urlscan.io logo urlscan.io
SecurityTrails logo

gridinsoft.com Open in urlscan Pro
172.67.74.78  Public Scan

Go To Rescan Add Verdict Report
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Submission: On November 07 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 2 countries across 14 domains to perform 72 HTTP transactions. The main IP is 172.67.74.78, located in United States and belongs to CLOUDFLARENET, US. The main domain is gridinsoft.com.
TLS certificate: Issued by WE1 on October 23rd 2024. Valid for: 3 months.
This is the only time gridinsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
48 172.67.74.78 13335 (CLOUDFLAR...)
2 172.67.142.245 13335 (CLOUDFLAR...)
1 192.0.73.2 2635 (AUTOMATTIC)
2 104.16.140.209 13335 (CLOUDFLAR...)
2 104.16.109.254 13335 (CLOUDFLAR...)
1 104.17.175.201 13335 (CLOUDFLAR...)
1 172.64.147.16 13335 (CLOUDFLAR...)
2 142.250.184.232 15169 (GOOGLE)
1 104.18.80.204 13335 (CLOUDFLAR...)
3 142.250.185.68 15169 (GOOGLE)
2 142.250.74.194 15169 (GOOGLE)
2 216.58.206.66 15169 (GOOGLE)
1 216.239.34.36 15169 (GOOGLE)
2 142.250.186.67 15169 (GOOGLE)
1 104.16.117.116 13335 (CLOUDFLAR...)
72 16
48    172.67.74.78 (United States)

ASN13335 (CLOUDFLARENET, US)
gridinsoft.com
2    172.67.142.245 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    192.0.73.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
secure.gravatar.com
2    104.16.140.209 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
js-na1.hs-scripts.com
2    104.16.109.254 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hscollectedforms.net
forms.hscollectedforms.net
1    104.17.175.201 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    172.64.147.16 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
2    142.250.184.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f8.1e100.net
www.googletagmanager.com
1    104.18.80.204 (None, )

ASN13335 (CLOUDFLARENET, US)
forms.hsforms.com
3    142.250.185.68 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f4.1e100.net
www.google.com
2    142.250.74.194 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net
googleads.g.doubleclick.net
2    216.58.206.66 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f2.1e100.net
td.doubleclick.net
1    216.239.34.36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
2    142.250.186.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f3.1e100.net
www.google.co.uk
1    104.16.117.116 (None, )

ASN13335 (CLOUDFLARENET, US)
track.hubspot.com
Apex Domain
Subdomains		 Transfer
48 gridinsoft.com
gridinsoft.com
1 MB
4 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 42
td.doubleclick.net — Cisco Umbrella Rank: 192
5 KB
3 google.com
www.google.com — Cisco Umbrella Rank: 3
128 B
2 google.co.uk
www.google.co.uk — Cisco Umbrella Rank: 5087
128 B
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
134 KB
2 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4567
forms.hscollectedforms.net — Cisco Umbrella Rank: 4719
25 KB
2 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2500
js-na1.hs-scripts.com — Cisco Umbrella Rank: 6488
2 KB
2 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1222
19 KB
1 hubspot.com
track.hubspot.com — Cisco Umbrella Rank: 2324
1 KB
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3643
1 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 4621
882 B
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2172
26 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2191
25 KB
1 gravatar.com
secure.gravatar.com — Cisco Umbrella Rank: 2302
28 KB
72 14
Domain Requested by
48 gridinsoft.com gridinsoft.com
3 www.google.com www.googletagmanager.com
gridinsoft.com
2 www.google.co.uk gridinsoft.com
2 td.doubleclick.net www.googletagmanager.com
2 googleads.g.doubleclick.net www.googletagmanager.com
2 www.googletagmanager.com gridinsoft.com
www.googletagmanager.com
2 use.fontawesome.com gridinsoft.com
1 track.hubspot.com
1 js-na1.hs-scripts.com js.hs-analytics.net
1 region1.google-analytics.com www.googletagmanager.com
1 forms.hsforms.com gridinsoft.com
1 forms.hscollectedforms.net js.hscollectedforms.net
1 js.hs-banner.com js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hscollectedforms.net js.hs-scripts.com
1 js.hs-scripts.com gridinsoft.com
1 secure.gravatar.com gridinsoft.com
72 17
Subject Issuer Validity Valid
gridinsoft.com
WE1		 2024-10-23 -
2025-01-21		 3 months crt.sh
use.fontawesome.com
WE1		 2024-09-09 -
2024-12-09		 3 months crt.sh
*.gravatar.com
Sectigo ECC Domain Validation Secure Server CA		 2023-12-05 -
2025-01-04		 a year crt.sh
hs-scripts.com
WE1		 2024-09-26 -
2024-12-25		 3 months crt.sh
hscollectedforms.net
WE1		 2024-09-22 -
2024-12-21		 3 months crt.sh
hs-analytics.net
WE1		 2024-10-07 -
2025-01-05		 3 months crt.sh
hs-banner.com
WE1		 2024-09-24 -
2024-12-23		 3 months crt.sh
*.google-analytics.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
hsforms.com
WE1		 2024-10-10 -
2025-01-08		 3 months crt.sh
*.google.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
*.g.doubleclick.net
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
*.doubleclick.net
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
*.google.co.uk
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
hubspot.com
WE1		 2024-10-03 -
2025-01-01		 3 months crt.sh

This page contains 4 frames:

Primary Page: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Frame ID: 7AD141A06E8685F9AD43970FD76BF9F2
Requests: 68 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/940364021?random=1730955635016&cv=11&fst=1730955635016&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config
Frame ID: 337AA432CF4AD06AA97EECF73172B44C
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/481455245?random=1730955635393&cv=11&fst=1730955635393&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config
Frame ID: B807CAC9FF5B949FFA516B8BEE4E2CC6
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fgridinsoft.com
Frame ID: AADE90F930F8B9D5CD54EC18137CF229
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Unmasking PUA:Win32/Presenoker: An Easy Guide on Removal

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • /flickity(?:\.pkgd)?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • swiper(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

72
Requests

99 %
HTTPS

0 %
IPv6

14
Domains

17
Subdomains

16
IPs

2
Countries

1509 kB
Transfer

3114 kB
Size

17
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

72 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
gridinsoft.com/blogs/pua-win32-presenoker-adware/ 		122 KB
30 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e2d949ca590a98824a903c83203d0ee33503bbbf0f6cc6048a511a0f6c19330

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=14400, must-revalidate
cf-apo-via
tcache
cf-cache-status
HIT
cf-edge-cache
cache,platform=wordpress
cf-ray
8deac29c6896beaa-LHR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 07 Nov 2024 05:00:32 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
last-modified
Tue, 05 Nov 2024 23:21:49 GMT
link
<https://gridinsoft.com/blogs/wp-json/>; rel="https://api.w.org/", <https://gridinsoft.com/blogs/wp-json/wp/v2/posts/21717>; rel="alternate"; title="JSON"; type="application/json", <https://gridinsoft.com/blogs/?p=21717>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B8H0tYE3f5%2BIWMm9kJbeTM0rxqtduiuoaUQWEWIFvyDjs7rqdLVoM3JVWu73OwZVT4Aca5SvsbN5cQU2a3EdEZ4i%2FoBJBh9y9nrFZ1uh0YR9ythF2pJjFYHz0pyHsajF"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=35168&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4289&recv_bytes=4555&delivery_rate=568&cwnd=12000&unsent_bytes=0&cid=264ea9ce905003df&ts=191&x=1" cfHdrFlush;dur=0
vary
Accept-Encoding
x-pingback
https://gridinsoft.com/blogs/xmlrpc.php
style.min.css
gridinsoft.com/blogs/wp-includes/css/dist/block-library/ 		110 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb3a89cc6347e098063bd15f285bc90411846ddce6f17812364feedab67a67f5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66e0e8cc-1b72b"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BL%2FTka%2FZ62mLjlTRNb5iEaM5FqQO8ODP0r3Pomo5o3Gz9U9O466Vebp%2BpSwqOqGakZh8NW8IJ07L9xRer0CQ4xsBXS5SkEmkeEnf4AN3ZF1%2BQ3bPBRzpWcSB943Y%2BjQh"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac29d5901beaa-LHR
expires
Thu, 07 Nov 2024 05:40:05 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=30281&sent=91&recv=50&lost=0&retrans=0&sent_bytes=42642&recv_bytes=7574&delivery_rate=437945&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=318&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Wed, 11 Sep 2024 00:48:12 GMT
vary
Accept-Encoding
server
cloudflare
style.css
gridinsoft.com/blogs/wp-content/plugins/foxiz-core/lib/foxiz-elements/public/ 		19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/foxiz-core/lib/foxiz-elements/public/style.css?ver=2.0
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef7778b5aadf91b551d9f45c543ccae4cde4b48ebdba3a5b6a2349cc2692e505

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97c4f-4df0"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Hb5rvsTroumbwGfYBNroxveUTbco2CYgskaUXB8DlBtQNPdY5Hdvhu6KptLyOj35OyAkiVyetmnKEg838%2BBxpTyFVYxSzZIcl3KS5ad1ebGGNABzwRkLY8OnRn99Prh"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac29d5902beaa-LHR
expires
Thu, 07 Nov 2024 05:40:05 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=30281&sent=85&recv=50&lost=0&retrans=0&sent_bytes=36966&recv_bytes=7574&delivery_rate=437945&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=316&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Sun, 29 Sep 2024 16:11:59 GMT
vary
Accept-Encoding
server
cloudflare
style.css
gridinsoft.com/blogs/wp-content/plugins/ultimate-blocks/src/extensions/ 		250 B
745 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/ultimate-blocks/src/extensions/style.css?ver=6.6.2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43844c1db1f6297fde35378913d63a1cd77d9385b5cc241dc6c1550c5679b82b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
HIT
etag
W/"66e0e8ef-fa"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nTGvo9Hw0L6Sqq7sA536QQDa%2FDhCLUoZVOATFBrmbXW61VJB74Is8KyesMhYIDsg1%2BBLsD5vn%2FTRNM%2F2F%2F71sAOA9lzVZbBznIGFtf23ti4OU7SnDTS3A4zi9IPLndC5"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac29d5903beaa-LHR
expires
Thu, 07 Nov 2024 05:40:05 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=30281&sent=105&recv=50&lost=0&retrans=0&sent_bytes=58464&recv_bytes=7574&delivery_rate=437945&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=321&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Wed, 11 Sep 2024 00:48:47 GMT
vary
Accept-Encoding
server
cloudflare
cookieblocker.min.css
gridinsoft.com/blogs/wp-content/plugins/complianz-gdpr/assets/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1717690686
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d5f949fcf84560d013b596b51856d6bc487bedc510bc712e82458f00b2506e5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"6661e13e-ade"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jnwMXGk7VidZglPAm7unzox9UUxpKhjdmnfRKPWto7VWWAqDi2XpMNmbaV%2Fvb%2F%2FAWf2O96l0fOelMrAMdBrUnqF4E8UpZPXXgWbo2%2BFbD8UV%2B0dSqqStqmoJymbHIT6M"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac29d5904beaa-LHR
expires
Thu, 07 Nov 2024 05:10:55 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=30281&sent=89&recv=50&lost=0&retrans=0&sent_bytes=41228&recv_bytes=7574&delivery_rate=437945&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=317&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Thu, 06 Jun 2024 16:18:06 GMT
vary
Accept-Encoding
server
cloudflare
all.css
use.fontawesome.com/releases/v5.15.4/css/ 		58 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.15.4/css/all.css
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.142.245 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/

