoany.com	www.cybertriage.com static.addtoany.com
3	px.ads.linkedin.com	1 redirects snap.licdn.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.googletagmanager.com	www.cybertriage.com www.googletagmanager.com
2	js.hs-scripts.com	www.cybertriage.com www.googletagmanager.com
2	use.fontawesome.com	www.cybertriage.com use.fontawesome.com
1	track.hubspot.com
1	px4.ads.linkedin.com	www.cybertriage.com
1	snap.licdn.com	js.hsadspixel.net
1	api.hubapi.com	js.hsadspixel.net
1	perf-na1.hsforms.com	www.cybertriage.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	cta-service-cms2.hubspot.com	js.hubspot.com
1	www.google.de	www.cybertriage.com
1	region1.analytics.google.com	www.googletagmanager.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hubspot.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	fonts.gstatic.com	fonts.googleapis.com
1	assets.basistech.com	www.cybertriage.com
1	fonts.googleapis.com	www.cybertriage.com
1	hubs.li	1 redirects
57	26

This site contains links to these domains. Also see Links.

Domain
learn.microsoft.com
unit42.paloaltonetworks.com
attack.mitre.org
github.com
lolbas-project.github.io
u0041.co
docs.cybertriage.com
windoh.wordpress.com
thinkdfir.com
digitalforensicsurvivalpodcast.libsyn.com
www.basistech.com
twitter.com
www.reddit.com
www.linkedin.com
www.facebook.com
www.youtube.com
www.addtoany.com

Subject Issuer	Validity	Valid
www.cybertriage.com E5	`2024-07-24` - `2024-10-22`	3 months	crt.sh
upload.video.google.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
static.addtoany.com E5	`2024-06-21` - `2024-09-19`	3 months	crt.sh
assets.basistech.com R11	`2024-07-15` - `2024-10-13`	3 months	crt.sh
use.fontawesome.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-10`	a year	crt.sh
hs-scripts.com E1	`2024-05-31` - `2024-08-29`	3 months	crt.sh
*.google-analytics.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
hscollectedforms.net WE1	`2024-07-25` - `2024-10-23`	3 months	crt.sh
hsadspixel.net E6	`2024-06-14` - `2024-09-12`	3 months	crt.sh
hs-analytics.net WE1	`2024-06-11` - `2024-09-09`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
hs-banner.com E1	`2024-05-30` - `2024-08-28`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
*.google.de WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
hsforms.com WE1	`2024-06-14` - `2024-09-12`	3 months	crt.sh
hubapi.com E6	`2024-07-02` - `2024-09-30`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-07-01` - `2025-01-01`	6 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
Frame ID: E9ACDEEF27582C0342BE83DC059B535C
Requests: 57 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: E4C0F6056061F5EDD9E4E0B563A57E12
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DFIR Breakdown: Using Certutil To Download Attack Tools - Cyber Triage

Page URL History Show full URLs

https://hubs.li/Q02HYMrh0?trk=public_post-text HTTP 301
https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

57
Requests

98 %
HTTPS

88 %
IPv6

22
Domains

26
Subdomains

25
IPs

3
Countries

980 kB
Transfer

2299 kB
Size

16
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
Title: Certutil

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/retefe-banking-trojan-targets-sweden-switzerland-and-japan/
Title: here

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/software/S0160/
Title: certutil software

Search URL Search Domain Scan URL

URL: https://github.com/LOLBAS-Project/LOLBAS/blob/master/README.md
Title: LOLBAS Project

Search URL Search Domain Scan URL

URL: https://lolbas-project.github.io/lolbas/Binaries/Certutil/
Title: here

Search URL Search Domain Scan URL

URL: https://u0041.co/posts/articals/certutil-artifacts-analysis/
Title: here

Search URL Search Domain Scan URL

URL: https://github.com/AbdulRhmanAlfaifi/CryptnetURLCacheParser
Title: here

Search URL Search Domain Scan URL

URL: https://docs.cybertriage.com/en/latest/chapters/intel/index.html#chapters-intel-index--page-root
Title: malware analysis

Search URL Search Domain Scan URL

URL: https://windoh.wordpress.com/2011/04/23/crl-caching-in-windows-and-a-little-bit-about-ocsp-caching-too/
Title: here

Search URL Search Domain Scan URL

URL: https://thinkdfir.com/2020/07/30/certutil-download-artefacts/
Title: https://thinkdfir.com/2020/07/30/certutil-download-artefacts/

Search URL Search Domain Scan URL

URL: https://digitalforensicsurvivalpodcast.libsyn.com/dfsp-404-certutil-attacks
Title: https://digitalforensicsurvivalpodcast.libsyn.com/dfsp-404-certutil-attacks

Search URL Search Domain Scan URL

URL: https://www.basistech.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.basistech.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://twitter.com/cybertriage
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/CyberTriage/
Title: Reddit

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cyber-triage/
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CyberTriage
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCmiKEstYkQRUlTtU9R4JaRw
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hubs.li/Q02HYMrh0?trk=public_post-text HTTP 301
https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 53

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4664700&time=1722077359720&url=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4664700&time=1722077359720&url=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951&e_ipv6=AQL2GVoaTqg5PAAAAZDzzy77BptrI3v7trc3wmROnyCXm-nkKnPHq4JnA0ao6FzZuUXfZsVPxx2a4dYLE-7-wFj5TZ_r1Q

57 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/
Redirect Chain

https://hubs.li/Q02HYMrh0?trk=public_post-text
https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951

88 KB
17 KB

1368ms
601ms

Document
text/html

141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

743e85ed383df0246a4fbb524668cf1883a9f2247dd4f8866c95b05cf35ba31e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8a9c0fe0fc88916b-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 27 Jul 2024 10:49:18 GMT
link: <https://www.cybertriage.com/wp-json/>; rel="https://api.w.org/" <https://www.cybertriage.com/wp-json/wp/v2/posts/27235>; rel="alternate"; type="application/json" <https://www.cybertriage.com/?p=27235>; rel=shortlink
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 1
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WP Engine
x-xss-protection: 1

