urlscan.io logo urlscan.io
SecurityTrails logo

adlumin.com Open in urlscan Pro
35.185.12.98  Public Scan

Go To Rescan Add Verdict Report
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aer...
Submission: On June 07 via api from TR — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 26 IPs in 3 countries across 23 domains to perform 153 HTTP transactions. The main IP is 35.185.12.98, located in North Charleston, United States and belongs to GOOGLE, US. The main domain is adlumin.com. The Cisco Umbrella rank of the primary domain is 712028.
TLS certificate: Issued by R3 on June 1st 2023. Valid for: 3 months.
This is the only time adlumin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 35.185.12.98 15169 (GOOGLE)
114 141.193.213.10 209242 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2001:4860:480... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:9000:225... 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4860:480... 15169 (GOOGLE)
1 2600:9000:237... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 18.66.192.114 16509 (AMAZON-02)
3 2606:4700::68... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
153 26
1    35.185.12.98 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 98.12.185.35.bc.googleusercontent.com
adlumin.com
114    141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
adlumin.wpenginepowered.com
2    2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2606:4700::6812:863b (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
2    2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a02:26f0:3500:16::215:148d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
2    2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2606:4700::6810:650c (United States)

ASN13335 (CLOUDFLARENET, US)
ws.zoominfo.com
1    2600:9000:225e:3200:4:d7e1:700:93a1 (United States)

ASN16509 (AMAZON-02, US)
sc.lfeeder.com
1    2606:4700::6811:64ac (United States)

ASN13335 (CLOUDFLARENET, US)
js.usemessages.com
2    2606:4700::6811:6dc7 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hscollectedforms.net
forms.hscollectedforms.net
1    2606:4700::6811:836e (United States)

ASN13335 (CLOUDFLARENET, US)
js.hsleadflows.net
1    2606:4700::6810:89ce (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    2606:4700::6812:18c4 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2600:9000:237d:2000:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.linkedin.oribi.io
4    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
1    2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:80b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    18.66.192.114 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-192-114.muc50.r.cloudfront.net
tr.lfeeder.com
3    2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)
api.hubspot.com
forms.hubspot.com
3    2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)
app.hubspot.com
track.hubspot.com
5    2606:4700::6812:8d65 (United States)

ASN13335 (CLOUDFLARENET, US)
static.hsappstatic.net
1    2606:4700::6812:e0f (United States)

ASN13335 (CLOUDFLARENET, US)
3431514.fs1.hubspotusercontent-na1.net
Apex Domain
Subdomains		 Transfer
114 wpenginepowered.com
adlumin.wpenginepowered.com
4 MB
6 hubspot.com
api.hubspot.com — Cisco Umbrella Rank: 4992
app.hubspot.com — Cisco Umbrella Rank: 5637
track.hubspot.com — Cisco Umbrella Rank: 2452
forms.hubspot.com — Cisco Umbrella Rank: 4666
24 KB
5 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 6022
294 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 390
www.linkedin.com — Cisco Umbrella Rank: 567
px4.ads.linkedin.com — Cisco Umbrella Rank: 6569
5 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 57
region1.google-analytics.com — Cisco Umbrella Rank: 1892
21 KB
2 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4924
forms.hscollectedforms.net — Cisco Umbrella Rank: 5117
26 KB
2 lfeeder.com
sc.lfeeder.com — Cisco Umbrella Rank: 15359
tr.lfeeder.com — Cisco Umbrella Rank: 26170
12 KB
2 gstatic.com
fonts.gstatic.com
72 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 75
159 KB
2 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2635
2 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67
2 KB
1 hubspotusercontent-na1.net
3431514.fs1.hubspotusercontent-na1.net
3 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 5056
408 B
1 google.com
www.google.com — Cisco Umbrella Rank: 3
408 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 121
346 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1007
378 B
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2369
16 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2367
21 KB
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 4547
88 KB
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 5166
22 KB
1 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 5046
2 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 942
5 KB
1 adlumin.com
adlumin.com — Cisco Umbrella Rank: 712028
20 KB
153 23
Domain Requested by
114 adlumin.wpenginepowered.com adlumin.com
adlumin.wpenginepowered.com
5 static.hsappstatic.net app.hubspot.com
static.hsappstatic.net
3 px.ads.linkedin.com 3 redirects
2 app.hubspot.com js.usemessages.com
static.hsappstatic.net
2 api.hubspot.com js.usemessages.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts.gstatic.com fonts.googleapis.com
2 www.googletagmanager.com adlumin.com
www.googletagmanager.com
2 js.hs-scripts.com adlumin.com
www.googletagmanager.com
2 fonts.googleapis.com adlumin.com
1 3431514.fs1.hubspotusercontent-na1.net
1 forms.hubspot.com js.hsleadflows.net
1 track.hubspot.com
1 tr.lfeeder.com adlumin.com
1 forms.hscollectedforms.net js.hscollectedforms.net
1 www.google.de adlumin.com
1 www.google.com adlumin.com
1 stats.g.doubleclick.net www.google-analytics.com
1 px4.ads.linkedin.com adlumin.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 region1.google-analytics.com www.googletagmanager.com
1 js.hs-banner.com js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hsleadflows.net js.hs-scripts.com
1 js.hscollectedforms.net js.hs-scripts.com
1 js.usemessages.com js.hs-scripts.com
1 sc.lfeeder.com adlumin.com
1 ws.zoominfo.com adlumin.com
1 snap.licdn.com www.googletagmanager.com
1 adlumin.com
153 31

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
linkedin.com
www.linkedin.com
www.youtube.com
Subject Issuer Validity Valid
adlumin.com
R3		 2023-06-01 -
2023-08-30		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-03-19 -
2024-03-18		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-02-01 -
2024-01-31		 a year crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3		 2023-04-04 -
2024-04-03		 a year crt.sh
*.lfeeder.com
Amazon RSA 2048 M01		 2023-03-22 -
2024-04-19		 a year crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01		 2023-02-24 -
2023-08-06		 5 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
www.google.de
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2023-02-05 -
2024-02-05		 a year crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3		 2023-04-10 -
2024-04-09		 a year crt.sh
hubspotusercontent-na1.net
Cloudflare Inc ECC CA-3		 2023-01-26 -
2024-01-25		 a year crt.sh

This page contains 2 frames:

Primary Page: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Frame ID: 9DAA44CC0E1054D3B573B5C89F35E93B
Requests: 144 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/b20a4b809ae341899a1ab4b4bb814af7?uuid=9bfb843a173a40cda8b49f5141720c0a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: 390A71C496978B9B296E9269CA1534D2
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

PowerDrop: A New Insidious PowerShell Script for Command and Control Attacks Targets U.S. Aerospace Defense Industry | Adlumin SaaS Security

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • /flickity(?:\.pkgd)?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