Response headers

cache-control
max-age=31556926
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
etag
W/"ecd507b3125edc4d2a03aa6ae5d07da9"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VzdLfsIdpm%2Bhx6u4dBRmokYH016%2Fg3vsOgZYw6PtzHK3lhaRlkTWkS0feuTQt%2F8mHNHvX3m1RGHSGUPr5Mv%2BXFw7ZG3gj6sKsaihesOKq1isE3NVs%2FAMucs%2BnSQr2fllzcszF%2FTm"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a06ab84134-LHR
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=22868&sent=15&recv=21&lost=0&retrans=0&sent_bytes=9168&recv_bytes=2400&delivery_rate=392481&cwnd=246&unsent_bytes=0&cid=1de59e8c56ff63c0&ts=224&x=0"
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Fri, 22 Sep 2023 01:45:24 GMT
vary
Origin, Accept-Encoding
server
cloudflare
2a66a39a-e33b-4477-97c2-41a97b0a0bfd
https://gridinsoft.com/ Frame 		0
0
main.css
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/css/ 		441 KB
68 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/css/main.css?ver=2.4.3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09f3f68515a4c87754bae6c4bec6a3f3dd6291703358f9443c442d7d6fa39b40

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-6e427"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2swFS3OdM%2BqiWr1EiAEA86qTUSGRDgxBTg8orIW4yFLZPZpc9xvLR7LXsDeYS0wBwApNjdONH3nSuntt%2FqympDfpZUuI%2Fk%2BGkzviP2DH79pB15XdSFUMx7SUUZmxHcJw"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a0cb5fbeaa-LHR
expires
Thu, 07 Nov 2024 05:40:05 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25763&sent=121&recv=69&lost=0&retrans=0&sent_bytes=70347&recv_bytes=10958&delivery_rate=333040&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=874&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
print.css
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/css/print.css?ver=2.4.3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5378ba6682687aef28e3f03df3498970c456b8300bbd37f0395b4bcc8e05f10a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-69b"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RpMai2%2B5HAup%2BB0VTuFJjqEo6lciIlIvq63eDerVTfTPsxqFpAnFoRMxh4Zk%2BB8tb4DYCX2ZCC88qrzRTKrlnIzwGPdOT1rFokBHrobR6chDB9AcBRXVqT5VKtzXF78F"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a0cb60beaa-LHR
expires
Thu, 07 Nov 2024 05:40:05 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25763&sent=131&recv=69&lost=0&retrans=0&sent_bytes=82127&recv_bytes=10958&delivery_rate=333040&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=875&x=1", cfHdrFlush;dur=18
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
style.css
gridinsoft.com/blogs/wp-content/themes/foxiz-child/ 		612 B
955 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz-child/style.css?ver=2.4.3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26380ced18d21b382c7b30ca2bb4a755819b6543e4943944fd2d10658a2a7059

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
HIT
etag
W/"66f97b8b-264"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=190AWrqLPNzHtjcA5Zt0%2BS52jqAw06joRFPVmq2Wns6sb0uG61v7SrV3V5o8%2FZH5obVlzw4nSLTQ9Nw0zsW9p%2FZAtmTxYu1DHgmZ%2FJBUufJvOXCpgJKUzH%2F7zU0SJCCt"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a0cb61beaa-LHR
expires
Thu, 07 Nov 2024 05:40:05 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25763&sent=118&recv=69&lost=0&retrans=0&sent_bytes=68022&recv_bytes=10958&delivery_rate=333040&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=870&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Sun, 29 Sep 2024 16:08:43 GMT
vary
Accept-Encoding
server
cloudflare
v4-shims.css
use.fontawesome.com/releases/v5.15.4/css/ 		26 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.15.4/css/v4-shims.css
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.142.245 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8fe2f1cb7bc41c640ad3ea24449cfa1ba5291e16dbbbab0ef61bfe43f3212910

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"a034d3c71bee546f625877d7932917f8"
age
1316988
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WyEH%2Bw5TCR5FAA2ZfkUrRfhvUAdjb7KNYWfI6y12TN67XPbgKuDT4Jwqn1M5f2GHbjHex3qHQL5M0FvtaymfdA9Q5y%2FV4h%2Fw52OxSyFubleMDqRr5abzeCXtXSInxrUuZRPLwFEt"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=22360&sent=8&recv=14&lost=0&retrans=0&sent_bytes=4026&recv_bytes=2400&delivery_rate=176754&cwnd=243&unsent_bytes=0&cid=1de59e8c56ff63c0&ts=196&x=0"
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Fri, 22 Sep 2023 01:45:24 GMT
vary
Origin, Accept-Encoding
cache-control
max-age=31556926
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a0caf64134-LHR
access-control-allow-origin
*
server
cloudflare
jquery.min.js
gridinsoft.com/blogs/wp-includes/js/jquery/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
REVALIDATED
etag
W/"654d4632-15601"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FCx7%2B%2F%2F9LKQAgcuV%2BkVuMhkZBI1tzo12J1DqZghfPVl4pnZbrvjcrWehX8SGcNmQ%2FX7cExfthU6OToPug%2FiZJB14K61FEN3llPahzyuvV5egqeVC7Kx1xLjTxi%2BbL4Ua"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a0cb62beaa-LHR
expires
Thu, 07 Nov 2024 06:00:32 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=24930&sent=199&recv=81&lost=0&retrans=0&sent_bytes=157193&recv_bytes=12130&delivery_rate=311676&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1038&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Thu, 09 Nov 2023 20:50:58 GMT
vary
Accept-Encoding
server
cloudflare
jquery-migrate.min.js
gridinsoft.com/blogs/wp-includes/js/jquery/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"64d2a8c1-3509"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NOfty8bgttnivjRxUsoKlEC%2BZ7cDx%2F3S25%2BsI6HPGjMb69FHfquQoEb1srKzf80R0bfYIu6yXpVe%2BShDmusDy73wrZSVuYeS%2Bz0s4N6bXub7NKF6gR8fX%2FDhZttmFtFu"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a0cb63beaa-LHR
expires
Thu, 07 Nov 2024 05:05:35 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25763&sent=113&recv=69&lost=0&retrans=0&sent_bytes=62358&recv_bytes=10958&delivery_rate=333040&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=870&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 08 Aug 2023 20:42:41 GMT
vary
Accept-Encoding
server
cloudflare
highlight-share.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/highlight-share.js?ver=1
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73e41fb76ddcd5f047288e2fc664c19387db2fb6c01da9315fde404c53c3de18

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-1c4d"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JJ0YC0%2FNb%2FFISRxX9X1kEKq07e4WQI4a3RyY5kpV1y%2Fp6YbYEiGh6LQEc9txAxhVI0icQO8nTDKfXqZsltIwWPM%2BX5Ym9DY40wcoS3sUoHM7%2FHtRf0nYU0kF7MVGIBX%2B"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a0db65beaa-LHR
expires
Thu, 07 Nov 2024 05:40:05 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25763&sent=110&recv=69&lost=0&retrans=0&sent_bytes=59327&recv_bytes=10958&delivery_rate=333040&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=869&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
/
gridinsoft.com/blogs/ 		136 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/?local_ga_js=0644836af4791c2ec2a326743f50420b
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6667eb92d07331b9ce3ccb1936273a82484bf2a81e5b43101ad3f50716a71c47

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-edge-cache
cache,platform=wordpress
content-encoding
gzip
cf-cache-status
BYPASS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XarAREPf8SHQxHC0FiKF8MIbfRfYXonQYkiYHNWhlk%2FxOBwtcRKM848xcXVplYY65bMnRWF1yR%2FjmMrfHb2Wz7Txb%2B8uquygk3jzTFbfWL6geN1QHKlVLg4CcmDEUYl7"}],"group":"cf-nel","max_age":604800}
expires
Thu, 19 Nov 1981 08:52:00 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=27260&sent=944&recv=195&lost=0&retrans=0&sent_bytes=1007987&recv_bytes=27848&delivery_rate=1931877&cwnd=119100&unsent_bytes=0&cid=264ea9ce905003df&ts=2072&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:34 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=604800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
cf-ray
8deac2a2dca2beaa-LHR
cf-apo-via
origin,qs
server
cloudflare
gridinsoft-blog.webp
gridinsoft.com/blogs/wp-content/uploads/2022/07/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2022/07/gridinsoft-blog.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f9cbef012abc87034a912f5750d3f1642acced4622bfe151ecffdda271bd0f1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"62c2045e-1390"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3TWZknQRmjTbqGBx%2FmL4b9BSdpnACyuZCV%2B7bX5RsXQitPlM0xGNwrbWKD22%2F1FmTB7EdbTWSMhhlMCb%2Ftvyk8eBxr%2FUNhvQb0z3DAFKw1duhhyE5lbECEMreUmC%2BIn"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:32 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25763&sent=131&recv=69&lost=0&retrans=0&sent_bytes=82127&recv_bytes=10958&delivery_rate=333040&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=888&x=1", cfHdrFlush;dur=5
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
image/webp
last-modified
Sun, 03 Jul 2022 21:04:30 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a0db66beaa-LHR
accept-ranges
bytes
content-length
5008
server
cloudflare
3fee76701d729ba7480d648eb2f847b4
secure.gravatar.com/avatar/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/3fee76701d729ba7480d648eb2f847b4?s=120&d=mm&r=g
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
863fccb66d39342008922e0d59c7154032fbff5e4026eaac35b001b260fddb31