Redirect headers

access-control-allow-credentials: false
cf-cache-status: DYNAMIC
cf-ray: 8a9c0fda1fe68efb-FRA
date: Sat, 27 Jul 2024 10:49:17 GMT
link: <https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951>; rel="canonical"
location: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
referrer-policy: no-referrer
server: cloudflare
vary: origin
x-content-type-options: nosniff
x-envoy-upstream-service-time: 16
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/etsu-td/envoy-proxy-6fbcbcc66c-nbn8j
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: a0656b9c-166a-44ad-b5b3-a27c8247875c
x-request-id: a0656b9c-166a-44ad-b5b3-a27c8247875c
x-robots-tag: none

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
1 KB 48ms
19ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900&display=swap

Requested by

Host: www.cybertriage.com
URL: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8ed40b4be7a49bbc6382f2b7439e6af9eb3a57b5575576d7c39f7085fbf2e3b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 27 Jul 2024 10:49:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 27 Jul 2024 10:24:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 27 Jul 2024 10:49:18 GMT

GET
H3 200 style.min.css
www.cybertriage.com/wp-includes/css/dist/block-library/ 111 KB
15 KB 32ms
31ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:33 GMT
server: cloudflare
age: 1279547
etag: W/"66912e55-1bae5"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57a90916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 style.css
www.cybertriage.com/wp-content/uploads/maxmegamenu/ 69 KB
7 KB 36ms
35ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/uploads/maxmegamenu/style.css?ver=ebf4a3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e85f4c2da0e2c184163258375056fd61e5e53c98450daa7355c0c7b415eb2b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:34 GMT
server: cloudflare
age: 1279547
etag: W/"66912e56-115be"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57a91916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 dashicons.min.css
www.cybertriage.com/wp-includes/css/ 58 KB
35 KB 27ms
25ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-includes/css/dashicons.min.css?ver=6.5.5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:33 GMT
server: cloudflare
age: 1279547
etag: W/"66912e55-e688"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57a95916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 plugins.css
www.cybertriage.com/wp-content/themes/cybertriage2021/css/ 6 KB
2 KB 25ms
24ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/css/plugins.css?ver=1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9cdeb15b8242f0eb4ff22b8834ca732782965339edffed3d8eccd19bd0355fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
age: 1279547
etag: W/"66912e59-186b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57a97916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 style.css
www.cybertriage.com/wp-content/themes/cybertriage2021/ 75 KB
15 KB 47ms
46ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/style.css?ver=14.31

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4686f81d36236fc2c54854604ec5f12609d56d292c4e42ddf00fb18ddbc7a7c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 26 Jul 2024 15:43:32 GMT
server: cloudflare
age: 57342
etag: W/"66a3c424-12c06"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57a9b916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 video-page-plugins.css
www.cybertriage.com/wp-content/themes/cybertriage2021/css/ 13 KB
3 KB 38ms
36ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/css/video-page-plugins.css?ver=3.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5542df8e54683fc16bb23e0d440443069d8ed326ff50bc8087de6d4c9e29bc28

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
age: 234452
etag: W/"66912e59-3223"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57a9e916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 addtoany.min.css
www.cybertriage.com/wp-content/plugins/add-to-any/ 2 KB
741 B 39ms
37ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:39 GMT
server: cloudflare
age: 1279547
etag: W/"66912e5b-644"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57a9f916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 41ms
28ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f06bf06915359224831501cef5d0c410b2dccf80d1b6082b776f6147e18ee524

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 12342
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"3b1eac2bad1254b5d88c9f99d5f79d65"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F9AlXrf8dcbfXv8j2AIpecde0j3aE9zkSlhEDVRBLdemK%2B7voc59xTljffrtUd1CU8sdIeOq6HM%2FHdJsEGPPAbVEc5Lsqo%2BqAEn0dcMJWozAp8eGMIK8TllId%2FTDcnpfXRNKmmTbLW%2FZ2CHLKRLHUAUk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 8a9c0fe61d602c52-FRA

GET
H3 200 jquery.min.js Show response
www.cybertriage.com/wp-includes/js/jquery/ 86 KB
31 KB 49ms
48ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:33 GMT
server: cloudflare
age: 1279547
etag: W/"66912e55-15601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57aa1916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery-migrate.min.js Show response
www.cybertriage.com/wp-includes/js/jquery/ 13 KB
5 KB 38ms
37ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:33 GMT
server: cloudflare
age: 1273448
etag: W/"66912e55-3509"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe57aa4916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 addtoany.min.js Show response
www.cybertriage.com/wp-content/plugins/add-to-any/ 129 B
314 B 29ms
25ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:39 GMT
server: cloudflare
age: 1273448
etag: W/"66912e5b-81"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe60b41916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 facebook.png
www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/ 748 B
1 KB 29ms
25ms Image
image/webp 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/facebook.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

383998e5815442cdc84c798b467f4bbb3faa5d802b73674e1fcf3aac30e6fefa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 266056
cf-polished: origFmt=png, origSize=1732
content-disposition: inline; filename="facebook.webp"
alt-svc: h3=":443"; ma=86400
content-length: 748
cf-bgj: imgq:100,h2pri
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
etag: "66912e59-6c4"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8a9c0fe60b42916b-FRA

GET
H3 200 twitter.png
www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/ 794 B
1 KB 40ms
37ms Image
image/webp 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/twitter.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d567f8fed3e76eaa26fd9d5a57e7c84fb8f7b645dc2360a9eff212cff89d375b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 191223
cf-polished: origFmt=png, origSize=1935
content-disposition: inline; filename="twitter.webp"
alt-svc: h3=":443"; ma=86400
content-length: 794
cf-bgj: imgq:100,h2pri
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
etag: "66912e59-78f"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8a9c0fe60b43916b-FRA