153
Requests

99 %
HTTPS

85 %
IPv6

23
Domains

31
Subdomains

26
IPs

3
Countries

5020 kB
Transfer

8017 kB
Size

23
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 132
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4470834%26time%3D1686103909959%26url%3Dhttps%253A%252F%252Fadlumin.com%252Fpost%252Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true&e_ipv6=AQKr1sZPDmw9lAAAAYiTn-kKPG_7FqknzoX8BQOpVDGbxBGP7qkMtPB8vNMuAnJOn-JgP-7yAzvV

153 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ 		150 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.185.12.98 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
98.12.185.35.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
2ee3fb312c4f9dc98ade1b707b255ddfbcbaf18d656de422a17f574f0f7841fb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=600, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 07 Jun 2023 02:11:49 GMT
server
nginx
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
HIT: 7
x-cache-group
normal
x-cacheable
SHORT
x-powered-by
WP Engine
grid.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/grid.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f263adc7aa1e2753fa89385c468485645f3076acdcc8f0cd81edf00677c7dd4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64513062-2c3b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sZmNvFgKwvOUxL847ovPO2qfcUOHptqPldBbTNZULsNxcg7gV4w5Noyvl%2BJ%2BOxegqb%2Fuz6FlGpge%2BWD67DgjxWr9Q2iRywKQzhmNFtfK2N9PjnZiAGqw%2BbKj6J%2FitIZeaHdfBItULh7Ih7COCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddacdf4bbd7-FRA
alt-svc
h3=":443"; ma=86400
base.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		20 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/base.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bf5262d2b65c72708c054c0e5d9fd374295547d0f1ee4dcb082d11ff7fc8a42

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64513062-4e7e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NyVrQa%2BMFJGsxdMnLxxLZmxFPkhifIhtAPnk%2FCsMsc0CjwqMUBfQgdwqp0tamzxp2c3LaBaIiHR7CtaJrWzUQR9NLehMqMXLZifWTF2phCgJpvSELkH9t%2Bdf9io4NuAr2lmiug3Kku7%2FCx6QwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddaddf5bbd7-FRA
alt-svc
h3=":443"; ma=86400
layout.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		89 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/layout.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9348fa7f55ae75656a1c330fea76789f4ac1f5a05e338902af8b05210e7ef61c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2207492
etag
W/"64513062-16273"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f6p2oV%2BjtAl2Oyd6TjbsPSPQT%2BIy4PsXW2PmiRjAIrz6Ykkm%2BhR1H6n7emdqZ5etKfhCCc0Zk3QQc7C5AFaT3PHQ8Y66Sb1Fd%2FJNzl9BtXWxWhsXGtaizdDTMAoTRjKxjhdocHFsD4Uu%2BG86wQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddaddf6bbd7-FRA
alt-svc
h3=":443"; ma=86400
buttons.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttons/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttons/buttons.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3252dd0b99f05fca9861c280ab9df2949ea88206b207a770a8fa8a42dcd3d0c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64513063-1b62"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VCLL3DkVTB5J9%2Bb%2BC6CnhSxuFXn5MwI58rRvRMWtXAWsC9xxh9XUyNAT2ljpSNgteIk39PWxT31u680G%2F05tjUvj9L7Sfd5zbsZ4X6f8oGwufBWoHh3jW4XvvSYIkd3vkFHfzMhf%2FEsEe%2FAHfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddaddf7bbd7-FRA
alt-svc
h3=":443"; ma=86400
buttonrow.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttonrow/ 		472 B
480 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/buttonrow/buttonrow.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0276ecc6eb34688965af8f6b186f9d79f97505a31dd0cc983c3a3c6182ce97fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2207491
etag
W/"64513063-1d8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6XlnogTLWHkTCf%2F%2F9EGmoqGE1G57%2Fw7VRi1N5fa0Z%2Bk8T7dWFDUWcA6AzIZCodDsqleNn3LG%2FkH5QrqawceFOhIqYuZeNy1%2BXYTUkArwXaLlznomAyOe3JOgLvpPluq%2Bvy916u3ez06%2B8OHS0g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddaddf8bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_buttonrow.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
521 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_buttonrow.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
df5520815d1855bbe6788df257595be644bf27b1662e485605b2784c70e499b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"6455b665-435"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bLT7vZQ1hWcw4XdtpUysfjBDCHppqhtlpDSzp8iHEd3GqViDDsgM%2B%2Bz4O9Ne2mpMlE8dkXD%2BiDylZiOKJquCZuwZzYCMwy0NjOYBiNURvP5lPo4hUcpPIh%2BRhJ7GuMh7udvFcySbwvZXVihoIw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddaddfcbbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_buttons.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
731 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_buttons.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
587927ba416073d732643851c80a8f73f202fbdaf2d409e3bef44a48a8fd6e26

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"6455b665-517"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DY7WPpL7pPaQxxpU5NRrKY0d4kSOORB27AKotb9eUVIr84wEvPlqTXUVKIIeG7TLtHZUOHnAKI2eWceUPBfshAX6y0doSvRK%2BGglLpO5f1Jzn%2FVdJXvMtYbr4IuyPfYGzX4kTpxow8f6NTNneA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddaddfdbbd7-FRA
alt-svc
h3=":443"; ma=86400
bulma_grid.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/ 		18 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/bulma_grid.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9c5b1987a9c832d022b74eeeb75ad59e6d5192cb85584932da668f9d7f6f5c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
580450
etag
W/"6455b665-472d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zir3VbcD8Gw6n%2FE5HglN1c%2Fqn1zOBgssw%2FiE0CMxzomSa72IeDDnMB42MKUZ3l%2B46S%2BmGe1HYT2WBV2G0xs5SfQ%2FqEVvTFSIXl1ovqazYWMoDMtcg2AxyoO%2Bem8KgFk6JRdWGW1%2FUV%2F%2Bmh6grQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade0abbd7-FRA
alt-svc
h3=":443"; ma=86400
flickity.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/ 		2 KB
964 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/dist/flickity.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2a6fb021027df3628a394d95bb217f31bc1739932c0d581cdbefe88c78eebbd0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2757911
etag
W/"6455b665-7c3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6urJFqZZGhJQsc0vjaUTr%2BQ562Xk3nX%2B1W3DGIAgWQ9JE6UHcxNZKPmsx1IQIPufHIjeTAQVvTsBPwBwMQMSS%2BHXEUR%2BibIxLb9k1zspV51fh1vpmQ4ZZz1zcgYIp2ar2%2FRhUZh%2BAr7GcBrZ2A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade09bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_flickity_slider.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		458 B
677 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_flickity_slider.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
12b42fe6d39673c1e85c63df6ef2906ce0120d5fb1010142b49e9bc09f1bb68a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55476
etag
W/"6455b665-1ca"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Iz4AGRVRk4NhM8VqlGdfY7cc2bVBgCpxhcvjfFkAW6Ao4sFNBXkBOqTqD9RVoL5Qs24NyBvKcX%2B6bT%2FcyGYRa%2FffvrWHnVjgXq7wcjnwPj7vV8fRJhSU%2BJobeK0d9GS4J7LefbE62OVzlofhg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade0cbbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_custom_menu.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		280 B
418 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_custom_menu.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9a3829921f030601d923482197968bd87d9e00904316282225e02756ddf3014