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

link
<https://gravatar.com/avatar/3fee76701d729ba7480d648eb2f847b4?s=120&d=mm&r=g>; rel="canonical"
cache-control
max-age=300
x-nc
HIT lhr 4
expires
Thu, 07 Nov 2024 05:05:33 GMT
accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
28144
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/png
last-modified
Fri, 26 Nov 2021 13:23:31 GMT
server
nginx
content-disposition
inline; filename="3fee76701d729ba7480d648eb2f847b4.png"
GS_Blog_banner_What-is-PUA_Win32_Presenoker.webp
gridinsoft.com/blogs/wp-content/uploads/2024/04/ 		42 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/04/GS_Blog_banner_What-is-PUA_Win32_Presenoker.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4cf4fb08e2a7fc369b9054488bda138738961132f2febc12fd3df5841b212eed

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"662bbc5b-a860"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pDy08qiq2QHSXNvTCEIqzIYL%2FYEyljZ7ydPWz%2FErMz9WbFi1GNBb78gFiufnnWIXausEt6a04KxrBlg3VKWoWfS7wZkPzvhC8o6pQxmyyo5iu4TlxJrye3zpwDV2kdCD"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=27043&sent=445&recv=131&lost=0&retrans=0&sent_bytes=428507&recv_bytes=22828&delivery_rate=530141&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1369&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Fri, 26 Apr 2024 14:38:19 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a2dca3beaa-LHR
accept-ranges
bytes
content-length
43104
server
cloudflare
Presenoker-detection.webp
gridinsoft.com/blogs/wp-content/uploads/2024/04/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/04/Presenoker-detection.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9d9673c75cce5980cee75d53a6830052103e21da11e72dc0edd9ffd76698303

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"662bb4b9-3ec0"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9iGskh6gmJEYul%2FpHAL8VRFrXIAdw4uE6L6c7ik%2FxwWqv42XG7dQjyPnPoc5qi%2B%2FBLdevbbsiwtN5C3mvnrIbiqAHR8ZmafuSBImfPd%2BjskTkIVMcqT7goilLTyntanb"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26297&sent=430&recv=130&lost=0&retrans=0&sent_bytes=411390&recv_bytes=22783&delivery_rate=441784&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1365&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Fri, 26 Apr 2024 14:05:45 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a2dca4beaa-LHR
accept-ranges
bytes
content-length
16064
server
cloudflare
ad1.webp
gridinsoft.com/blogs/wp-content/uploads/2024/04/ 		298 KB
299 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/04/ad1.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f03a743ac7613686746954c5dba75bb1d124d6b7bcc06b8e23fa5c7ac5d01b09

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"662bb80c-4a85c"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9dPr2g6FzYPEqfYpGLUqArKucxF%2F8YW%2FmeGeMqmwBXZYNE4ZaxsvErJQiWHEPgaRidj%2BXTaIhW2SZasH1dMleGThnJUdoWSUqci8d1vCXHByHEKKnsRaUeDMfhJcdwoJ"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26588&sent=471&recv=132&lost=0&retrans=0&sent_bytes=458988&recv_bytes=22873&delivery_rate=928373&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1378&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Fri, 26 Apr 2024 14:19:56 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a2dca5beaa-LHR
accept-ranges
bytes
content-length
305244
server
cloudflare
flickity.css
gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/vendor/flickity/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/vendor/flickity/flickity.css?ver=2.2.1
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20a22e2a0610fa88287f0f8a033e1f8c5fb3abb7f0a0d527115b6ce3dde328a1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66e0e8ea-705"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZQlQqsmsKeEoPLMQT3w6bS%2FF7ypAL0jc2HvG7YoBDNl0LFGhvflBqZETx%2Bgbk5E2tYoJRMYgq7m8JX0PCN%2B%2F53G4UZCyW3AVUjnZrKf%2FkSw1XionI03xKan%2FEoQw2N7L"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a0db67beaa-LHR
expires
Thu, 07 Nov 2024 05:46:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25763&sent=119&recv=69&lost=0&retrans=0&sent_bytes=69000&recv_bytes=10958&delivery_rate=333040&cwnd=22800&unsent_bytes=0&cid=264ea9ce905003df&ts=871&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Wed, 11 Sep 2024 00:48:42 GMT
vary
Accept-Encoding
server
cloudflare
shortcodes.css
gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/includes/css/ 		44 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/includes/css/shortcodes.css?ver=7.2.2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76bbb197dd7895884e9e80018bf5ea5b01ba896b3527be7de3447341e2a3e276

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66e0e8ea-b0bf"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3YWWcRpN0sVP1EmWL8ecDGevRnlPCoU15FKxl3EzXUb94GgMk8kMcZo5%2FsOFtdnsm1KEfUcCvtRhOy%2F04ChwGYGmtIf99%2F1h3KIwDsJUp%2FCSw%2Fzi7k7hNjDbU0NDHKnx"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a19bc9beaa-LHR
expires
Thu, 07 Nov 2024 05:34:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25294&sent=190&recv=79&lost=0&retrans=0&sent_bytes=148566&recv_bytes=11738&delivery_rate=1248139&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=993&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:32 GMT
content-type
text/css
last-modified
Wed, 11 Sep 2024 00:48:42 GMT
vary
Accept-Encoding
server
cloudflare
core.js
gridinsoft.com/blogs/wp-content/plugins/foxiz-core/assets/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/foxiz-core/assets/core.js?ver=2.4.3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7de32d703bdc40c65a949e883bed0245e592c5189746f94ef2884938c478401c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97c4f-338d"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BaDoIoW302W%2BIm3DqjWJa1OmMUn%2F%2BjAtcFLxo76y3zlrQXYAw1pYnPxRta%2Bq5x5QBWNOY13mkeQrqj3F%2FrkB9Vk7IffcEIIbhxpR19twDz92w2ef%2FP4o9v8R2DTtqPMI"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a25c62beaa-LHR
expires
Thu, 07 Nov 2024 05:40:06 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25377&sent=228&recv=100&lost=0&retrans=0&sent_bytes=189021&recv_bytes=17954&delivery_rate=770173&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1115&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:11:59 GMT
vary
Accept-Encoding
server
cloudflare
47550839.js
js.hs-scripts.com/ 		2 KB
984 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/47550839.js?integration=WordPress&ver=11.1.60
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.140.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7019bfa08ad610155d7b360d00e7ad3a01fd78ffcfc8b0c6640eeb3e673722e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

access-control-max-age
3600
content-encoding
gzip
cf-cache-status
EXPIRED
x-content-type-options
nosniff
expires
Thu, 07 Nov 2024 05:02:03 GMT
date
Thu, 07 Nov 2024 05:00:33 GMT
x-hubspot-correlation-id
33edae52-ae28-47ea-b0a9-b007b487cecd
content-type
application/javascript;charset=utf-8
vary
origin, Accept-Encoding
last-modified
Thu, 07 Nov 2024 05:00:33 GMT
cache-control
public, max-age=90
access-control-allow-credentials
true
cf-ray
8deac2a53e35951b-LHR
accept-ranges
bytes
access-control-allow-origin
https://gridinsoft.com
content-length
614
server
cloudflare
comment-reply.min.js
gridinsoft.com/blogs/wp-includes/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-includes/js/comment-reply.min.js?ver=6.6.2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"628fbf1a-ba5"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b7%2Fi1cGBJ1Cmy65e%2B%2Bkxs71WENla8qdOfT5vhzDxVaoFNMuMmLsXzhSj8%2BJjr4KwIFHVTjAUPUc9EGrzBnHyQQI%2BzozDujEo14OC3SN0SpHh%2BldM7PWB052zJAQyG4QN"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dca6beaa-LHR
expires
Thu, 07 Nov 2024 05:40:06 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25279&sent=285&recv=101&lost=0&retrans=0&sent_bytes=253629&recv_bytes=17999&delivery_rate=85404&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1198&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Thu, 26 May 2022 17:55:38 GMT
vary
Accept-Encoding
server
cloudflare
jquery.waypoints.min.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/jquery.waypoints.min.js?ver=3.1.1
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c86e183995d42d069cdf501e7605562c081cd7aac3b779abe3f69af717d4dd47

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-234a"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZQggUS2t5RUNaUiyshDI0jr%2B7ejraRpSdeNNqHMZTjIZBrMLd3EDgqCFmDO7ANd0gszuZxLcImI8Xm2zZTMsuA6C8oesRBLF2dF8MLnugNXovc7o%2Bpd1MFG%2Bqg7JA0Hi"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2cc96beaa-LHR
expires
Thu, 07 Nov 2024 05:40:06 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26175&sent=415&recv=129&lost=0&retrans=0&sent_bytes=394138&recv_bytes=22738&delivery_rate=2437440&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1345&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
rbswiper.min.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		139 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/rbswiper.min.js?ver=6.5.8
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29c7c4c555a024a5b74091431e8447c686bbbf6fde257c8f3b552deb70c68359

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-22b44"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kZq4KUVx%2FAh9UI57WLFfQmgW7GRZtgR5p8xHHHLn0D%2F3oWEQXUVlltxUxbLCGmZfoMgIP6WU%2Ft1Ave%2BMUbTykR2DDuR6XulHGFXF2cSY3Z1%2Bn3Icwdj2Iy%2BJ2BqdUGsn"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dc99beaa-LHR
expires
Thu, 07 Nov 2024 05:11:41 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25279&sent=248&recv=101&lost=0&retrans=0&sent_bytes=210399&recv_bytes=17999&delivery_rate=85404&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1195&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
jquery.mp.min.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/jquery.mp.min.js?ver=1.1.0
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb276e01752e73eb55790096a2f3808d914998ed519db70bc86d3064910a2e81