GET
H3 200 linkedin.png
www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/ 672 B
954 B 37ms
34ms Image
image/webp 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/linkedin.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c8832e0fd81a244478bf9728715f61a1331b942558cc78cc1d34ee09bee81d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 191223
cf-polished: origFmt=png, origSize=1651
content-disposition: inline; filename="linkedin.webp"
alt-svc: h3=":443"; ma=86400
content-length: 672
cf-bgj: imgq:100,h2pri
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
etag: "66912e59-673"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8a9c0fe60b44916b-FRA

GET
H3 200 reddit.png
www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/ 918 B
1 KB 41ms
38ms Image
image/webp 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/assets/social/reddit.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c96789a38d469846ca2bd4ae33cc4c3383873aef458fb26a12100c003ccefa93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 191223
cf-polished: origFmt=png, origSize=2175
content-disposition: inline; filename="reddit.webp"
alt-svc: h3=":443"; ma=86400
content-length: 918
cf-bgj: imgq:100,h2pri
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
etag: "66912e59-87f"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8a9c0fe60b45916b-FRA

GET
H/1.1 200
OK BasisTech-text-white-bamboo-cutout.png
assets.basistech.com/ 51 KB
51 KB 538ms
100ms Image
image/png 45.79.188.33
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.basistech.com/BasisTech-text-white-bamboo-cutout.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.79.188.33 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),

Reverse DNS

45-79-188-33.ip.linodeusercontent.com

Software

Apache/2.4.52 (Ubuntu) /

Resource Hash

5d6ddcfeb4b5d1fa0b3bb7e992c53b79b9291f4e3938412d3c0bed29278f18f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Sat, 27 Jul 2024 10:49:19 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Mon, 22 Aug 2022 22:50:42 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "cb52-5e6dc47011480"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 52050

GET
H2 200 all.css
use.fontawesome.com/releases/v5.15.4/css/ 58 KB
13 KB 54ms
26ms Stylesheet
text/css 2606:4700:3037::ac43:8ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.15.4/css/all.css?ver=6.5.5
Requested by: Host: www.cybertriage.com
URL: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8ef5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:45:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 141326
etag: W/"ecd507b3125edc4d2a03aa6ae5d07da9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qWZF7UJFk9dhAzn0KlRA4jAYCmawruAsKkAfY7tu1SabZkGva2MHqcTN7s3pdmr%2BovSnLK2XsNmrxMILPw5k%2BiIdPRoZ6oAuKE9wpHn0iDaFvIrcphLfLlumRgy4UpMQnixYz3dY7bpHKcaVS3NoI5XN"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 8a9c0fe5aebe3615-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 23399343.js Show response
js.hs-scripts.com/ 2 KB
1 KB 69ms
34ms Script
application/javascript 2606:4700::6810:8bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/23399343.js?integration=WordPress&ver=11.1.22

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58fb302f68f005fca51cd4743a031eab94c72ed0d616bf319d7d8ce6025c0604

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f03a8dcf-59de-4754-aae9-1ca1b582d60e
cf-polished: origSize=2540
age: 24
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f03a8dcf-59de-4754-aae9-1ca1b582d60e
cf-bgj: minify
last-modified: Sat, 27 Jul 2024 10:48:55 GMT
server: cloudflare
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.autopsy.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-7dd59b876-mtwxl
x-evy-trace-virtual-host: all
access-control-allow-credentials: true
cache-control: public, max-age=90
cf-ray: 8a9c0fe61b0d9b25-FRA
expires: Sat, 27 Jul 2024 10:50:49 GMT

GET
H3 200 plugins.js Show response
www.cybertriage.com/wp-content/themes/cybertriage2021/js/ 85 KB
22 KB 28ms
25ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/js/plugins.js?ver=3.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

df8d168cd22bc91dcbec6d603ffb3efa6dc8433331f59af457258554f5389d91

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
age: 1279548
etag: W/"66912e59-1551d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe60b33916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 global.js Show response
www.cybertriage.com/wp-content/themes/cybertriage2021/js/ 6 KB
2 KB 43ms
40ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/js/global.js?ver=4.03

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec0f0f22d1883c8e341d6a4ca257b8edca8549afb73c22c11e61793a5fcd3e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:36 GMT
server: cloudflare
age: 1279548
etag: W/"66912e58-182a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe60b36916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 video-page-plugins.js Show response
www.cybertriage.com/wp-content/themes/cybertriage2021/js/ 134 KB
39 KB 41ms
37ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/js/video-page-plugins.js?ver=3.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b383afe19e877f3053153bf0980e6b293abf6454f161470e7ecec0e918b8ae7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:37 GMT
server: cloudflare
age: 1279548
etag: W/"66912e59-218de"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe60b39916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 video-page-triggers.js Show response
www.cybertriage.com/wp-content/themes/cybertriage2021/js/ 4 KB
2 KB 31ms
27ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/themes/cybertriage2021/js/video-page-triggers.js?ver=3.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f591c511b80091461cecd36d6f95808c46ca8d7fc2a9d1b73d089112c5be99f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:36 GMT
server: cloudflare
age: 1279548
etag: W/"66912e58-10d7"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe60b3c916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 hoverIntent.min.js Show response
www.cybertriage.com/wp-includes/js/ 1 KB
957 B 43ms
39ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-includes/js/hoverIntent.min.js?ver=1.10.2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:33 GMT
server: cloudflare
age: 1273449
etag: W/"66912e55-5db"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe60b3e916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 maxmegamenu.js Show response
www.cybertriage.com/wp-content/plugins/megamenu/js/ 33 KB
6 KB 29ms
25ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/wp-content/plugins/megamenu/js/maxmegamenu.js?ver=3.3.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a875e1d5f8cfe252cc8f5e04d750dd8c771fb8aceabd435d548425a445ab61d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:38 GMT
server: cloudflare
age: 1273449
etag: W/"66912e5a-82aa"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fe60b40916b-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 221 KB
79 KB 51ms
26ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TVQV5RN