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2757911
etag
W/"6455b665-118"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KbwLRu8KLS2kzTyOHE9o4pkk1F7HEExuOitLXYcgviRkqc9TH%2F%2B%2FkGeLosWgZjsY2SY7Sog%2BCrGZOJRE4oMozK0ei5BtNod7ZAdMVVLTnTW3QdNjTQnKlxLMgX5ugeMZlGTLoUyyZQGyZKNYCA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade0dbbd7-FRA
alt-svc
h3=":443"; ma=86400
grid_row.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/grid_row/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/grid_row/grid_row.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
22790dd93a3e568eccc84db1a236e0bbf21007eb10a314ed8a364396649edfc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
35232
etag
W/"64513063-bb9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nIU7zBCuOkJ2fo8A8wBOWqsZTdjo9wG73eSViyv553Z1WHrJgx4UZn%2BA782t%2BIcTAyEV2Fa4v4%2BIiVWO%2FuvRtLmbdoL6L9r2iMb2S6Cfdn69ynoPshrPB30PPhusIErrjEQ9sBMCa647VJa2yg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade0bbbd7-FRA
alt-svc
h3=":443"; ma=86400
heading.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/heading/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/heading/heading.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
217c9ab482899dd907452152ae6b87ea26e5fc0ee107d4a4ddc35bf239727436

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64513063-1294"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZwLgx15Mwki1byUfmvK1q0cKjazvhUBGSlpc2UrrGQCUmrgtcu4tPrXhEos6poZe4yPQt1PfMZRZ8u8NcI01FBs%2FjteIC6O9X6rurtQB0RTirKhUxHRA0dtL%2FZU5G8FRl51odihSOK4Rm47qA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade08bbd7-FRA
alt-svc
h3=":443"; ma=86400
hr.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/hr/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/hr/hr.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc2fc51fc5ade58e3350056a062f6817c41544909061ca953f4aaa41c1ea6d1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
3200105
etag
W/"64117050-8d9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IHOxbzehTwG4YwtV7nRiw9Ja17RwwR2wQFqG5R4HFin2kNQL5EtWxjQ5MUxJHc1KLDKMffnGFGr0FyS%2B%2FQhpknAbH0rGy7vse5FlReOFQhJrivP69DTC5DPYExrHrhSeiSiDLLYwAjvw0j9KQw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade04bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_hr.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
638 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_hr.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d480d8c899f7bae61b8985b1b73a92b828bb087f57e0c5902f11942ea96750b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"6455b665-42c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EAY%2FO2dgeLD8uRXob7ehBiuxjYjWIZGgD2%2BCzpZqvff0%2FKBUXCf5RmtK8KXR4jJJshv%2Blf0bn1bmRbSNKmokM5UJSadajMS5dxAl26FB6Yrv%2F4r%2FZpNHIwQRqfj5pLGMunp8Da3S1MXasPrqKw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade2abbd7-FRA
alt-svc
h3=":443"; ma=86400
icon.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/icon/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/icon/icon.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f0310c1ab27ea2a728f8d5adcc98460dfe171f20e96f03e43593338eda99acd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64513063-a11"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lr41rnqT67hC%2FmfjjfEBtD%2BpsaD0yk72g5rqDmlmRCluvS02JjCRjqPoztYOyNBjU9iKuYQ0oNLc8FXt%2FatRBGrQOY0Unsqs2ce6jjNVe9RvUYgRx%2FgWM6Fi42j%2Bufa0MAV97oO2AW47xRvyiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade1ebbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_icon.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		409 B
478 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_icon.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9369f01b809edd4c69b4b8dbe586c6fa0fd737e801d485b11f3ba0a01518e43b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
401679
etag
W/"6455b665-199"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ip0BqhrtyIblvkct86YhKf%2FxNoGJhlLu7qIvakTvIMLjRfqkZGFn8AcHj3q5vmDRM%2FqtMtlYg5jczNZqoUx5k2txtfh%2FgBuLeUJKghirPzzPkF1MdmzS6yHGYIhXjr6o25X9zQA3fepEDKgatw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade2fbbd7-FRA
alt-svc
h3=":443"; ma=86400
image.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/image/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/image/image.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c054c233ba0597c8d83a9f54fa67bf318ec262c588d2086ac4245f2d16a1ea4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
401679
etag
W/"64513063-1cec"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E1aD1XrogvrLT%2FELs7tja%2BpHwoCU2RJlepuga47sSyf5h8SVyEHC2W%2FljRc1TDYGXtcH4KAwo%2FkBuKIDX%2FhyTfyA8q%2FNPn%2FqdmBl%2FX8PyuPCHiume60Hhg7oL4OqH3M%2BdOxyx4loYb79X%2BwXQA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade1dbbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_image.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		1 KB
556 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_image.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
444a2d579e0730495e430d37ba6f4aa4dde136665b5a565749462dfdbf4f207a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"6455b665-496"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9SFadBOdZIqTF8TkKve9jhGdmP8QzI4Y4XfAsjbwQakuKy6Y8jwbMcUNraYyCa5kmSPY2SS%2FWrWk4EPWGpJ%2B6X8yiRTtg%2Btlcl2ahioJA6C2T6GJcPq3wg13XAPPHu8iPShow8EtSqD0ScTXig%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade01bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_grids.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_grids.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d016509bcdceb392c3b04f2b3691b706b35c649046fe249b2dd9efc14b9e26b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"6455b665-1468"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eAPpfuXo6Pv42K2rIswfiSF3GABPs9RJJmIfeJ7YkLK4DjTtu2z9dbh54b9RMITHvuQ3jAaz4kmILbcvBe1K44okja7RsQ%2BqP%2BCcmnDzC4AaekQi8G7%2BWwECnALqVWYTH3kSOj%2FwiS4d7bOOEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddaddfebbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_item_grid.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		374 B
702 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_item_grid.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d9ccc96ded6b593317eced6f7dcf8b6a49cb2d7f9632d7b64df1bee868eac11