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-4e98"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zoT0V97ktGBl2WmAbjM1QjAfaNaAwbPIpkeDGCgMnRzF%2FT1LA2C0xwdOURlvsU4Hkv0%2BWernxEzVRq9jLGkK7Kn64bJwdJS9BO2BYjSmtm0EaPWbo0O1JZNMbgIuoNcs"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dc9abeaa-LHR
expires
Thu, 07 Nov 2024 05:40:06 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25279&sent=232&recv=101&lost=0&retrans=0&sent_bytes=193109&recv_bytes=17999&delivery_rate=85404&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1191&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
jquery.tipsy.min.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/jquery.tipsy.min.js?ver=1.0
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
627bd02138c41bcada2624bce3ad21bfe1b42e79dd90c8d6e8b386c613a1708a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
REVALIDATED
etag
W/"66f97b1f-10d5"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ysM9WUEzrU5CZzooJ3PMdCM%2FQas7PMdlBygqd18L0lbwRfpuDg0eDuTb8rA5T4UUc%2FF02WRcfCdT9V1rGU21i6K5TsE4mY6f3nSgwiAuLHkgSiZWKe12mGbXdbxmQ0Wf"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dc9cbeaa-LHR
expires
Thu, 07 Nov 2024 06:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26175&sent=428&recv=129&lost=0&retrans=0&sent_bytes=409114&recv_bytes=22738&delivery_rate=2437440&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1359&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
jquery.ui.totop.min.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		611 B
1016 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/jquery.ui.totop.min.js?ver=v1.2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb354f051082f4f09c92850f594a4685858da56fbddffcb6f48796babab4033a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
HIT
etag
W/"66f97b1f-263"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OkY%2BDDlGDWOPZbJ0HT4bOTRLhy4rT2V58uxrpORFkhIrBfNaToCKihyPvguO7cQkNV%2BLroG3%2Fmva4EpVTEL0wDG5rhyi6N6n63TIF6RH7%2B8ZejEY0DUdKxLVAxx6iil0"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dc9dbeaa-LHR
expires
Thu, 07 Nov 2024 05:11:41 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26175&sent=414&recv=129&lost=0&retrans=0&sent_bytes=393098&recv_bytes=22738&delivery_rate=2437440&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1344&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
personalized.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		21 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/personalized.js?ver=2.4.3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3469e72d4d4320f058038c9ffa6d509b2fdf44ae5fe123890ffd9584197cabdc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-55c6"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3gil8THN62qabX4CS6KTxc3%2Fs8G2L55snTtPvICp%2FoQEKLdeIA88TAlBAPb%2F%2BjB6pgNfxvlM0Jy4cWw5vxQ4czig%2F6vvv3qv%2BGXpYkglfCMCdGBTFlv8XZD%2BDPnO%2BtPu"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dc9ebeaa-LHR
expires
Thu, 07 Nov 2024 05:11:41 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25279&sent=281&recv=101&lost=0&retrans=0&sent_bytes=249893&recv_bytes=17999&delivery_rate=85404&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1196&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
global.js
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/ 		112 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/js/global.js?ver=2.4.3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3adf99ee0cf77a199223ea0bc8c2ad0a409e772f67b74edab35db191cb539a1c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97b1f-1c1f2"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r84ARVS53SfesIk7BXS9jC480LbN9MLwBvsvcg41J4wKLxUrB7QL%2Bng14q4mfqiS9JUOBgxXcoa0sU8SitH2LzI3r%2Bl1Za71I3I%2BE%2BDlI8FomCYnviUGeQFdqRMFVOBB"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dc9fbeaa-LHR
expires
Thu, 07 Nov 2024 05:40:06 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26175&sent=397&recv=129&lost=0&retrans=0&sent_bytes=373624&recv_bytes=22738&delivery_rate=2437440&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1335&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
server
cloudflare
complianz.min.js
gridinsoft.com/blogs/wp-content/plugins/complianz-gdpr/cookiebanner/js/ 		39 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1717690686
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e48afa0ca2fdaed77ef3d14202f805ab16829b42e321b71635d538f9e9efa4e2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
public, max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"6661e13e-9dee"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T1Koro9Ww2fBM3byKrHa5r3Ho7G2gy%2BYPHKim06UkistK5axjxnUjTENGDBBmH72dGyz1bSCYlpnfML%2FVG8zNFNRjKoZtvDW3wuDwCop2FUR%2BSoQnJP8n44QzIaxJgEs"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dca8beaa-LHR
expires
Thu, 07 Nov 2024 05:20:17 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26175&sent=418&recv=129&lost=0&retrans=0&sent_bytes=397641&recv_bytes=22738&delivery_rate=2437440&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1349&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Thu, 06 Jun 2024 16:18:06 GMT
vary
Accept-Encoding
server
cloudflare
akismet-frontend.js
gridinsoft.com/blogs/wp-content/plugins/akismet/_inc/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1721240342
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bc5622bfab1a16855ad49b99a3f9ed8eb24f49da469a113f9000b866f109e2e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
public, max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66980b16-2c7c"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=19hoJ0cCCPrkzFzBHy3NxzlMdXMwG43VwRZyctmxW6UQxKo6D2wHFBoQa%2FCaSjNPiPOK2AhWPc0%2F3Yt2f0fsM7Bw4Qh7%2BKwD8CcEFdVt8wG%2B5nRNiNqY6gqbx01aDKjy"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dcaabeaa-LHR
expires
Thu, 07 Nov 2024 05:05:37 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25279&sent=244&recv=101&lost=0&retrans=0&sent_bytes=206330&recv_bytes=17999&delivery_rate=85404&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1194&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Wed, 17 Jul 2024 18:19:02 GMT
vary
Accept-Encoding
server
cloudflare
flickity.js
gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/vendor/flickity/ 		53 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/vendor/flickity/flickity.js?ver=2.2.1
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcc6aaeccd530bcb0e91ef01e2046485f1ad113a865aafb17a740eee4da61e32

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66e0e8ea-d32f"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9WYRXaS7VHAllTT9D567agn5sLgsKGuDueCd0Ha89NifzS57lYxl1jB9SHOnnGXvCwPZBs9icfdJSTtvuMtZyzFR5Q1snKjPFtRROKLdQEF37AeCZ8U3z4P7YAY7Gxkp"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dca0beaa-LHR
expires
Thu, 07 Nov 2024 05:46:34 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25279&sent=287&recv=101&lost=0&retrans=0&sent_bytes=255703&recv_bytes=17999&delivery_rate=85404&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1201&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Wed, 11 Sep 2024 00:48:42 GMT
vary
Accept-Encoding
server
cloudflare
index.js
gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/includes/js/shortcodes/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/includes/js/shortcodes/index.js?ver=7.2.2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
165b215ce8cdca7f7596f3a6fd43414352fa68142d63c9f4d234a4bb46f71de6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66e0e8ea-3b8f"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JXBapgO9GZ3AutUp3KvJJAPfltUZOLljbPQlw1sbED%2B0h6DwHDEnCgms%2FkpLkDy%2FDg%2F38RGcBOAs0Xxra%2BTDsuE1xv6Ydlwsk6FQP8KYVyANgTTvCI1JDmEtEAcjgQCi"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a2dca1beaa-LHR
expires
Thu, 07 Nov 2024 05:15:40 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25279&sent=239&recv=101&lost=0&retrans=0&sent_bytes=201231&recv_bytes=17999&delivery_rate=85404&cwnd=72300&unsent_bytes=0&cid=264ea9ce905003df&ts=1193&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Wed, 11 Sep 2024 00:48:42 GMT
vary
Accept-Encoding
server
cloudflare
2sDfZG1Wl4LcnbuKjk0m.woff2
gridinsoft.com/fonts.gstatic.com/s/oxygen/v15/ 		16 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKjk0m.woff2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e64f128d5352d04ea5c87031e4cf1ad204b72a0afb003ece52eeb997d28a570

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
HIT
age
178139
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UhSYEnA6m8FU6O3ssUw5azXuA5Dwij2cAfnFlXLmkaGomvd%2BUmRNaI0y9lb2OecKFP5V8P1zdZ%2BnQ6mSNmhR%2FQE3ZBMu3pheaTKsiQU0lAA6dEeumssyLj%2FSgdDc3kfL"}],"group":"cf-nel","max_age":604800}
expires
Thu, 30 Oct 2025 12:55:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25359&sent=322&recv=119&lost=0&retrans=0&sent_bytes=287701&recv_bytes=22293&delivery_rate=1503959&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1301&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
font/woff2
last-modified
Mon, 09 May 2022 18:31:32 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fde5beaa-LHR
accept-ranges
bytes
content-length
16348
cf-apo-via
proxy
server
cloudflare
2sDcZG1Wl4LcnbuCNWgzaGW5.woff2
gridinsoft.com/fonts.gstatic.com/s/oxygen/v15/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/fonts.gstatic.com/s/oxygen/v15/2sDcZG1Wl4LcnbuCNWgzaGW5.woff2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5740bce57f68562d42e8ca6f6eb70dca3bc33be11ef0361e78274d360f41adc9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
HIT
age
178139
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uGiBMDe%2Fo6rdADZqbThnFQRvoQzJF7eOGMr1sZThIJ6bYSEesO6WvcFDO8bPL65dG3YcDCeaacAJJF%2BRnQLCG2pVi15J0ic5IT4%2BoaKsz0ReAMGee1WHF95QY6xwM4Tw"}],"group":"cf-nel","max_age":604800}
expires
Sun, 02 Nov 2025 11:36:57 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25359&sent=307&recv=119&lost=0&retrans=0&sent_bytes=270502&recv_bytes=22293&delivery_rate=1503959&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1300&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
font/woff2
last-modified
Mon, 09 May 2022 18:30:51 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fde6beaa-LHR
accept-ranges
bytes
content-length
16172
cf-apo-via
proxy
server
cloudflare
j8_46_LD37rqfuwxyIuaZhE6cRXOLtm2gfT-PYqZAC4I.woff2
gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/ 		21 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/j8_46_LD37rqfuwxyIuaZhE6cRXOLtm2gfT-PYqZAC4I.woff2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d52f1f1c0e3e9e237c7604afefa8d784064f688c76293e3f1102dab32a830925

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
HIT
age
178139
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kjn03kaxvMRCp%2ByzjW0LS9KhRIvAeLwoQWaqHCoS0q1TllzFQxiolPJa%2FcxN0c7dE8I6LutfBIzKmTsk03oUdBpFuv2gLDjbmr5yxtlkpSQIAjyjGUqZb6jkfXO4W7Hi"}],"group":"cf-nel","max_age":604800}
expires
Sun, 02 Nov 2025 11:54:53 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25359&sent=337&recv=119&lost=0&retrans=0&sent_bytes=305075&recv_bytes=22293&delivery_rate=1503959&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1301&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
font/woff2
last-modified
Thu, 21 Apr 2022 16:59:31 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fde7beaa-LHR
accept-ranges
bytes
content-length
21624
cf-apo-via
proxy
server
cloudflare
j8_46_LD37rqfuwxyIuaZhE6cRXOLtm2gfT-WYuZAC4I.woff2
gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/ 		21 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/j8_46_LD37rqfuwxyIuaZhE6cRXOLtm2gfT-WYuZAC4I.woff2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed81d5248fa368649beafa2654a6dcf3b0fbb083cc1c2dfb18e5aad1d94510e9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
HIT
age
60655
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fkt6grYwosWHGtm6ixjGKPZ3wofRApLc0fE4vZuT%2B0doF0CpJyTPoSfRyHncRtE6LWZpAnpQgYT9CLSyqk9NWy7mb3Oq%2BA1kqdEPjcN%2FXKoLq4CH1359RqQyZ0c8BUrj"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25359&sent=377&recv=119&lost=0&retrans=0&sent_bytes=350587&recv_bytes=22293&delivery_rate=1503959&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1304&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
font/woff2
last-modified
Thu, 21 Apr 2022 16:47:04 GMT
vary
Accept-Encoding
cache-control
public, max-age=2592000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fde9beaa-LHR
accept-ranges
bytes
content-length
21884
cf-apo-via
proxy
server
cloudflare
icons.woff2
gridinsoft.com/blogs/wp-content/themes/foxiz/assets/fonts/ 		23 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/fonts/icons.woff2?ver=2.4.3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/css/main.css?ver=2.4.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676ffbd4f026753a64c42d788f13923a771e7509f58361a4b98f87fa5cd4a03e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/blogs/wp-content/themes/foxiz/assets/css/main.css?ver=2.4.3