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e81e4353262f5904d8503a1ffc7643fd1bef2a62da92b28b55dbb7dbba0e1d42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80559
x-xss-protection: 0
last-modified: Sat, 27 Jul 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 27 Jul 2024 10:49:19 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 70ms
24ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.cybertriage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 23 Jul 2024 15:27:45 GMT
x-content-type-options: nosniff
age: 328894
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Jul 2025 15:27:45 GMT

GET
DATA 200
OK truncated
/ 31 KB
31 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6db83b2803fed3f9b574567755102b18c401904a374c8acf4c9a2e9b0159cb4f

Request headers

Referer
Origin: https://www.cybertriage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.15.4/webfonts/ 75 KB
76 KB 82ms
37ms Font
font/woff2 2606:4700:3037::ac43:8ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.15.4/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.15.4/css/all.css?ver=6.5.5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8ef5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef

Request headers

Referer: https://use.fontawesome.com/releases/v5.15.4/css/all.css?ver=6.5.5
Origin: https://www.cybertriage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1391295
alt-svc: h3=":443"; ma=86400
content-length: 76736
last-modified: Fri, 22 Sep 2023 01:45:26 GMT
server: cloudflare
etag: "ed311c7a0ade9a75bb3ebf5a7670f31d"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=alX%2FnRPy0luMhfVoULQC4N0dIW%2BZSL9pnXv%2BCTgtSkDbJWK1honvDotFYhP9II24ABZJX3NXJ2Rrr6%2BuKjtY20A5jadoFC6aTl%2FfTQ%2BASPfTBzgCMTBuG%2FXVBqiW%2BiFe2Y49bcyFSZadEmFErck7nQbO"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 8a9c0fe68d5a5d55-FRA

GET
H3 200 2024-7-certutil-1-800x427.png
www.cybertriage.com/wp-content/uploads/2024/07/ 78 KB
79 KB 42ms
38ms Image
image/webp 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybertriage.com/wp-content/uploads/2024/07/2024-7-certutil-1-800x427.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4014a53b54891ab7493caad36030cff934eeb51967a526020fb60ab07114ef6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 101497
cf-polished: origFmt=png, origSize=116732
content-disposition: inline; filename="2024-7-certutil-1-800x427.webp"
alt-svc: h3=":443"; ma=86400
content-length: 80230
cf-bgj: imgq:100,h2pri
last-modified: Thu, 18 Jul 2024 21:56:16 GMT
server: cloudflare
etag: "66998f80-1c7fc"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8a9c0fe63b81916b-FRA

GET
H3 200 2024-7-certutil-2-800x424.png
www.cybertriage.com/wp-content/uploads/2024/07/ 111 KB
112 KB 831ms
828ms Image
image/png 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cybertriage.com/wp-content/uploads/2024/07/2024-7-certutil-2-800x424.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b9d28da2ea82d0fe63d5476b2be7fbf8d3f6a3a9cfeae2dabb9273ee069bfe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 21:56:18 GMT
server: cloudflare
etag: "66998f82-1bda5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8a9c0fe63b83916b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 114085

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 207ms
119ms Script
application/javascript 2606:4700::6810:6ffe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/23399343.js?integration=WordPress&ver=11.1.22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c78fab07d4ee469def66170220968c4e790992e5adc971a34edc7eabc695e79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
Origin: https://www.cybertriage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.586/bundles/project.js&cfRay=8a9c0fe6e807924d-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"ac41634810840adc02ea51748cb19c2f"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.586/bundles/project.js
date: Sat, 27 Jul 2024 10:49:19 GMT
x-amz-version-id: FCxgV_B3nWescR00el0uV0Hdj2lazDBZ
x-content-type-options: nosniff
cf-cache-status: EXPIRED
via: 1.1 06c1d28e93bdae8f6401a12c10b2f570.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 876b2832-d464-4d8f-96d3-f6451db25abd
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 5
x-evy-trace-route-configuration: listener_https/all
x-request-id: 876b2832-d464-4d8f-96d3-f6451db25abd
last-modified: Tue, 23 Jul 2024 12:55:20 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-2jprr
cf-ray: 8a9c0fe6e807924d-FRA
x-amz-cf-id: GNFYcLqoyrc3Q86tbllpvb-dLE_xCgU3Dcdm7qUbMls2UNwucO4dZQ==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 108ms
22ms Script
application/javascript 2606:4700::6811:df98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/23399343.js?integration=WordPress&ver=11.1.22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:df98 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dea7d93054c054d6908de184845b8db289207bb4928bbdd07d0ad8d52ec0708f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
x-amz-version-id: kl1dxvjzkssE.fV_O4PhpuAJA5n_6jGg
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 a4f9ca051b97c1ac09e2af244690d376.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 268
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.571/bundles/pixels-release.js&cfRay=8a9c095b6c4a1e54-FRA
x-cache: Hit from cloudfront
x-hubspot-correlation-id: 46847c3c-8abb-4693-b6bd-34ef2fa9f226
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 46847c3c-8abb-4693-b6bd-34ef2fa9f226
last-modified: Fri, 19 Jul 2024 20:16:33 UTC
server: cloudflare
etag: W/"5d8f21e5e9508f10da257acb3360bbbd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-kt4hg
cf-ray: 8a9c0fe6ecfa3618-FRA
x-amz-cf-id: _1kXBSI1Q9_Ay-OJHQmQRqFAB7apkLGhIGkfbfRquegXHqidufR2IA==
x-hs-target-asset: adsscriptloaderstatic/static-1.571/bundles/pixels-release.js

GET
H2 200 23399343.js Show response
js.hs-analytics.net/analytics/1722077100000/ 69 KB
25 KB 221ms
136ms Script
text/javascript 2606:4700::6811:afc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1722077100000/23399343.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/23399343.js?integration=WordPress&ver=11.1.22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df9cbb58ca11e14fc82bada8739aa943c22e8bebac66c54d9e1cbe4f970e9ce8