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
580450
etag
W/"6455b665-176"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jHQgNdmuqimOz%2FGYb%2B0aX7NXsiMknfzLIrcZdfSiFjgB9r1%2BqQw6%2BY3oP%2BvQa9Ne%2F7esdkEFcEkjyt4PDF%2BnOm1RW8OqU6YYGChKq5MAFz6ip5Zh2N1LLU8%2FY0yppCWWpG5oqpOQ6y8Ld0XHLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade03bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_posts_grid.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		366 B
483 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_posts_grid.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b243ae266676dccee611c6ed9eff868b5c1425110010164b31fa120c1fbf26b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2757911
etag
W/"6455b665-16e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wsnh6bFT6WE5MeXDKnXw6CKWmj9vL1P7e%2Fd6KgHeYfK0mHbaaBVwZJ8pIn6N%2Bi8fu4OmJOE6NS5vusK%2FxLroBW2Smu3KGqQJmcV3Qc8cejEe7c5JpMBrlJDnvHNWsQ1auR7WizfoB5iUQxSGJw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade06bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_social_profiles.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		472 B
496 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_social_profiles.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d489ed7659a9807cebb71e700fb6ae6ae8b8be566ea5d116be3c4470f57cf1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"6455b665-1d8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lrA1tmnVC7jCo1Z4BUVq8Vam7tBF7ichBSMobXyO%2B5sC5pbnZ%2FXDozw3BkWJz3m2yOasArpKod%2BASI6A4oufAQnBzGARda7VfrUq04HkRztO%2FpSNNkUK%2B1nybXe0CI4jSGtsQoHbtnROPKnGrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade34bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_tab_slider.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		5 KB
923 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_tab_slider.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
95965900d54c7e7f0ca243ae8770ed860f2eded07a9a2e873e29cc4c44ab486c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"6455b665-1285"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5QnRDTjhrD95b%2FckcAR64U72TQQ87M3i1%2F80PgjsdOlRIGGvboU1BknuMb93WZnP0nPpvJQ1I6YEMMB76sEb3PGz%2BRQMDAPYUN%2BfOrh6Ui9y3dQYopVgzWXteHSbJgiE2V%2Fum3cF5Mcyf38jFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade33bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_textblock.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		52 B
358 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_textblock.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c5db6ce4dc5dd7260f21f7fcde1b035cfcca54224da6b394cf15e97096d8c80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2757911
etag
W/"6455b665-34"
vary
Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o4lTtvABVxwB%2FoiWRu0EDeBUzFeVkGPNMGoX2cuA8lTwVdFbZYCKCAvPTJs8UOTQDUesiTnG3nrP8PYSaXDw5T64YaG3qpqLinijVUwhuKdsNZw4OfvHiN7OWYxW0rKH1tGDnvyXd%2FC6Zdss8g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade30bbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_columns.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		660 B
567 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_columns.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
23c18d5450819b3f10a57f7ba33819719dafea8daef0bf4f4c81cb467dc71c89

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"6455b665-294"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zEcqhug5oUxLI50Av%2B3%2FvR5UYLstySpymKXGXjJAr%2BKSQ3Q%2FFLR8BQFnfGFufyXtSOAn52gaewWwGr6y3BTq%2BAwac0Vm6ITOK%2BolPsKbgu0udLKEgcQ8a29g1FsmbJ38N17AbOzty7obfPmhnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade2cbbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_section.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		3 KB
734 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_section.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
715b3f8974434ad1f23845b14088738f2d3d484b77a510559e022ec3ad592216

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2757911
etag
W/"6455b665-b6d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hj7bDxVxwu8%2FyCG%2BTAhO34PdCaCkG7QZxJPGf5KqTPQpMLyPl0r%2F5Cm7XPG2zg824lQhsZi258C5PNryw3UzHVCM2EcrVVZjDm0qmKR7lxWShpQxremCvPcON6jLh2OlQklvDQcgWnfENLO20g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade0ebbd7-FRA
alt-svc
h3=":443"; ma=86400
lottie.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/css/ 		936 B
569 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/css/lottie.css?ver=1.2.9
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cb59666c173ea6887d2c29f37c3d2c5ac95d648aad9ad6493a9247af3215192

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2207491
etag
W/"64117054-3a8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AQk8%2Bs8If%2Faj0d6b6sP%2BiRozHH2ofWVVc4K62SlQcsSyJA0n2lkUXMv%2FplUpOjk%2BmMd6auFqeLCkXf0t8sB9VJ7%2Fi4HKbv%2B9zJmItkV6dt6NUxXD3ofH6s3w6EPmeyj%2FVZMOeEuDqRBPM6bBJg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade2ebbd7-FRA
alt-svc
h3=":443"; ma=86400
blog.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/blog/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/blog/blog.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1049fae50c8abfe96ebcf379914f9c2691aaeab24ccdc9654acf9930fda7a4bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64513063-5525"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IbRPnVRkVX8yJRoIWPW1sTovaoIhWgEk8Auos8nGGtK92UKJWBU02Oa7Y00fYgD866JCEqnNdz%2BaGMB4CY33iimpLuvLkCqC1KoHogaTysuyqZWGEtUtWH6BWTSFgKO3BtUiYYI4qGdnig1RQA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade38bbd7-FRA
alt-svc
h3=":443"; ma=86400
postslider.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/postslider/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/postslider/postslider.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec595c4c1f819f1b18211993b250c2deb88918d06db5b8292f2de9eda0cbd83a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55476
etag
W/"64513063-1004"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WNLe1siDle66c%2FIWcV98yDifi7F57%2FJ94%2FXMu0RlvOk0SfFYtRvG9N4ZYny2wThFmEwWpsXVUCsS7kkGcyKb7XhqSxfehMLzvxFvYA15iqi9h2tyZ3NllEgF0bZx0bW1wjpUhPE1uf8hT2LKqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade23bbd7-FRA
alt-svc
h3=":443"; ma=86400
comments.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/comments/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/comments/comments.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cacbbb7f3cef11f7c7285558291685348abab2396fc8da6ef1388792942cb724

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64513063-160a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5P2l%2B3nziiKu4kIFS4vUSOsrCED76dgCnwhxr2gIwWwvtKInK0U9LwuOJhEskmalq4CgOAqR25H4Tb%2F%2BWd9f9FZaQsdkFLLoIkm%2F5hXkY23ZHen4L7OsGZ15Vwi3%2B%2FjjtokO9dBh%2FOOhUWczvg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade25bbd7-FRA
alt-svc
h3=":443"; ma=86400
slideshow.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/ 		14 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/slideshow.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7082f515e51ca981be0d22e9647f586770d6cba06de2f73d3d29c47d60918758