Response headers

cf-cache-status
HIT
etag
"66f97b1f-5da4"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SgVG8Bp2JZoys46JyWolQyzcqi5ms9SFzcYzsKvSAL7hn6K14ycOTinTtx%2BC1lDoiECq4qR0fPth9TVDhXtkMfTyym%2BrhIiwEYj0QBQSxx2HeCHhFWxkYjaw1Fhtyosp"}],"group":"cf-nel","max_age":604800}
expires
Thu, 07 Nov 2024 05:45:04 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26793&sent=624&recv=152&lost=0&retrans=0&sent_bytes=637174&recv_bytes=23781&delivery_rate=1599379&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1523&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
font/woff2
last-modified
Sun, 29 Sep 2024 16:06:55 GMT
vary
Accept-Encoding
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fdecbeaa-LHR
accept-ranges
bytes
content-length
23972
server
cloudflare
j8_16_LD37rqfuwxyIuaZhE6cRXOLtm2gfT2hq-M.woff2
gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/ 		21 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/j8_16_LD37rqfuwxyIuaZhE6cRXOLtm2gfT2hq-M.woff2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
140ee2462b736e743b7f9b2dd82f41ecfa63f17a818739fec426067500edb49c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
HIT
age
178139
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ju2HJh9zn2wulfIqnGxv3vuHwqq3LULaGg7czJCD7kpDiu%2FHrqU9tbDZnIB2g2oDtnyC0ONLjin%2Fy%2FB%2BM7ln5GHweeDwsK2w%2FDbEWxo1nMgdEHsOgEloEyHeTQ2EmObh"}],"group":"cf-nel","max_age":604800}
expires
Sun, 02 Nov 2025 11:35:42 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25359&sent=357&recv=119&lost=0&retrans=0&sent_bytes=327861&recv_bytes=22293&delivery_rate=1503959&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1302&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
font/woff2
last-modified
Thu, 21 Apr 2022 16:46:59 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fdedbeaa-LHR
accept-ranges
bytes
content-length
21560
cf-apo-via
proxy
server
cloudflare
QR-Code-Phishing-150x150.webp
gridinsoft.com/blogs/wp-content/uploads/2024/11/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/11/QR-Code-Phishing-150x150.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
533fee6130d42e8ab405c40ae8f71db9503d12903a5c21ae2d32ef50a5b2f5ff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"672a09d5-27ce"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YRY%2FZOPUPVszBN487NjCNdwEZocoboS%2BykRJhQ9QnNd3Pen0ilF2qKPK5C0aW%2FRoIyzDhb2G3mQmbbBI6rzNpAu2ttxPqBAUK%2BRilb4nvkbpVm2Y9I9tz9rBfRG3GhfN"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26588&sent=497&recv=132&lost=0&retrans=0&sent_bytes=489475&recv_bytes=22873&delivery_rate=928373&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1381&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Tue, 05 Nov 2024 12:04:37 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3edd8beaa-LHR
accept-ranges
bytes
content-length
10190
server
cloudflare
nokia-hacked-featured-150x150.webp
gridinsoft.com/blogs/wp-content/uploads/2024/11/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/11/nokia-hacked-featured-150x150.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65d264c9b08a92980556fbeda052afc3fd95293593da15807d78e87b7816721a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"67290580-d66"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NWUpeeVMUeQHPBjtk01Dlbs7wSJpqnRO0fttYXJXdsUKLnX9Y3cXWzQlBfqjOEHoueBKqnLSnslvy2IkLGH%2BNBW0xsZ4LKBiofXphjei5YFdeFCvnnW%2Fd02PHmo6VhPA"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26793&sent=620&recv=152&lost=0&retrans=0&sent_bytes=632971&recv_bytes=23781&delivery_rate=1599379&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1519&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Mon, 04 Nov 2024 17:33:52 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3eddabeaa-LHR
accept-ranges
bytes
content-length
3430
server
cloudflare
Threat-actors-use-copyright-infringement-phishing-lure-to-deploy-infostealers-150x150.webp
gridinsoft.com/blogs/wp-content/uploads/2024/11/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/11/Threat-actors-use-copyright-infringement-phishing-lure-to-deploy-infostealers-150x150.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d96ff60e71c4b640bd0b174825692eb2c0ca732c9931e34ac0929e70e500d2d9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"6724f541-1a8a"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ioaWhFmb%2BK2Dz%2FnSBHImixthL7d5J%2FPVgyPEHAbBpikLnwZpzsf2cdKZCBqEIIGQrJnoBSEVYGLMW8Bk7YHJqQJvhReYlXo8XbNlNj7dEX1uBKgUxdVJtKwQRcP27fhV"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26470&sent=507&recv=133&lost=0&retrans=0&sent_bytes=500592&recv_bytes=22918&delivery_rate=1350756&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1389&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Fri, 01 Nov 2024 15:35:29 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fde1beaa-LHR
accept-ranges
bytes
content-length
6794
server
cloudflare
Spectre-Vulnerability-Keeps-Haunting-Intel-AMD-CPUs-150x150.webp
gridinsoft.com/blogs/wp-content/uploads/2024/10/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/10/Spectre-Vulnerability-Keeps-Haunting-Intel-AMD-CPUs-150x150.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c0c6074314115747c7fa8078a938c3ec81f6486d9c83a0c9967917cedd97f86

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"67220efe-22da"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iz2fWZxDyzctuPi3LEwh0sZ4%2BuELVE5aS4FsgpWVll3%2F2%2FuzE1TeVwE%2B0JljTf0%2F9KVPG1d7fMDVj25xNMU2SWF88fByMIdL6vI9G7sm0rAkrT7onPdoNpKJjz2kypGE"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25702&sent=514&recv=137&lost=0&retrans=0&sent_bytes=508237&recv_bytes=23098&delivery_rate=2042205&cwnd=105900&unsent_bytes=0&cid=264ea9ce905003df&ts=1401&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Wed, 30 Oct 2024 10:48:30 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a3fde4beaa-LHR
accept-ranges
bytes
content-length
8922
server
cloudflare
collectedforms.js
js.hscollectedforms.net/ 		69 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/47550839.js?integration=WordPress&ver=11.1.60
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.109.254 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca9ead1a878c5a474808166462389da9859bbe06ee7c5e4365029c8062709121
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/

Response headers

x-request-id
c97dcf09-2ce7-4f23-beae-cd2b7d2a198d
content-encoding
gzip
cf-cache-status
EXPIRED
x-amz-version-id
_vUoUmuymk3IT7Uikz585Nn8PzBEJUsn
etag
W/"216a00fb66fa9b149d5f8b5557f0f563"
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-evy-trace-listener
listener_https
x-amz-cf-id
Za9Kuv09Q2N0k55wj4miUSyfnSVC9nom5uyLhF_z-Ty37knuaXbkxQ==
x-hubspot-correlation-id
c97dcf09-2ce7-4f23-beae-cd2b7d2a198d
content-type
application/javascript; charset=utf-8
last-modified
Mon, 14 Oct 2024 10:34:35 UTC
x-amz-replication-status
COMPLETED
x-evy-trace-route-service-name
envoyset-translator
cache-control
s-maxage=600, max-age=300
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-86c46c9777-gk866
x-envoy-upstream-service-time
6
x-hs-target-asset
collected-forms-embed-js/static-1.885/bundles/project.js
server
cloudflare
x-evy-trace-virtual-host
all
x-amz-server-side-encryption
AES256
access-control-max-age
3000
access-control-allow-methods
GET
x-hs-cache-status
MISS
date
Thu, 07 Nov 2024 05:00:34 GMT
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.885/bundles/project.js&cfRay=8dd5f8bc982ab7ae-CDG
via
1.1 c13d71f8919c23db6bbd1c08a4dfb350.cloudfront.net (CloudFront)
cf-ray
8deac2a93d327783-LHR
access-control-allow-origin
*
x-evy-trace-route-configuration
listener_https/all
x-amz-cf-pop
IAD12-P3
47550839.js
js.hs-analytics.net/analytics/1730955600000/ 		68 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1730955600000/47550839.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/47550839.js?integration=WordPress&ver=11.1.60
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.175.201 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1af41e808f2d2a589b250a67264c6959b2f644f70309564e0135bd096ed524a4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

x-amz-server-side-encryption
AES256
x-request-id
14e4406f-66c6-4a8e-898e-7059469a3604
content-encoding
gzip
cf-cache-status
MISS
etag
W/"12051df3038a0acef82aba9d98b29cb3"
x-amz-version-id
null
expires
Thu, 07 Nov 2024 05:05:34 GMT
x-evy-trace-listener
listener_https
date
Thu, 07 Nov 2024 05:00:34 GMT
x-hubspot-correlation-id
14e4406f-66c6-4a8e-898e-7059469a3604
content-type
text/javascript
last-modified
Tue, 22 Oct 2024 23:16:27 GMT
vary
origin, Accept-Encoding
x-amz-id-2
Umketz3lpeemrVTDVGPXUI0AiiLIuZNi9zUgx+qaPiWdKaGhdKbMK7r+YBF26k6jEocJVI3lRVs=
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=300,public
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-r9tq8
x-envoy-upstream-service-time
72
access-control-allow-credentials
false
x-amz-request-id
DVQ48JJS9MSZCZKB
cf-ray
8deac2a958f94145-LHR
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-evy-trace-virtual-host
all
banner.js
js.hs-banner.com/v2/47550839/ 		71 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/v2/47550839/banner.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/47550839.js?integration=WordPress&ver=11.1.60
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.147.16 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0aac85bb5538a2a6b6ec8177f46f89b6110c9d0859e2c90b1273fa770c5b02f4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