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: MISS
x-amz-request-id: X5MJYG33BCRVG1X5
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 728066a4-0da6-4d8c-8104-338e8064dcea
x-envoy-upstream-service-time: 22
x-amz-id-2: ZV66ZUATjVqG72vHfNTKlsGqZn44UlMRz4xjwcV+9oeeLfdvSDGCNhFkr4VpYxziF+U5TUR+Cvg=
x-evy-trace-listener: listener_https
x-request-id: 728066a4-0da6-4d8c-8104-338e8064dcea
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 26 Jul 2024 21:12:26 GMT
server: cloudflare
etag: W/"67249e3be743f96e506adaa16da39130"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-lw9wf
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8a9c0fe6eb514d64-FRA
expires: Sat, 27 Jul 2024 10:54:19 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 82 KB
24 KB 203ms
119ms Script
application/javascript 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/23399343.js?integration=WordPress&ver=11.1.22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c83d141e62216b5d071e70ca3a4d683ed137d20cfadebd57dd7a85aa672545a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
Origin: https://www.cybertriage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1270/bundles/project.js&cfRay=8a9c0fe6ef758fc8-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"3a0fbe94ca02fc82b8023b601eb1c059"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1270/bundles/project.js
date: Sat, 27 Jul 2024 10:49:19 GMT
x-amz-version-id: MxCt6gVg2smW7YsxOhv0LXmditJ.U_pY
x-content-type-options: nosniff
cf-cache-status: EXPIRED
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: cb97bfad-64a7-4df0-8bb8-52258beb7d64
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 3
x-evy-trace-route-configuration: listener_https/all
x-request-id: cb97bfad-64a7-4df0-8bb8-52258beb7d64
last-modified: Tue, 23 Jul 2024 18:42:20 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1QfoJGb4iC5Djr5NJis2bu8y72HwSuU15HaiL43xKD8qBQXgyblQRQS9kdMiNMZJ7iR5ozXmhN%2BUbL4hoIiSoZz8jQZN6q%2BhB5L2DHyu3DcIDbY9uQTDqUGq%2FTiQTK44Zx%2BD9yedMirIWpIx"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-rkwqq
cf-ray: 8a9c0fe6ef758fc8-FRA
x-amz-cf-id: pELV5uhrfSFvOvtQMz2QKvuZXTVvDlRmCG1qoJD04Tnoti05_U1h6w==

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/23399343/ 71 KB
26 KB 399ms
312ms Script
text/javascript 2606:4700:4400::6812:22e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/23399343/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/23399343.js?integration=WordPress&ver=11.1.22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd55830d977b8fb0d175953c232082a8305e862df5ed865b9f67832546e795d1

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
x-amz-version-id: 4hqqA21SGrpmhqJZ_cUitEhvyS.OGRdF
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: 111RJYZPCKZH1QH4
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 127d4d2d-476b-4fba-9368-928427fe5fe2
x-envoy-upstream-service-time: 122
x-amz-id-2: vWC2qfSKe45jQUV8fO1eMpDF5OmHiQ+yf3jU/H9XUyZfMPw5OVVc8ym38QlVvj7uqWO7YQMm90Q=
x-evy-trace-listener: listener_https
x-request-id: 127d4d2d-476b-4fba-9368-928427fe5fe2
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 15 Apr 2024 16:55:42 GMT
server: cloudflare
etag: W/"84654da85f980ad6a74c9648aa1de84b"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.autopsy.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-rslzw
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8a9c0fe6ef429106-FRA
expires: Sat, 27 Jul 2024 10:54:19 GMT

GET
H3 200 sm.25.html
static.addtoany.com/menu/ Frame E4C0 0
0 46ms
33ms Document
text/html 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 9239
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8a9c0fe68b004db6-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 27 Jul 2024 10:49:19 GMT
last-modified: Sat, 27 Jul 2024 08:15:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bwx3kDVJmqOicRxELTr060ABiQn7uYLKHAIniiJqHPjCQHPMqS9U9%2FxmfVOVkgPquWjqlWQ6qA9hEDb4hQ2O1xisJnFj0N17B4oEg1vpPRruNaTLw0AEuAVfu81meJD5uO%2FfLxhY"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.D0Uc7kY6.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 55ms
36ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
Origin: https://www.cybertriage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 21667
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"6fea96ea56ee4fff557b8776f9c8c3a6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NiEWlH4zEZS1wbaCjZxAtKN%2FvFP94oEHrh4CDWs7ufPfABQNIlXoZb7Q%2FCy5nsML%2Bj5pEfiM74EuRwiJgnV5wLFkJ4Tl1on6vfrrqeJP8fTSxZj4We%2ByQinVmlUsfVEReT2Ed7to"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 8a9c0fe67fea2c3d-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 369 KB
119 KB 34ms
30ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZJXWCWJBTE&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVQV5RN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6e493391385775f9eb300ef972c8cc6df934ba91bfe568cd4fd233cb0086ba76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 121704
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 27 Jul 2024 10:49:19 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 108ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVQV5RN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 27 Jul 2024 10:29:07 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1212
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 27 Jul 2024 12:29:07 GMT

GET
H2 200 23399343.js Show response
js.hs-scripts.com/ 2 KB
905 B 130ms
122ms Script
application/javascript 2606:4700::6810:8bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/23399343.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVQV5RN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1a6d646b3bc903442eb82c0d78be8c7b6cae71e05599d7dfa436d1902f93850

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 9e57a70c-b8ad-4b22-9abd-6be68b506533
x-envoy-upstream-service-time: 5
content-length: 680
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 9e57a70c-b8ad-4b22-9abd-6be68b506533
last-modified: Sat, 27 Jul 2024 10:49:19 GMT
server: cloudflare
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.cybertriage.com
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-7dd59b876-qghx6
access-control-allow-credentials: true
cache-control: public, max-age=90
accept-ranges: bytes
cf-ray: 8a9c0fe6fc049b25-FRA
expires: Sat, 27 Jul 2024 10:50:49 GMT