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
948008
etag
W/"64513063-367e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J833bwVgC4YcJw1qtoEMkmlesAD27eI6JN4wCAJYaeGjejLd6feWUf8glAypWi0wA5HbwFO8N%2F0cFY1xCgGyd2mSTwEBw%2F8JQUzQ7o2K9F2WNOeudK%2FCNQkZY87%2F1cgUDj5ZtukL4tqXV6JqbA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade11bbd7-FRA
alt-svc
h3=":443"; ma=86400
gallery.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/gallery.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad664e38b3726ad7583729d98cbc9cdf4200bb8a9f7d5fd2edee2c164275e98a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
948008
etag
W/"64513063-f2d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PQYgH833%2FAOARVcgKAThaGDICckoLGNatb%2FMZ7y4yz%2FNIZUnEe0xSba23l9F35eWH0ovg3RPDwMWiKnCPFmhDd8J8lidcO4oD3TfkBE9wExyi2WtAmLz6l6Hb5%2BO8fwr8CidUt%2Bc5J9NaX3XxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade19bbd7-FRA
alt-svc
h3=":443"; ma=86400
masonry_entries.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/ 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/masonry_entries.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1b5e616447d7dd30bb411495b4d2772e6a13f9dbfe917a7211dd8f367cd87bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2757911
etag
W/"64513063-51e8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uxlcSQ5aEhTy8dYPlzsrjXPIaAGG%2FvlgbvBXz4HVVyR7OicfLtDu12IzSC3TfrmAiab%2FtNYjHcIdgzr6NFuEIIFBegmKl5Sg0EZNkv0tCTz%2B2cGqZMOmUXmnx%2B3KAxsIr3sgol5oYLp7jm%2FPqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade16bbd7-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-site-preloader.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		2 KB
982 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/avia-snippet-site-preloader.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bcddae7c91da7bd97a182b850f395405f8345e360f631b475ecf09dfe1068dd4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64513062-858"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kXntstOH0hgBnFTW3mRabag8gqf4dgMvh5gEDcFEeie6qBWDrHW9CXJidCkoia9dOVs3YJ0vJR8qvz%2F0hCYqDJzDAbWJmcBSMi86l9DVPfT33KJBBjFkdNynWE7TjjqzVpvFbmKRFLmdX5qQtw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade17bbd7-FRA
alt-svc
h3=":443"; ma=86400
slideshow_fullsize.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow_fullsize/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow_fullsize/slideshow_fullsize.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd09b4ba242a8b4e112ac76ce830dd343409d09e39815b24801672c68e46b311

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64513063-1a1c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qMom4Xj113KZBR0p%2FII7miWcUZwXBVhArgacU25n9b2un49X1EhpxM6EGyv91JeohmuUIPF5JKlxSu%2BPEG1JTHF8nQD2lC5DvYhpP66o%2FCKmnq9W96wVSm4k6Kuw%2Fwm2J%2F%2FDdKaPcz3oCPw2Nw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade24bbd7-FRA
alt-svc
h3=":443"; ma=86400
social_share.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/social_share/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/social_share/social_share.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ee6bd4bd09278d65d934110778277ff7f43039d2625930ed3c657049fa00475

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
948008
etag
W/"64513063-26e7"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YOoB1nHx9jC2CPbMBpJmgILcFsRuywbxrMXD8E%2FoB5%2Bdyx4g4wOmEWjoVaA9E7RzRLxEQ5kE4in3co910%2BOWdYoasq98oXTP5I7eLNV8Ob5u7Vto%2BfeYkOoJSJwxoQxWgLC41IE9o4sqzarxCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade2dbbd7-FRA
alt-svc
h3=":443"; ma=86400
tabs.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/tabs.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ecdc3e1733b4465431016227c1c31cd75bb931a284b9728a4478217e8a57eee0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
580450
etag
W/"64513063-e6b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GccSXnFUJkT37KygAc04PfSAVbPfTGiCVTDkMoXYkolc0sb1LZcNT760fhVLCyxOXT81jNcZ%2BuWAK2q7kHjMfd2lVq4MNmTF6sGf8T0UbEpfjIEFWlJP%2BM3SfCYBeKjqSdb%2FBRukFVzWtVFISA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade26bbd7-FRA
alt-svc
h3=":443"; ma=86400
testimonials.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/testimonials.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1bd651cea184b004cb55a78dbfeabd2768ce75576af8114f4185b640520c06a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1791654
etag
W/"64513063-2373"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jI%2F11UQW2PNkbRgb4KA1vJbd3krc8Q22aOn3YLpOM73fxdpyClfQ8ZXPIqrvh8e5bieKZhWbfITH4Gli5RAaq9sdWs3MCalL53H8mEAAqU2xwMjfWXKw063gQvGncqFg8wKJUvNWqxokn3aK0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade21bbd7-FRA
alt-svc
h3=":443"; ma=86400
toggles.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/toggles.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b438219488cb104cc30a2e5ce6dc29a0bc3fa7ebe6d101d7fab1feec1952b06

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64513063-1397"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DQW5kHVhR3NeWh6Qm78zOiP1s%2BfouaDkdxzm3BHWzuP%2F%2F3WKLTVWGqs%2ByB6nfG7%2BSNzc2v3wXCRihU34DC08Qt%2BzPsZy9TpKTFVxMWotuJOveWopLpf%2BuLzpwiytctASFx7kcQq4oN%2B8zMICIg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade32bbd7-FRA
alt-svc
h3=":443"; ma=86400
video.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/ 		2 KB
867 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/video.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5ec3b8830ed916eebffd15f4518f9a87333b50c3b0c10d108ed239b795c0b2a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64513063-785"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iD5PzC21LT68mvVyi9wV4mOLNEG10GvnXP9i8uXrXVoI14nfPfZxSak2njtUpqw8U6Aopvn5yBFG6ENx0Ok58pZvyvtAVBJgL1m8n14sQhjqQd0e4uZKmXScmaJD1CVj0rbp9VrW9XuG39Rqng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade22bbd7-FRA
alt-svc
h3=":443"; ma=86400
style.min.css
adlumin.wpenginepowered.com/wp-includes/css/dist/block-library/ 		95 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-includes/css/dist/block-library/style.min.css?ver=6.2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 12 Apr 2023 20:18:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
401679
etag
W/"6437121c-17ced"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xzcklAkQ5v0mbrdK58gIm9uPuCBuNqIKpGf%2Br4pzzXLQY3ZKinqT6hMxao709%2FHoLMc5g1LjyqMET6iwr1zLilWK6w8Zl26gWuWSOFOhAPIyHuCyII9Zg75ZNoJzDu2xEk8XhiHKARRz89RDtQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade1cbbd7-FRA
alt-svc
h3=":443"; ma=86400
shortcodes.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		45 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/shortcodes.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
36c200dc8adfd56fd5d1ca02e882d27ea1921e4ae06e88da926df6148c068d80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
401679
etag
W/"64513062-b2de"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2B0%2BqWmfCapGKlbjfDEtvkIwuHEU1PTNSTT9HXSS%2FXR4CBlhFqH1HcjlDLdon%2F4uAmswgLD4wc47vfTbZCepSTjwHvduIyNivw%2FH8rEmZIFegAkOoM42je7DurybZUJGYof7lRJa%2F%2B6gGKJbxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade1bbbd7-FRA
alt-svc
h3=":443"; ma=86400
ep_shortcodes.css
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/css/ep_shortcodes.css?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
203a8a704d1c184b461f12e49f4ef3374f2a54af046381826f90739bf67c13dc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2757911
etag
W/"6455b665-16ea"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FNjQNouDRopaMHaYO6GT9wFkkyvgs7oWODaWSxLKxTIj1KUvonlkr%2FxFXTSEy8N4cl1wQq0r5Ho5WIjzBwoG1kgKlOYoZ%2FptbrNErZD6VLA97yT%2FtnJH7NRXQprIT%2B1oICNLg8qZbF1cdNX6mw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade35bbd7-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-fold-unfold.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/avia-snippet-fold-unfold.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
073a6079fa5c55602c328617cae71c68556c5ee1d5980ac51aab8bba61ffd929