x-evy-trace-virtual-host
all
access-control-max-age
604800
x-request-id
a16c166a-dab2-4e02-b211-62c8827ce840
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding
gzip
cf-cache-status
REVALIDATED
etag
W/"a617995e5b743f2355949343e36a8d86"
x-amz-version-id
ImXZv.DYtuGoTDc7TlNrJYHADdstjXZn
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires
Thu, 07 Nov 2024 05:05:34 GMT
x-evy-trace-listener
listener_https
date
Thu, 07 Nov 2024 05:00:34 GMT
x-hubspot-correlation-id
a16c166a-dab2-4e02-b211-62c8827ce840
content-type
text/javascript; charset=UTF-8
last-modified
Mon, 30 Sep 2024 04:05:44 GMT
vary
origin, Accept-Encoding
x-amz-id-2
0lQVshTf61CuJWB7NziQpkWu9e6o0R0vK6oTAwvTfYCZB6zip+s23H70FiFs+vmKmaLRODJmkZg=
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=300,public
timing-allow-origin
*
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-75d7846cb8-z9c74
x-envoy-upstream-service-time
76
access-control-allow-credentials
true
x-amz-request-id
35XP5SF7MZGK3G53
cf-ray
8deac2a95c9179b4-LHR
access-control-allow-origin
https://gridinsoft.com
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-amz-server-side-encryption
AES256
banner-1-optout.css
gridinsoft.com/blogs/wp-content/uploads/complianz/css/ 		16 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/complianz/css/banner-1-optout.css?v=18
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1717690686
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c75c2f459b778784f30497cfb326a7ace5fd6db29a22d4ca8dba5b963217d64d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"66f97e21-3f88"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j%2Br51kI001G91NpjLcd1j%2FzcX2ba3WCdHkRaYeljWn3coP7YI4cumQoYC2OLVc7aJXwHgo%2FOS1brVsqSnqWK5myxfIV2%2Fla0YmVRyXxQAy5659FfBknpUOuRxuj3FMM5"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a69fa7beaa-LHR
expires
Thu, 07 Nov 2024 05:20:17 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25512&sent=803&recv=179&lost=0&retrans=0&sent_bytes=844437&recv_bytes=26034&delivery_rate=3346834&cwnd=119100&unsent_bytes=0&cid=264ea9ce905003df&ts=1791&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
text/css
last-modified
Sun, 29 Sep 2024 16:19:45 GMT
vary
Accept-Encoding
server
cloudflare
wp-emoji-release.min.js
gridinsoft.com/blogs/wp-includes/js/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-includes/js/wp-emoji-release.min.js?ver=6.6.2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
HIT
etag
W/"660cb0ad-4926"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZEuh9IuFaUSJEi9By79vQ5y1FX8SRBP3%2F4NUUN0xLMDQj7iUQzivn6xCLDamiJfjIyLnw8gM7TVaPRLhQ9SEYqc5WD1DGWWCfvffzXiiohfzhxI4o5TSuz3QQATEvzJ6"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2a6bfc9beaa-LHR
expires
Thu, 07 Nov 2024 05:55:48 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25512&sent=808&recv=181&lost=0&retrans=0&sent_bytes=848269&recv_bytes=26874&delivery_rate=3346834&cwnd=119100&unsent_bytes=0&cid=264ea9ce905003df&ts=1819&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
application/javascript; charset=utf-8
last-modified
Wed, 03 Apr 2024 01:28:13 GMT
vary
Accept-Encoding
server
cloudflare
admin-ajax.php
gridinsoft.com/blogs/wp-admin/ 		2 B
844 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/blogs/wp-admin/admin-ajax.php
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
*/*
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-robots-tag
noindex
cf-edge-cache
cache,platform=wordpress
content-encoding
gzip
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ihPSNHzy9HFsWx1ai3J3%2FCFh%2BbBWoqyoyeWYSJ%2FiVDGbGuKj0epGNEoj%2BS8GhQK99fyEKV4ICPH4LXDlJkUW9wkr4ti4F4f2OfFzB2u96tGhSYgEG%2FBgMOP%2FTtqwAimP"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 11 Jan 1984 05:00:00 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=29683&sent=1197&recv=226&lost=0&retrans=0&sent_bytes=1304992&recv_bytes=29256&delivery_rate=2244722&cwnd=165900&unsent_bytes=0&cid=264ea9ce905003df&ts=2724&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:34 GMT
content-type
application/json; charset=UTF-8
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
cache-control
no-cache, must-revalidate, max-age=0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
access-control-allow-credentials
true
referrer-policy
strict-origin-when-cross-origin
cf-ray
8deac2a6fff6beaa-LHR
access-control-allow-origin
https://gridinsoft.com
server
cloudflare
ad2.webp
gridinsoft.com/blogs/wp-content/uploads/2024/04/ 		195 KB
196 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/04/ad2.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/vendor/flickity/flickity.js?ver=2.2.1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf7a5b148dffb18cf86c011883eb034d2582ddb79a6236ae89098dfb701d6cb8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"662bb900-30b8c"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SwCSA%2FkNnURO9j2ULfmbIzrv%2BwjRc4xjatV2NSH%2B5VX%2FOWulRzdX981pHSe6RpGcZX8ntQVNRAv9xeoFwY%2FX2OCBpj5nHhlRtlIIzvRmmHDub6aZEUI8kGEyBarm2dWE"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:33 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=24622&sent=834&recv=186&lost=0&retrans=0&sent_bytes=876912&recv_bytes=27443&delivery_rate=569256&cwnd=119100&unsent_bytes=0&cid=264ea9ce905003df&ts=1939&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
image/webp
last-modified
Fri, 26 Apr 2024 14:24:00 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a74818beaa-LHR
accept-ranges
bytes
content-length
199564
server
cloudflare
ad3.webp
gridinsoft.com/blogs/wp-content/uploads/2024/04/ 		161 KB
161 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gridinsoft.com/blogs/wp-content/uploads/2024/04/ad3.webp
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/wp-content/plugins/shortcodes-ultimate/vendor/flickity/flickity.js?ver=2.2.1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8313c3f7d7e07fd704b46e2bfb802e7b0a61f865f18978547fcbdb7cf9345495

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
BYPASS
etag
"662bb92d-28308"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C29ObdEEB4ejrNRMW%2BH66YklFqJI%2F8DX7JXT7Yrgc2yd29IzyPLLF9J5Q1TrRpHquWA7u%2FAfA0k9SMCxwecYBaR5LLJNvtSpKHRUrIjxBWydYOEuzQxhoUxhyGtdo4QL"}],"group":"cf-nel","max_age":604800}
expires
Fri, 07 Nov 2025 05:00:34 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26530&sent=980&recv=197&lost=0&retrans=0&sent_bytes=1050642&recv_bytes=27938&delivery_rate=1023293&cwnd=119100&unsent_bytes=0&cid=264ea9ce905003df&ts=2092&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:34 GMT
content-type
image/webp
last-modified
Fri, 26 Apr 2024 14:24:45 GMT
vary
Accept, Accept-Encoding
cache-control
max-age=31536000, private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a7481abeaa-LHR
accept-ranges
bytes
content-length
164616
server
cloudflare
j8_46_LD37rqfuwxyIuaZhE6cRXOLtm2gfT-dYyZAC4I.woff2
gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/ 		21 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/fonts.gstatic.com/s/encodesanscondensed/v10/j8_46_LD37rqfuwxyIuaZhE6cRXOLtm2gfT-dYyZAC4I.woff2
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2123f408e24aef68f451ccbe5370ec3c92354c75d3e58188d31e6b9618edafb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://gridinsoft.com
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cf-cache-status
HIT
age
114746
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qAUdDK%2BS6DVbwGq5Kc%2FxLMj3KXNfXaZs%2Bg%2FJgTkqbQgWcyhq1Txn8k%2FiJRqt7b0%2FpPnUK%2FqekBKdobOd4ionEZ2esJDmGsyXnKJscM4fhgNZfo4TK20u2KRWd%2FQsQ37G"}],"group":"cf-nel","max_age":604800}
expires
Sun, 02 Nov 2025 11:38:32 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=25103&sent=814&recv=184&lost=0&retrans=0&sent_bytes=854146&recv_bytes=27355&delivery_rate=76816&cwnd=119100&unsent_bytes=0&cid=264ea9ce905003df&ts=1899&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:33 GMT
content-type
font/woff2
last-modified
Thu, 21 Apr 2022 16:47:01 GMT
vary
Accept-Encoding
cache-control
public, max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8deac2a7b878beaa-LHR
accept-ranges
bytes
content-length
21596
cf-apo-via
proxy
server
cloudflare
js
www.googletagmanager.com/gtag/ 		421 KB
134 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/?local_ga_js=0644836af4791c2ec2a326743f50420b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.232 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
d767eef4d0e77f256aa68b3fdb8c624c507969dc6ef8d995d7b1fabe04c48b44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Thu, 07 Nov 2024 05:00:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 07 Nov 2024 05:00:34 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
136403
x-xss-protection
0
server
Google Tag Manager
json
forms.hscollectedforms.net/collected-forms/v1/config/ 		134 B
427 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=47550839&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.109.254 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d5299b02c873b4004f7bafa3367b665b76d98c587f66391724afb7be73a885
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://gridinsoft.com/