GET
H3 200 de.js Show response
static.addtoany.com/menu/locale/ 750 B
1017 B 24ms
24ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/locale/de.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9186
cf-polished: origSize=902
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"86610d84a116a5704d658324728b063f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UNnZgXGjznLBmCIH66Zbr1czDJVJh2lhyhqalk86eJcTA7cnPcmG8z%2B4c33lhjrTgmV2JUZz5v1V36zX28b0h%2FRWT%2FSWdb2IJQ0Tn1A2NpVGD2XhsvvvXcJ9k8AlelqPOukFCYk37tqi9py%2Fnux8gxtr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 8a9c0fe70e642c52-FRA

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 38ms
15ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-ZJXWCWJBTE&gtm=45je47o0v9129983567z8830890779za200zb830890779&_p=1722077359032&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250753&cid=1526544773.1722077359&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1722077359&sct=1&seg=0&dl=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951&dt=DFIR%20Breakdown%3A%20Using%20Certutil%20To%20Download%20Attack%20Tools%20-%20Cyber%20Triage&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2178
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZJXWCWJBTE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 27 Jul 2024 10:49:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybertriage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 76ms
23ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZJXWCWJBTE&cid=1526544773.1722077359&gtm=45je47o0v9129983567z8830890779za200zb830890779&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZJXWCWJBTE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 27 Jul 2024 10:49:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybertriage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 51ms
34ms Image
image/gif 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZJXWCWJBTE&cid=1526544773.1722077359&gtm=45je47o0v9129983567z8830890779za200zb830890779&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&z=638982998

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 27 Jul 2024 10:49:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
211 B 16ms
15ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=986994397&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951&ul=de-de&de=UTF-8&dt=DFIR%20Breakdown%3A%20Using%20Certutil%20To%20Download%20Attack%20Tools%20-%20Cyber%20Triage&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACAAI~&jid=1176035733&gjid=830547922&cid=1526544773.1722077359&tid=UA-215658-14&_gid=2054488467.1722077359&_slc=1&gtm=45He47o0n81TVQV5RNv830890779za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=1308681191

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 27 Jul 2024 10:49:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybertriage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
349 B 45ms
22ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-215658-14&cid=1526544773.1722077359&jid=1176035733&gjid=830547922&_gid=2054488467.1722077359&npa=1&_u=YCDAiEABBAAAAGAAI~&z=67987687

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 27 Jul 2024 10:49:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cybertriage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 61 B
1 KB 131ms
121ms Fetch
application/json 2606:4700::6810:7574
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=23399343&currentUrl=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: cd37ecee-5733-4a0a-9e4f-22e12eb8c232
content-encoding: br
x-envoy-upstream-service-time: 6
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: cd37ecee-5733-4a0a-9e4f-22e12eb8c232
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.cybertriage.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=26Y3pYAxVbLDFLmz41EXMe%2FduWQuXc1Ga%2F1O6bXIni%2BvnTiWbwtMCXXr6jiDsEUosTGlqaXZx%2FP%2FV7XHnCB7DlIhWGPfQFMtJ3X%2BttshOhZkZbrOBok5gdo5lECDPb9p28NR0sGBGvYwCUKmPe9DIhgBfvA3IZy%2BlWM%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8a9c0fe7c8568fc8-FRA
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-cj8pw

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 135 B
435 B 132ms
123ms XHR
application/json 2606:4700::6810:6ffe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=23399343&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7e5d4895e4655fcc6f420fe087c7ccf124bc14dc9088590970cf0424ce9fb35

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 7822c07c-1aed-42b0-bddd-6c983b1d7dab
x-envoy-upstream-service-time: 10
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7822c07c-1aed-42b0-bddd-6c983b1d7dab
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.cybertriage.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-lkr4k
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8a9c0fe7e90b924d-FRA

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
928 B 148ms
124ms Image
image/gif 2606:4700::6813:afbc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:afbc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f2a4db80-686e-4047-bd52-f99451f90349
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f2a4db80-686e-4047-bd52-f99451f90349
last-modified: Sat, 27 Jul 2024 10:49:19 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-776cb5686f-nlgnj
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8a9c0fe8b9ac9042-FRA

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 114 B
1 KB 165ms
138ms XHR
application/json 2606:4700::6812:f26c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=23399343

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:f26c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a98f05a5c0d5018f28a663c81dbf4080a4cd3a34ef009a7c3e714319efeeb19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 7b609d22-0fe0-43d2-9c6f-36d8009c07a1
content-encoding: br
x-envoy-upstream-service-time: 9
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7b609d22-0fe0-43d2-9c6f-36d8009c07a1
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.cybertriage.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-7dd59b876-8h52p
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lge9%2FIMM5157E8Wf%2B01fAh3Jrcznx16cNYntnNIMNEry7Cl7xEaqFw32CKJOzes76SKzhzs0JEG%2Bh8CBVCJpsJIKDMREYEtkZ6nbv0sdS3FYj9PhN8bTNGwcK2j6ZNpeNDd8gB4gigFEkSyl"}],"group":"cf-nel","max_age":604800}
cf-ray: 8a9c0fe91d4c9f17-FRA
access-control-allow-headers: *

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 45ms
14ms Script
application/javascript 2a02:26f0:480:15::213:7e63
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:15::213:7e63 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2024 05:33:09 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=57488
accept-ranges: bytes
content-length: 14597

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
817 B 206ms
153ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=4664700&time=1722077359720&url=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: *
Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
content-encoding: gzip
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: EDE3294EC4324D56B068CABDF7C58534 Ref B: FRAEDGE1120 Ref C: 2024-07-27T10:49:19Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-ltx1
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-li-uuid: AAYeOGFPN2LR+z2UTPPDww==
x-fs-uuid: 00061e38614f3762d1fb3d944cf3c3c3

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4664700&time=1722077359720&url=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4664700&time=1722077359720&url=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content...