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64513062-be8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KgFTx33hz2myR2i4P8xyV53Xjr%2BwUA%2BLZByepC0yAgU25X8oL84TDIMqe3%2BchBu4dkTZ7R7%2FIMbeGEueJk3R3EfSY2VkMyXCianheId8K8I%2FFHpwfA2jf0DVuxzcazEApqszjVoRK3Ak5tKq9g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade1fbbd7-FRA
alt-svc
h3=":443"; ma=86400
magnific-popup.min.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/magnific-popup.min.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
73d6e5d1826e94ad196ca526bf3e0a373c3309520bb2b7fd4c2fb43d0c259466

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
948008
etag
W/"64513063-1470"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O%2BXb4m%2B1XgxpfzgQ1wHVuraieroKtlaqBp42f2ahAxqN9XMMBDDs597i%2B5vSxMnefxDR88teuSirhCaun9JIg2CfWVIXGmOo0Hh0NVrWGT1zUlC5NZzx6Js1OhkkcGlEku3eIZ93Cd9izEjyjA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade20bbd7-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-lightbox.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/avia-snippet-lightbox.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0297edafcd54f53621088094296941c6a77cfb019026eee169349f32ed7af4da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
948008
etag
W/"64513062-e6e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R37nY2tXbwkaBQvTQBcJ978EjSNsld%2BK88KVvqNph2T78rCmP%2BbkIzofQT3qpoxmjvyZpD9e03fAUoBnJZl5KHfu5JUKc9rUg5CTnn5eiLg5EHrNyzuej1fUWXBuE41Aw3nzvPHN2nfsrqdrQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade0fbbd7-FRA
alt-svc
h3=":443"; ma=86400
adlumin.css
adlumin.wpenginepowered.com/wp-content/uploads/dynamic_avia/ 		145 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/dynamic_avia/adlumin.css?ver=64653f035dffe
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a54ad83059bb321221bdac36b08d6806f4de4d5db1695080ffdd80815205c29

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 17 May 2023 20:54:27 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64653f03-2427b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9bJqutrCBHNpPg92vsB9DW17547zMAKl%2FyvizlmXGYLkhMBXCqh0BBxswfJybY4EI5PbKilrWHZC7kVUup9%2FtvLUd6b0zZaAOlteFvxo4Y2iqAfXuDT0VVjqIl0Ea3o%2Bp0WFyppILbsdomM%2Bdg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade27bbd7-FRA
alt-svc
h3=":443"; ma=86400
custom.css
adlumin.wpenginepowered.com/wp-content/themes/enfold/css/ 		707 B
628 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/css/custom.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb04c84b625847684f6b428b2acc5772b549e12d18acf8ca9b6a356cdb661fbc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
3053995
etag
W/"64513062-2c3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V%2FkyDtxQTv3mDpwElq4Q2RnZKavuGP4P2bjUlzfFq86aV7rmx2aV9n4q4A0HGgbJMR8kokz3v8TV0ARP7bhL2B1Rt2VQKPnc9TJwuUb3nFnhv4%2BFwjooiZuWUGLNKWxbZkKqVBaqFEi68Oqnvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade10bbd7-FRA
alt-svc
h3=":443"; ma=86400
style.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/ 		127 B
403 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/style.css?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
626a1b45dfb726aa02dba6eb4015b75a221174f91f5371b913a60c3a86b92424

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64117050-7f"
vary
Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RJd9nq8jyWXrOVDG1QtUoMrULSX1jSRETX3bos%2FaENLak2kFj8t3DZrmg7TaXOK6iSCE3xO9LpBg7dejdUd49EUFeVphBXV%2FNq8vVghQIesMMrZcyaIypHMeYH4C3WRhQgN%2FjpwiCMNNKh9agg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade15bbd7-FRA
alt-svc
h3=":443"; ma=86400
offsets.css
adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/ 		46 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/offsets.css?ver=0.0.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9ba04e90ac17399077da403dcec63d6cd544ea42152828539571c0b5caccfea

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64117055-b955"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d%2F%2BZnEjBAnYDYINlefgUgCur%2F1GiEVj7yJUa6uFIr%2FUcNQpGINsyyjHz0%2BI271rCuslUPRaRlWPbJCkORClsj0NXs6vhc7c6nky5VFwneRShQYvQbn%2BJssz4b7UEl8CR4b7YGqOqIQXU7iTArg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade2bbbd7-FRA
alt-svc
h3=":443"; ma=86400
gutenberg.css
adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/ 		12 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/punch-core/assets/css/gutenberg.css?ver=0.0.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
112a239ebcf5597c720d13075140da5250b8b33a8cbd07a9b6f46e455a112e82

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6839
etag
W/"64117054-2f0f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FCeWhdp%2Fh%2BBZDRmHurbfxrujLSzc9obF2h6KrZZy373AYPwCjOFwTUXaGX79oZhj20qMGyVBdr0m6IDVvqQlm7XXxK%2BtW0T%2BDaQ6Fn5xTs6nCe%2BIHkGwNG7H49CKtSc9eJX4Ip7IA69rxFRtmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade37bbd7-FRA
alt-svc
h3=":443"; ma=86400
main.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		54 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/main.css?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7668e9a8ee3f3506685b2269a26f589ef6ada1fdea931242003f1e7db5ddc152

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
948008
etag
W/"64117050-d66f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9syXRYSPpRFMFjqAy%2FXLtuwqdUafTWRG4C%2BO4UQVFk1wO6sb46lXiZQcpuI2Xvm1ebYOL2MpYm%2Fk3Ch%2Bq59OCgwfuLd5yd%2B%2Fkb33qMRi%2BKP%2BSTDSPfol4J569mA2DzzvpZ%2BC3syRjPBTdKLOqg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade31bbd7-FRA
alt-svc
h3=":443"; ma=86400
single-common.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/single-common.css?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef99bfee0210da514c96937252ea791f0a0552e0aaf5e18513221bec3cd10cca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55476
etag
W/"64117050-1d54"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FdnZStZJ1Ga%2B1Lj1fiqBJHs5scGSN4G2IK6mjpigpwtCURX%2FSt3RKHGJzkTD63n8%2BJb5YX7TOyp4crkb%2BiWdZgs7AHsxME8Qa5T0iqnFkk55caOcTYvjs445pCikBosmdPBSJi0O%2FoScLQbt%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade12bbd7-FRA
alt-svc
h3=":443"; ma=86400
gutenberg.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		330 B
542 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/gutenberg.css?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a6cc7acf572850a7396cd004598b7d9585fc4cb4256eedcf36472df9f63c24b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55476
etag
W/"64117051-14a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n1fzU%2BJ4AtDDCC%2BKfXtwu2r2N7B1uaKrHdXMuiVIVva7xXP6qhtmSCaDHUD%2B4O%2FKATWIIQ7qz2OWl3O8LXA8Cef%2BXc5g4X48iswVz2dpFC8i6OigP3hTysOjKkzv6NBAcrFqnMRmHhBcKQT9XQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade28bbd7-FRA
alt-svc
h3=":443"; ma=86400
avia-js.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-js.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
99e15e21fe8fead546f6621fbc85685a0b22d77da44231a7a50fdf508731caf9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
3053995
etag
W/"64513063-839"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F3qHmiu3%2B08DRp7DneLMaN6NsBeRoAcHFP%2BU1m65cYb8lrUMw%2BS6HQPLyg08aKHPhgKrmURIPWUV01154wsBMnOTjCoaCdMKjS%2B%2FrmyOrqJh%2FSrwbeIgfFyghtdRG%2F3%2F5ZMMpjKCl7p0O4afQA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade3abbd7-FRA
alt-svc
h3=":443"; ma=86400
avia-compat.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-compat.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f0aa888761e5eef0bf608f1c73787ae9a925a762932ba393ebd387627a0ad897