Response headers

x-robots-tag
none
access-control-max-age
180
x-request-id
bb0de95c-0245-4089-ba6d-d234e2c001a7
content-encoding
br
cf-cache-status
DYNAMIC
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options
nosniff
x-evy-trace-listener
listener_https
date
Thu, 07 Nov 2024 05:00:34 GMT
x-hubspot-correlation-id
bb0de95c-0245-4089-ba6d-d234e2c001a7
content-type
application/json;charset=utf-8
vary
Accept-Encoding
access-control-allow-headers
*
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-86c46c9777-zl2mg
x-envoy-upstream-service-time
9
cf-ray
8deac2ab4e4f7783-LHR
access-control-allow-origin
https://gridinsoft.com
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-evy-trace-virtual-host
all
counters.gif
forms.hsforms.com/embed/v3/ 		35 B
882 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

x-robots-tag
none
x-request-id
fa6d79e8-21ab-4afe-a588-2e85dea70e21
access-control-expose-headers
X-Origin-Hublet
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
x-evy-trace-listener
listener_https
date
Thu, 07 Nov 2024 05:00:34 GMT
x-hubspot-correlation-id
fa6d79e8-21ab-4afe-a588-2e85dea70e21
content-type
image/gif
vary
origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=0, no-cache, no-store
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-6c6b56f4b-2t5x5
x-envoy-upstream-service-time
2
access-control-allow-credentials
false
cf-ray
8deac2ac5a07beba-LHR
x-evy-trace-route-configuration
listener_https/all
content-length
35
server
cloudflare
x-evy-trace-virtual-host
all
collect
www.google.com/ccm/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1549216886.1730955635&auid=93315222.1730955635&npa=0&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&tft=1730955635056&tfd=3096&apve=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f4.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/940364021/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/940364021/?random=1730955635016&cv=11&fst=1730955635016&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f2.1e100.net
Software
cafe /
Resource Hash
04ddac9eab9540f942a4134bdfb734f445b28d0c8034d57ca4036f4f833c9084
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
2349
date
Thu, 07 Nov 2024 05:00:35 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
940364021
td.doubleclick.net/td/rul/ Frame 337A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://td.doubleclick.net/td/rul/940364021?random=1730955635016&cv=11&fst=1730955635016&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s11-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://gridinsoft.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
16
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 07 Nov 2024 05:00:36 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/481455245/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/481455245/?random=1730955635393&cv=11&fst=1730955635393&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f2.1e100.net
Software
cafe /
Resource Hash
a225e699b70f1e7d03e0a836fe26f927f9454a5814ffad75ee96e2aa51ed8943
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
2366
date
Thu, 07 Nov 2024 05:00:35 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
481455245
td.doubleclick.net/td/rul/ Frame B807 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://td.doubleclick.net/td/rul/481455245?random=1730955635393&cv=11&fst=1730955635393&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s11-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://gridinsoft.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
16
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 07 Nov 2024 05:00:36 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-5N4B7Q122M&gtm=45je4au0v875497828za200&_p=1730955633080&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101823848~101925629&cid=2129470139.1730955636&ul=en-gb&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1730955635&sct=1&seg=0&dl=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&dt=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=3681
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://gridinsoft.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 07 Nov 2024 05:00:36 GMT
content-type
text/plain
server
Golfe2
sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame AADE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fgridinsoft.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5N4B7Q122M&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.232 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f8.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
45143
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
1476
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy
cross-origin
date
Wed, 06 Nov 2024 16:28:13 GMT
expires
Thu, 06 Nov 2025 16:28:13 GMT
last-modified
Mon, 21 Oct 2024 16:58:00 GMT
report-to
{"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server
sffe
service-worker-allowed
/static/service_worker
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
/
www.google.com/pagead/1p-user-list/940364021/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/940364021/?random=1730955635016&cv=11&fst=1730955600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dYYegzgUD-abhw9z8Xd_Ch06hxa7uGA&random=3721686049&rmt_tld=0&ipr=y
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Thu, 07 Nov 2024 05:00:35 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
/
www.google.co.uk/pagead/1p-user-list/940364021/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.uk/pagead/1p-user-list/940364021/?random=1730955635016&cv=11&fst=1730955600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dYYegzgUD-abhw9z8Xd_Ch06hxa7uGA&random=3721686049&rmt_tld=1&ipr=y
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Thu, 07 Nov 2024 05:00:36 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
/
www.google.com/pagead/1p-user-list/481455245/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/481455245/?random=1730955635393&cv=11&fst=1730955600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7dFqjzGS5SxPdzoC8tvFTgSuFFTQaIfGucIiZ3u10Qz9bYKSpV&random=203452163&rmt_tld=0&ipr=y
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Thu, 07 Nov 2024 05:00:35 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
/
www.google.co.uk/pagead/1p-user-list/481455245/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.uk/pagead/1p-user-list/481455245/?random=1730955635393&cv=11&fst=1730955600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v875497828za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101925629&u_w=1600&u_h=1200&url=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&hn=www.googleadservices.com&frm=0&tiba=Unmasking%20PUA%3AWin32%2FPresenoker%3A%20An%20Easy%20Guide%20on%20Removal&npa=0&pscdl=noapi&auid=93315222.1730955635&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7dFqjzGS5SxPdzoC8tvFTgSuFFTQaIfGucIiZ3u10Qz9bYKSpV&random=203452163&rmt_tld=1&ipr=y
Requested by
Host: gridinsoft.com
URL: https://gridinsoft.com/blogs/pua-win32-presenoker-adware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Thu, 07 Nov 2024 05:00:36 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
47550839.js
js-na1.hs-scripts.com/ 		2 KB
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js-na1.hs-scripts.com/47550839.js
Requested by
Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1730955600000/47550839.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.140.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c53789758b44005030005a553219b5f78b6c4e672eb554b86c44da2c6fc40c53
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

access-control-max-age
3600
content-encoding
gzip
cf-cache-status
EXPIRED
access-control-allow-credentials
true
x-content-type-options
nosniff
cf-ray
8deac2b7d9f0951b-LHR
accept-ranges
bytes
access-control-allow-origin
https://gridinsoft.com
content-length
608
date
Thu, 07 Nov 2024 05:00:36 GMT
x-hubspot-correlation-id
a3d37db4-f149-4077-b555-8271bf1f4964
content-type
application/javascript;charset=utf-8
vary
origin, Accept-Encoding
server
cloudflare
last-modified
Thu, 07 Nov 2024 05:00:36 GMT
__ptq.gif
track.hubspot.com/ 		45 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-gb&bfp=3150758462&v=1.1&a=47550839&ct=blog-post&rcu=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&pu=https%3A%2F%2Fgridinsoft.com%2Fblogs%2Fpua-win32-presenoker-adware%2F&t=Unmasking+PUA%3AWin32%2FPresenoker%3A+An+Easy+Guide+on+Removal&cts=1730955636429&vi=4bc268bbef15e5218a5d7f1e65d04a7b&nc=true&u=242596701.4bc268bbef15e5218a5d7f1e65d04a7b.1730955636413.1730955636413.1730955636413.1&b=242596701.1.1730955636414&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.117.116 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/

Response headers

x-robots-tag
none
x-request-id
71fd7447-27e8-4bac-b1fe-cd2cd76d138c
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M8IG9YzyTH3TLomg%2FHVu4N4wO2bJoDcZKlRzl437O37Q1KZsysxWme7Uy2n3yKu38jEoLa0F%2BjjFev4DadHQVCW15O8XB7pdBUDlTEB6tFvY6M0BcgcKyM%2FFj08uegn717Dn"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-evy-trace-listener
listener_https
p3p
CP="NOI CUR ADM OUR NOR STA NID"
date
Thu, 07 Nov 2024 05:00:36 GMT
x-hubspot-correlation-id
71fd7447-27e8-4bac-b1fe-cd2cd76d138c
content-type
image/gif
vary
origin, Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
cache-control
no-cache, no-store, no-transform
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-746d57b5c6-2lx62
x-envoy-upstream-service-time
8
access-control-allow-credentials
false
cf-ray
8deac2ba1ab1cd15-LHR
x-evy-trace-route-configuration
listener_https/all
content-length
45
server
cloudflare
x-evy-trace-virtual-host
all
favicon.ico
gridinsoft.com/ 		15 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://gridinsoft.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.74.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31994dda4d5118e5983d8f50eedfde71c17474fd41f5939b1844126ac29b1694

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://gridinsoft.com/blogs/pua-win32-presenoker-adware/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
HIT
etag
W/"62c42ebe-3aee"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YmO%2BUnxgGooplVMNGwW3yL9E9JxpPS2N5IZJx59JsQdLEZ51ujMVZKYDvoatbrz%2FOvGbqJD%2Bm0FmCVf0gn%2FMB0bHJj1%2FaJ%2BxTp1MHRdG8j4YzYEfS%2BZyF6KwMEE3ikBy"}],"group":"cf-nel","max_age":604800}
cf-ray
8deac2b7dc14beaa-LHR
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=28761&sent=1199&recv=228&lost=0&retrans=0&sent_bytes=1305885&recv_bytes=29925&delivery_rate=30580&cwnd=165900&unsent_bytes=0&cid=264ea9ce905003df&ts=4559&x=1", cfHdrFlush;dur=0
date
Thu, 07 Nov 2024 05:00:36 GMT
content-type
image/x-icon
last-modified
Tue, 05 Jul 2022 12:29:50 GMT
vary
Accept-Encoding
server
cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
gridinsoft.com
URL
blob:https://gridinsoft.com/2a66a39a-e33b-4477-97c2-41a97b0a0bfd

Verdicts & Comments Add Verdict or Comment

131 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| _wpemojiSettings function| jQuery object| Sharect object| _hsq function| gtag object| dataLayer object| su_image_carousel_672aa88d2a502_script object| foxizCoreParams object| FOXIZ_CORE_SCRIPT object| leadin_wordpress object| _hsp function| Waypoint function| RBSwiper object| FOXIZ_PERSONALIZE object| foxizParams object| FOXIZ_MAIN_SCRIPT object| complianz function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Flickity function| Unipointer function| Unidragger function| imagesLoaded object| SUShortcodesL10n object| SUImageCarousel object| addComment function| cmplz_create_element function| cmplz_add_event function| cmplz_is_hidden function| cmplz_html_decode function| cmplzLoadConsentAreaContent object| cmplz_banner object| cmplz_manage_consent_button object| cmplz_banner_container object| cmplz_waiting_inline_scripts object| cmplz_waiting_scripts object| cmplz_fired_scripts boolean| cmplz_all_scripts_hook_fired object| cmplz_fired_category_events object| cmplz_fired_service_events object| cmplz_categories function| cmplz_run_script function| cmplz_maybe_run_waiting_scripts function| cmplz_set_blocked_content_container function| cmplz_insert_placeholder_text function| cmplz_set_blocked_content_container_aspect_ratio function| cmplz_has_blocked_scripts function| cmplz_enable_category function| cmplz_remove_placeholder function| cmplz_get_waiting_script function| cmplz_array_is_empty function| cmplz_is_waiting_script function| cmplz_run_after_all_scripts object| cmplz_fired_events function| cmplz_run_tm_event function| cmplz_fire_before_categories_consent function| cmplz_check_cookie_policy_id function| cmplz_do_not_track function| cmplz_get_services_on_page function| cmplz_is_bot function| cmplz_is_speedbot function| cmplz_exists_service_consent function| cmplz_set_service_consent function| cmplz_clear_all_service_consents function| cmplz_get_all_service_consents function| cmplz_get_cookie_path function| cmplz_get_cookie_domain function| cmplz_reload_browser_compatible object| cmplz_user_data function| cmplz_track_status_end function| cmplz_set_up_auto_dismiss function| cmplz_fire_categories_event function| cmplz_track_status function| cmplz_accepted_categories function| cmplz_sync_category_checkboxes function| cmplz_merge_object function| cmplz_clear_cookies function| cmplz_set_accepted_cookie_policy_id function| cmplz_integrations_init function| cmplz_integrations_revoke function| cmplz_set_integrations_cookies function| cmplz_get_url_parameter function| cmplz_maybe_auto_redirect function| cmplz_wp_set_consent object| cmplz_cookie_data function| cmplz_start_clean function| cmplz_do_cleanup function| cmplz_setup_clean_interval function| cmplz_clear_storage function| cmplz_load_manage_consent_container function| cmplz_equals function| cmplzCopyAttributes function| cmplz_get_cookie function| cmplz_set_cookie function| cmplz_in_array function| cmplz_highest_accepted_category function| cmplz_accept_all function| cmplz_deny_all function| conditionally_show_banner function| show_cookie_banner function| cmplz_get_banner_status function| cmplz_set_banner_status function| cmplz_has_consent function| cmplz_is_service_denied function| cmplz_has_service_consent function| cmplz_set_consent string| wp_consent_type function| onYouTubeIframeAPIReady object| twemoji object| wp object| google_tag_manager object| google_tag_data object| __hsCollectedFormsDebug function| sanitizeKey boolean| _hstc_loaded object| hsCookieBanner boolean| _hspb_loaded boolean| _hspb_ran object| GooglebQhCsO object| gaGlobal boolean| _hstc_ran object| hsCallsToActionsReady string| __hsUserToken number| expireDateTime