0
265 B

226ms
181ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4664700&time=1722077359720&url=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951&e_ipv6=AQL2GVoaTqg5PAAAAZDzzy77BptrI3v7trc3wmROnyCXm-nkKnPHq4JnA0ao6FzZuUXfZsVPxx2a4dYLE-7-wFj5TZ_r1Q
Requested by: Host: www.cybertriage.com
URL: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 5CE012C032F34F1DA6D86435939B7154 Ref B: FRAEDGE1511 Ref C: 2024-07-27T10:49:19Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYeOGFS4txW4+GwNeXdTQ==

Redirect headers

date: Sat, 27 Jul 2024 10:49:19 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: DB830F7E011B4ADCBC16182F8747DAC5 Ref B: FRAEDGE1818 Ref C: 2024-07-27T10:49:19Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4664700&time=1722077359720&url=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951&e_ipv6=AQL2GVoaTqg5PAAAAZDzzy77BptrI3v7trc3wmROnyCXm-nkKnPHq4JnA0ao6FzZuUXfZsVPxx2a4dYLE-7-wFj5TZ_r1Q
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYeOGFPalviZ7VAbcdZPQ==

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
199 B 184ms
183ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sat, 27 Jul 2024 10:49:19 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: BE5E44BD3C8544878F806E4DB8449B67 Ref B: FRAEDGE1818 Ref C: 2024-07-27T10:49:20Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
access-control-allow-origin: https://www.cybertriage.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYeOGFVtRX5bCAeQWZHQw==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 209ms
142ms Image
image/gif 2606:4700::6810:7674
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=de-de&bfp=321484724&v=1.1&a=23399343&ct=blog-post&rcu=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F&pu=https%3A%2F%2Fwww.cybertriage.com%2Fblog%2Fdfir-breakdown-using-certutil-to-download-attack-tools%2F%3Futm_content%3D301596729%26utm_medium%3Dsocial%26utm_source%3Dlinkedin%26hss_channel%3Dlcp-76565951&t=DFIR+Breakdown%3A+Using+Certutil+To+Download+Attack+Tools+-+Cyber+Triage&cts=1722077360187&vi=63be2da0181fda831443b23684a51bf5&nc=true&u=71429708.63be2da0181fda831443b23684a51bf5.1722077360184.1722077360184.1722077360184.1&b=71429708.1.1722077360184&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybertriage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 975cffe0-5722-4730-9936-ac5769f05c21
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 4
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 975cffe0-5722-4730-9936-ac5769f05c21
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WzDtQ%2BuYEaFyjxB1uYAnHMRzC0NG%2BPZfMVwlL%2FD6kUqsMj9ZGsvn309t8WYzl5K1jNQcNdR266wYjw%2BRn2SMYgqe4f2Dgq2X5Afvu4BiEhQn9GApRIlauoXmIXgMNO46fImZz%2BT9iUgXukBs0uiD"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-756b8c8b56-652hd
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8a9c0fedaef465d0-FRA
x-robots-tag: none

GET
H3 200 favicon.ico
www.cybertriage.com/favicons/ 15 KB
4 KB 29ms
28ms Other
image/x-icon 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybertriage.com/favicons/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d67341c3c6aa3f7d400d81b0a9e47d5fea18e89e2ac92187a3839da264e338c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.cybertriage.com/blog/dfir-breakdown-using-certutil-to-download-attack-tools/?utm_content=301596729&utm_medium=social&utm_source=linkedin&hss_channel=lcp-76565951
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 10:49:20 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 12 Jul 2024 13:23:39 GMT
server: cloudflare
age: 1254129
etag: W/"66912e5b-3aee"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8a9c0fed6d72916b-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cybertriage.com/	1970-01-21 00:30:53	Name: _gcl_au Value: 1.1.1476076546.1722077359
.cybertriage.com/	1970-01-21 07:57:17	Name: _ga_ZJXWCWJBTE Value: GS1.1.1722077359.1.0.1722077359.60.0.0
.cybertriage.com/	1970-01-21 07:57:17	Name: _ga Value: GA1.2.1526544773.1722077359
.cybertriage.com/	1970-01-20 22:22:43	Name: _gid Value: GA1.2.2054488467.1722077359
.cybertriage.com/	1970-01-20 22:21:17	Name: _dc_gtm_UA-215658-14 Value: 1
.hsforms.com/	1970-01-20 22:21:19	Name: __cf_bm Value: vlwm17TpzCjsoUvcgWvvJ1sQUGRxFR5bMeTaZvji_8U-1722077359-1.0.1.1-SXhX4KWbXFEBHJ7BcuRlVFi80SWgDbAtn5iJ6tOkcrnrbikIWWBLfjpx1d0t3COWcXKzjBfx0xMH7Tccx7ps2g
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: YSSoJJSLzZpq4z1WA.MO6h_UBn81eBgMViFVR9P.Ckk-1722077359589-0.0.1.1-604800000
.linkedin.com/	1970-01-21 07:06:53	Name: bcookie Value: "v=2&b0d16c44-a296-47c1-855b-bbfcfafae2c3"
.linkedin.com/	1970-01-21 02:40:29	Name: li_gc Value: MTswOzE3MjIwNzczNTk7MjswMjHwW3CV8ABxH2ZvIta6fldBHIMBeBpIGQPP2HQFDcK5rg==
.linkedin.com/	1970-01-20 22:22:43	Name: lidc Value: "b=OGST00:s=O:r=O:a=O:p=O:g=3389:u=1:x=1:i=1722077359:t=1722163759:v=2:sig=AQHXUiYZoOGBoF0r6IjVPjlZacSNYKp8"
.cybertriage.com/	1970-01-21 02:40:29	Name: __hstc Value: 71429708.63be2da0181fda831443b23684a51bf5.1722077360184.1722077360184.1722077360184.1
.cybertriage.com/	1970-01-21 02:40:29	Name: hubspotutk Value: 63be2da0181fda831443b23684a51bf5
.cybertriage.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.cybertriage.com/	1970-01-20 22:21:19	Name: __hssc Value: 71429708.1.1722077360184
.hubspot.com/	1970-01-20 22:21:19	Name: __cf_bm Value: DPk_tEuYoocO0EAnLQv_6M0SCCXshFgI1yzQ9olalk8-1722077360-1.0.1.1-Dp1RoIjYE7qyffDKI2dPGulPMUyFUNmBFN3R4BrZfWilcXAukJHkQSc_VrsM50iTe2KGYKo4oruw0qjLcNNKpg
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: AgJAw5uBbSiqAS2DiBYmEKXumTXHRI6MiqaKGAJPcD0-1722077360395-0.0.1.1-604800000