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
633139
etag
W/"64513063-8ed"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HC1EJvkugfmGJ1J%2FUAqcXFNKPiw9U3W63n8tYPkMK6ZN7%2B713OfrdAoebeylOmTBzGModw6AiUsMv74FUTWDg4EbqmUwxuUz6oXde71cWMPQJCLvuexauHvKW13JP60a74AVSU5eHk12UhTzkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddade3bbbd7-FRA
alt-svc
h3=":443"; ma=86400
css2
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Manrope:wght@400;700&display=swap&family=Open+Sans:ital,wght@0,300;0,400;1,300&display=swap
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2380e58b96bbcc7a29d91a0b6cc4b6c9e78294b4eeb2b707670a22ae553bac07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 02:11:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 07 Jun 2023 02:11:49 GMT
PowerDrop-A-New-Insidious-PowerShell-ScriptBlog-Post.jpg
adlumin.wpenginepowered.com/wp-content/uploads/ 		195 KB
196 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/PowerDrop-A-New-Insidious-PowerShell-ScriptBlog-Post.jpg
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb6d369417c05fcafb12428480c1df5c3662aae9982339e8d4228a2171ac8422

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Jun 2023 13:55:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647de96b-30d33"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MYhfmEdpqijoya6EpAcySVfgvoE5qbn2hr7ZyRH7u4maWAoen4uVQUmja6DQwWhqGCkgsKVaAUy%2BmoVbqIG7rBREgQVE4dfoCxXWor6YzvC1iN3WAnrRKA2P1e2hVtAqewf6KPdStG%2Fvzs4TaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b442c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
199987
1.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/1.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a73f82214e6aa9bd554f0c894fa57d7fe152170c7f4157d610614d088137a41d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51e9-7035"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zkZJyoYryPcvUqweTRlhRmcmJX0Hn%2BKQ72PMqbMhzbjVt0ep8ye8jj2BVNEnmpX3fCsSrnB1yk5JvYDmSNSDjrolO7bgTz1DFIlKlkFZbeh6LloQTPruF%2Fc0kKacTAQfBg8bZx2mDuGtJKuWwg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b452c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
28725
2.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		330 KB
330 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/2.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
33d48d0f2713a68436e4e2d8726adc2541c2950e648b88c50c7bcc4d0c788bdf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ea-52697"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ihdQRde12sHM01aIapewgczbMAMVPo5rAQVLegUEV7WNqi1uc5JHOrYARkt7zdtglyCPO5%2Beukum2V7DDduow067%2FFRLHkK4DLT8%2FtC7r%2BxfUJQUrFhSyTxW77x6RPSy6d58gcCr2kdliWfRgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b462c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
337559
3.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/3.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4977c0573a102dbccc34e80e55c4822d4adefd5361c0095a45e2f28443c49d53

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ed-142c9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GButVz5djqc%2FVAc1XsjXI0uHWLhHlwPgu7vFhhvzQs5iIj3c8qfpY8WzVpM%2FsqJSftLIYz5PGyeYRqYqHk2xXKuNdaSlijKVCEd9wibckwrkmeWcA2CMoINj456AlQk8Wmzi0VMEdc5uLxwTQA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b472c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
82633
4.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		97 KB
97 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/4.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ec7c042190a170b4826bb36099933781563c611bcaaa5a5e9d406c63124d699

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ee-182c2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MiQcTiK%2FdV23yiv0UPqXW20epRlbleLl%2FDepxcLRQPl2CF6k2AoGcgOoRHS%2BXL1407ctvHtTkkEq2YoVwBJigM6G%2BGOT8jD8rP3RFI9zxyGX1a5DSwJMAaxzgBGsD8M2%2FYmntmMdjoQz2%2BsNog%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b482c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
99010
5.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		173 KB
174 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/5.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c1c1e89fcccad125bb71e5e795545e1c19735ee63cfcb4e2df99e19cc14e8d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51ef-2b5c7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JUyYjiZ32EXD7ivK%2BQhbrQ9y9CFBSUiHobMZcQEB4Jju3Mu2rQWaAV9UnpgKccjn8NNA0cibYWHRmuTzp4v2Nua7yC7c1W0RWFwGk9t0pByVVtfh2Qg5IIv%2BnRq%2Bry5HZ5lZrYAvIIuhUBfhdg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b492c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
177607
6.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		342 KB
342 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/6.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1293e61be98cca98a373d776cff9b16a8637ea75e273e8aaf90a3b3b372705bb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51f2-55759"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s%2BgmN53iLOSoIWH83rGb%2BejBNukpY2wlZ%2FJYkMcQMmynpTt3Qa%2BW8vYNLzxBiApI1dRc2uMkf5LLMLaFSY3tPVGWQynVraXgtnx9C3NvnqWgKyipt6BWd6gWIFCJQTn7biG2U0gE9GnF%2BvGCyA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b4a2c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
350041
7.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		782 KB
783 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/7.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfd63a3670df6dabce2d1982ee7e058d763cb2fc3fdf4922fc8df7ebad69b151