17 Cookies

Domain/Path Name / Value
gridinsoft.com/blogs/ Name: RBUUID
Value: m1k3al2
gridinsoft.com/blogs/ Name: personalize_sync
Value:
gridinsoft.com/blogs/ Name: syncTimeout
Value: 1
.hsforms.com/ Name: __cf_bm
Value: O.R4MsDgjoM_siQ8mWj15M2xE1dxIHDwMiiWGmmEleU-1730955634-1.0.1.1-cUl2VVBaGb4lts7dOqmcLp.qhcLD37vzl.JrJW42.b0xjVV5xKATUC0_8roICPukDXYAlUJsBjgB9peq88Hjdg
.hsforms.com/ Name: _cfuvid
Value: wqldYPxv0dd9FNkmGouP9VXsfj3I5kf0kqnijSk.hSo-1730955634706-0.0.1.1-604800000
gridinsoft.com/ Name: PHPSESSID
Value: 82scsjvsbnfohprqa923g3i83u
.gridinsoft.com/ Name: _gcl_au
Value: 1.1.93315222.1730955635
.doubleclick.net/ Name: IDE
Value: AHWqTUlakHf4C0LxOqU-YwhqRmVI8EPF_LdyT2QF0LXIPf-WfTaWOj1bvqQGP9Yh
.gridinsoft.com/ Name: _ga_5N4B7Q122M
Value: GS1.1.1730955635.1.0.1730955635.0.0.0
.gridinsoft.com/ Name: _ga
Value: GA1.1.2129470139.1730955636
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.gridinsoft.com/ Name: __hstc
Value: 242596701.4bc268bbef15e5218a5d7f1e65d04a7b.1730955636413.1730955636413.1730955636413.1
.gridinsoft.com/ Name: hubspotutk
Value: 4bc268bbef15e5218a5d7f1e65d04a7b
.gridinsoft.com/ Name: __hssrc
Value: 1
.gridinsoft.com/ Name: __hssc
Value: 242596701.1.1730955636414
.hubspot.com/ Name: __cf_bm
Value: VSKiZgdXjte3TrnWnYwm4C9.wZkQgeZgj9PPBSuK9Z4-1730955636-1.0.1.1-PWHFwnaO4U0kFc8_A8JWoFmrGJq6qOJCKFFsXm9Xy9u0KyGVu67xvg_iaJ5oC_ZK0m.bMIU4v0t3R0w.IqfoDg
.hubspot.com/ Name: _cfuvid
Value: QFzysO2aI2vPEehNKRT1Bz7cPjzv87m13x6UmZbOen8-1730955636922-0.0.1.1-604800000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

forms.hscollectedforms.net
forms.hsforms.com
googleads.g.doubleclick.net
gridinsoft.com
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
region1.google-analytics.com
secure.gravatar.com
td.doubleclick.net
track.hubspot.com
use.fontawesome.com
www.google.co.uk
www.google.com
www.googletagmanager.com
gridinsoft.com
104.16.109.254
104.16.117.116
104.16.140.209
104.17.175.201
104.18.80.204
142.250.184.232
142.250.185.68
142.250.186.67
142.250.74.194
172.64.147.16
172.67.142.245
172.67.74.78
192.0.73.2
216.239.34.36
216.58.206.66
04ddac9eab9540f942a4134bdfb734f445b28d0c8034d57ca4036f4f833c9084
09f3f68515a4c87754bae6c4bec6a3f3dd6291703358f9443c442d7d6fa39b40
0aac85bb5538a2a6b6ec8177f46f89b6110c9d0859e2c90b1273fa770c5b02f4
0d5f949fcf84560d013b596b51856d6bc487bedc510bc712e82458f00b2506e5
0f9cbef012abc87034a912f5750d3f1642acced4622bfe151ecffdda271bd0f1
140ee2462b736e743b7f9b2dd82f41ecfa63f17a818739fec426067500edb49c
165b215ce8cdca7f7596f3a6fd43414352fa68142d63c9f4d234a4bb46f71de6
1af41e808f2d2a589b250a67264c6959b2f644f70309564e0135bd096ed524a4
1e2d949ca590a98824a903c83203d0ee33503bbbf0f6cc6048a511a0f6c19330
20a22e2a0610fa88287f0f8a033e1f8c5fb3abb7f0a0d527115b6ce3dde328a1
26380ced18d21b382c7b30ca2bb4a755819b6543e4943944fd2d10658a2a7059
29c7c4c555a024a5b74091431e8447c686bbbf6fde257c8f3b552deb70c68359
31994dda4d5118e5983d8f50eedfde71c17474fd41f5939b1844126ac29b1694
3469e72d4d4320f058038c9ffa6d509b2fdf44ae5fe123890ffd9584197cabdc
3adf99ee0cf77a199223ea0bc8c2ad0a409e772f67b74edab35db191cb539a1c
43844c1db1f6297fde35378913d63a1cd77d9385b5cc241dc6c1550c5679b82b
4c0c6074314115747c7fa8078a938c3ec81f6486d9c83a0c9967917cedd97f86
4cf4fb08e2a7fc369b9054488bda138738961132f2febc12fd3df5841b212eed
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
533fee6130d42e8ab405c40ae8f71db9503d12903a5c21ae2d32ef50a5b2f5ff
5378ba6682687aef28e3f03df3498970c456b8300bbd37f0395b4bcc8e05f10a
5740bce57f68562d42e8ca6f6eb70dca3bc33be11ef0361e78274d360f41adc9
627bd02138c41bcada2624bce3ad21bfe1b42e79dd90c8d6e8b386c613a1708a
65d264c9b08a92980556fbeda052afc3fd95293593da15807d78e87b7816721a
6667eb92d07331b9ce3ccb1936273a82484bf2a81e5b43101ad3f50716a71c47
676ffbd4f026753a64c42d788f13923a771e7509f58361a4b98f87fa5cd4a03e
67d5299b02c873b4004f7bafa3367b665b76d98c587f66391724afb7be73a885
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6bc5622bfab1a16855ad49b99a3f9ed8eb24f49da469a113f9000b866f109e2e
73e41fb76ddcd5f047288e2fc664c19387db2fb6c01da9315fde404c53c3de18
76bbb197dd7895884e9e80018bf5ea5b01ba896b3527be7de3447341e2a3e276
7de32d703bdc40c65a949e883bed0245e592c5189746f94ef2884938c478401c
8313c3f7d7e07fd704b46e2bfb802e7b0a61f865f18978547fcbdb7cf9345495
863fccb66d39342008922e0d59c7154032fbff5e4026eaac35b001b260fddb31
8fe2f1cb7bc41c640ad3ea24449cfa1ba5291e16dbbbab0ef61bfe43f3212910
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
9e64f128d5352d04ea5c87031e4cf1ad204b72a0afb003ece52eeb997d28a570
a2123f408e24aef68f451ccbe5370ec3c92354c75d3e58188d31e6b9618edafb
a225e699b70f1e7d03e0a836fe26f927f9454a5814ffad75ee96e2aa51ed8943
b7019bfa08ad610155d7b360d00e7ad3a01fd78ffcfc8b0c6640eeb3e673722e
bf7a5b148dffb18cf86c011883eb034d2582ddb79a6236ae89098dfb701d6cb8
c53789758b44005030005a553219b5f78b6c4e672eb554b86c44da2c6fc40c53
c75c2f459b778784f30497cfb326a7ace5fd6db29a22d4ca8dba5b963217d64d
c86e183995d42d069cdf501e7605562c081cd7aac3b779abe3f69af717d4dd47
c9d9673c75cce5980cee75d53a6830052103e21da11e72dc0edd9ffd76698303
ca9ead1a878c5a474808166462389da9859bbe06ee7c5e4365029c8062709121
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
d52f1f1c0e3e9e237c7604afefa8d784064f688c76293e3f1102dab32a830925
d767eef4d0e77f256aa68b3fdb8c624c507969dc6ef8d995d7b1fabe04c48b44
d96ff60e71c4b640bd0b174825692eb2c0ca732c9931e34ac0929e70e500d2d9
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcc6aaeccd530bcb0e91ef01e2046485f1ad113a865aafb17a740eee4da61e32
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48afa0ca2fdaed77ef3d14202f805ab16829b42e321b71635d538f9e9efa4e2
eb354f051082f4f09c92850f594a4685858da56fbddffcb6f48796babab4033a
ed81d5248fa368649beafa2654a6dcf3b0fbb083cc1c2dfb18e5aad1d94510e9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef7778b5aadf91b551d9f45c543ccae4cde4b48ebdba3a5b6a2349cc2692e505
f03a743ac7613686746954c5dba75bb1d124d6b7bcc06b8e23fa5c7ac5d01b09
fb276e01752e73eb55790096a2f3808d914998ed519db70bc86d3064910a2e81
fb3a89cc6347e098063bd15f285bc90411846ddce6f17812364feedab67a67f5