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
assets.basistech.com
cta-service-cms2.hubspot.com
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
hubs.li
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hubspot.com
perf-na1.hsforms.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
snap.licdn.com
static.addtoany.com
stats.g.doubleclick.net
track.hubspot.com
use.fontawesome.com
www.cybertriage.com
www.google-analytics.com
www.google.de
www.googletagmanager.com
13.107.42.14
141.193.213.10
2001:4860:4802:32::36
2606:4700:10::6816:46c5
2606:4700:10::6816:47c5
2606:4700:3037::ac43:8ef5
2606:4700:4400::6812:2041
2606:4700:4400::6812:22e5
2606:4700::6810:6ffe
2606:4700::6810:7574
2606:4700::6810:7674
2606:4700::6810:8bd1
2606:4700::6811:afc9
2606:4700::6811:df98
2606:4700::6812:f26c
2606:4700::6813:afbc
2620:1ec:21::14
2a00:1450:4001:810::2003
2a00:1450:4001:81c::2003
2a00:1450:4001:81c::2008
2a00:1450:4001:827::200e
2a00:1450:4001:831::200a
2a00:1450:400c:c00::9b
2a02:26f0:480:15::213:7e63
45.79.188.33
027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
383998e5815442cdc84c798b467f4bbb3faa5d802b73674e1fcf3aac30e6fefa
4014a53b54891ab7493caad36030cff934eeb51967a526020fb60ab07114ef6d
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4686f81d36236fc2c54854604ec5f12609d56d292c4e42ddf00fb18ddbc7a7c1
4b9d28da2ea82d0fe63d5476b2be7fbf8d3f6a3a9cfeae2dabb9273ee069bfe4
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
5542df8e54683fc16bb23e0d440443069d8ed326ff50bc8087de6d4c9e29bc28
58fb302f68f005fca51cd4743a031eab94c72ed0d616bf319d7d8ce6025c0604
5d67341c3c6aa3f7d400d81b0a9e47d5fea18e89e2ac92187a3839da264e338c
5d6ddcfeb4b5d1fa0b3bb7e992c53b79b9291f4e3938412d3c0bed29278f18f6
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c83d141e62216b5d071e70ca3a4d683ed137d20cfadebd57dd7a85aa672545a
6db83b2803fed3f9b574567755102b18c401904a374c8acf4c9a2e9b0159cb4f
6e493391385775f9eb300ef972c8cc6df934ba91bfe568cd4fd233cb0086ba76
743e85ed383df0246a4fbb524668cf1883a9f2247dd4f8866c95b05cf35ba31e
7a98f05a5c0d5018f28a663c81dbf4080a4cd3a34ef009a7c3e714319efeeb19
8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef
8ed40b4be7a49bbc6382f2b7439e6af9eb3a57b5575576d7c39f7085fbf2e3b2
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
9c8832e0fd81a244478bf9728715f61a1331b942558cc78cc1d34ee09bee81d8
a875e1d5f8cfe252cc8f5e04d750dd8c771fb8aceabd435d548425a445ab61d3
b383afe19e877f3053153bf0980e6b293abf6454f161470e7ecec0e918b8ae7d
b7e5d4895e4655fcc6f420fe087c7ccf124bc14dc9088590970cf0424ce9fb35
b9cdeb15b8242f0eb4ff22b8834ca732782965339edffed3d8eccd19bd0355fb
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c78fab07d4ee469def66170220968c4e790992e5adc971a34edc7eabc695e79f
c96789a38d469846ca2bd4ae33cc4c3383873aef458fb26a12100c003ccefa93
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cd55830d977b8fb0d175953c232082a8305e862df5ed865b9f67832546e795d1
d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382
d567f8fed3e76eaa26fd9d5a57e7c84fb8f7b645dc2360a9eff212cff89d375b
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dea7d93054c054d6908de184845b8db289207bb4928bbdd07d0ad8d52ec0708f
df8d168cd22bc91dcbec6d603ffb3efa6dc8433331f59af457258554f5389d91
df9cbb58ca11e14fc82bada8739aa943c22e8bebac66c54d9e1cbe4f970e9ce8
e1a6d646b3bc903442eb82c0d78be8c7b6cae71e05599d7dfa436d1902f93850
e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e81e4353262f5904d8503a1ffc7643fd1bef2a62da92b28b55dbb7dbba0e1d42
e85f4c2da0e2c184163258375056fd61e5e53c98450daa7355c0c7b415eb2b19
ec0f0f22d1883c8e341d6a4ca257b8edca8549afb73c22c11e61793a5fcd3e95
ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40
edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f06bf06915359224831501cef5d0c410b2dccf80d1b6082b776f6147e18ee524
f591c511b80091461cecd36d6f95808c46ca8d7fc2a9d1b73d089112c5be99f4

www.cybertriage.com Open in urlscan Pro 141.193.213.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

57 Requests

98 %HTTPS

88 %IPv6

22 Domains

26 Subdomains

25 IPs

3 Countries

980 kBTransfer

2299 kBSize

16 Cookies

19 Outgoing links

Page URL History

Redirected requests

57 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.cybertriage.com Open in urlscan Pro
141.193.213.10 Public Scan

Screenshot
Live screenshot

Full Image

57
Requests

98 %
HTTPS

88 %
IPv6

22
Domains

26
Subdomains

25
IPs

3
Countries

980 kB
Transfer

2299 kB
Size

16
Cookies

57 HTTP transactions
1 data transactions