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51f5-c3951"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8RiHJVHVXUbh7n0uTmSGbZk1YakHc%2FeM2Af%2Fc41z1aTt%2BnHePUbuxwmFdT5omO%2BUUsSuBYgx3UVBikwsQjyJy8x8H4nthIeM0v9nfqe94T3T9bjHxEunUKU0XyclrfrYXJC%2FBAqj6Jxat3%2BAGw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b4c2c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
801105
8.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		483 KB
484 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/8.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0543d1876bd859425bd8984ac11f0eac32834426eedc15899cb277b84511fd9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:57 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51f9-78c9b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UdIVVL428agrGU8mcxHwL2jJf2dJiTp%2B5zJRKNhaFezWW74LimLVgVxPlCD%2FO8OR5X9RlNty0BhBoAZ24LOTklsiozYG8MNudZ4%2BHMDD8wwB%2Bskva2q4pbknL%2FAu3OgPA94z5IbtgQwinjOOTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b4d2c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
494747
9.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		57 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/9.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae892a0647d1a73896aea016960a1060fec53ac0898a51d5d95d0fe169bc32e9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:32:59 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51fb-e3b6"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2S8slqL24PHDjv7UKg1YaqbexHehYuFC8VddHeHYYGMjEjWYehN0tLnPLIOmluzEt%2B46ym9FlNuEI7ZbAzFgrECA9Q1cHT6cMfZAS1eSPkiZaWv5JkmspnOsVBB9vtoSAc3RbOh8vSe%2BGr3LFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b4f2c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
58294
10.png
adlumin.wpenginepowered.com/wp-content/uploads/ 		443 KB
444 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/10.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ce14806bc51adaa71c9b8832f7c57f18ca8cbfea36fbf94ddf5eec194182ac9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Fri, 02 Jun 2023 20:33:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"647a51fd-6ecfa"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=brf1gzq1jIAe144a6b8kYtqjl2imYzrXZkzIcC1cDsYiY2Sz%2Bg1EIBRhWuhLW7aJsVsCKMMsEa5x87Jy61T3yafvVUFvc6jn9itObH8x4epN1kd5hlcFNqIx5g5LFQA7D0lvaImbQ%2F25oQTvUg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b502c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
453882
numbers.js
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/dist/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/dist/numbers.js?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
af8586fb875a51c0b7a6fdf14d75d3ddf0497771a461d6e852c5375da7f1249a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
580450
etag
W/"64117050-127e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8eu9RFUzxpnxUPDUvTzK7QUuGAQkNGguYBVwpPPz7yrVOsPzSvZN4u2%2F9rYlML8TfvKUJVK%2BCTRnNxOoRCzWIcHJGzYD6zi0pUlrNKFUNMMNpk2nhEgLE85Trf8s6ax8ZOW1NCRfU6xK%2BslMkw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb3e71bbd7-FRA
alt-svc
h3=":443"; ma=86400
flickity.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		53 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f559133e795138a9e4836a6c22f45a9192d8f60bc51d58648840e8150c760a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2717254
etag
W/"6455b665-d357"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wtHHblIfu3mri%2Bwfesi5gN4ChqEpr3UQXI5Ivj4ZTIa16XjhAV16Lkb1TVCilVxty6AFLLXPYs362Wwhi3eENlSvJfU4YUR1BWxkSlKSB1bQBkUbhqo9r0O9LPGW9NvYvsnO4lIhWWpyQrQE6g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb3e72bbd7-FRA
alt-svc
h3=":443"; ma=86400
flickity-fade.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-fade.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d637dae1aa80d0dd5ba985ac364cf9d541e3152949a4f234c010319c8e1f0a02

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
554489
etag
W/"6455b665-1c2e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oxjqDf372YQdbmK5f9cZqKozoHiEN879u6bdZcRT2vWajCEVrEyoR22kuw2ZLoQsGGtgjuSCVLjt%2Biqo8aKV%2FMKXyUzW6fO765jM%2F1ZvZWuOcqcc7RJdb3YdabOSI1ICY%2Fzy5m0h1%2FWLNA3APQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b192c52-FRA
alt-svc
h3=":443"; ma=86400
enquire.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/enquire.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfb99dee1e029d51d6cfb672d847929890b1585402de17f5ed092edd72a688b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
99740
etag
W/"6455b665-c2b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dLy1uMnT1na725dwJfjOtxCDHhKGVaJ%2FZ8Y8vLqipYRGcC2cYaQXML5qHDApNbDCvVg%2B0wYt1Z6pNyI5WACKRKPI3UjfNkD5diRUuYYsphoWI75b0JwPsTcf7z9OTJNXNJaO4CuahaeayUAy%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b1a2c52-FRA
alt-svc
h3=":443"; ma=86400
flickity-sync.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-sync.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
29ed674055ed51be81f36c84c23c87a911775bcae6f8d158f4ec43b6f2bd606b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
645280
etag
W/"6455b665-c85"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RlcayFL6sfBxbElZ0ygnJWbhNWtMZFsCp2w8l%2F1qKfvydSnC2imTEogQg5YOCLwyZZ8oU%2Fvt5Smvk39dpqqwkgAAXGy1DTgpedHnzwa56VwxO55G5wt1WX7Cg6X5X7irD840sTjMlQkMLnaMxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b1b2c52-FRA
alt-svc
h3=":443"; ma=86400
flickity-as-nav-for.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-as-nav-for.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
645c85c47a096414f80fb2a589c4086ea33b22204c08c2c2db86f45d3bda9ad6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
397876
etag
W/"6455b665-101a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V%2BbmKV74LnyVYnmCP5bUv3cNQOFRxGJ%2FqV8B74SpDXtahe5B5XQzQs12KTaNNpbxEgXphCNMAHRiJbUPq8ldcK7qIGVUeCGSGVUc6hzlvGBFerCfd1W5%2Fd5%2FX3TZ%2FAnYa%2FwZKxusbTMU4huDxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b1c2c52-FRA
alt-svc
h3=":443"; ma=86400
flickity-prev-next.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		644 B
767 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-prev-next.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d77f2bc29b21dcd3e2656f073dd09cc1a658da77bd8d9ab0fcefda0a21fa7fb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
554489
etag
W/"6455b665-284"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GIlo5C0AiZAv0Dahiouj%2FiO%2BkRWGkHaCxTFRfsXBpLgqGjjh%2BOQXm5r3jQOvUbmIWda%2FuBhnQMrT0WuvnMe%2B4KJvKMDMlZAKzb2n6A4brK5mZ9IveSqlEhkzQhW%2FicNVqYFa9hGiQ2JANxSqog%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b1e2c52-FRA
alt-svc
h3=":443"; ma=86400
flickity-hash.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/dist/flickity-hash.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
200d1514b6b8b14cec7f01edbe31a348ca8716022772c1936facf61a338aef0c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
99739
etag
W/"6455b665-b58"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m5jmTZVK5JpBPnataWP0%2FITih4HruJ%2Bbin570cqo1C8sxmXyv5pm8XfC4hT%2FhhxPVN1YxamL0pktu3EWZYoN6eeJwENwP5mXnjxbYJiO%2BpnFsswpECoq5Aj5%2FG5fVNVS%2FkC9Q2KBvZAoyyQKiw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b1f2c52-FRA
alt-svc
h3=":443"; ma=86400
jquery.min.js
adlumin.wpenginepowered.com/wp-includes/js/jquery/ 		88 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.3
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 12 Apr 2023 20:18:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6437121c-15ed7"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NMrHF2eL7wCOdg1hhUOjaw%2FInIdeDtZE1WNqhafG0isCoAqHz8ICiwlVe4e%2B34Tao1fvtkMTqmWV%2BKKqYHElWdDjrSUKDvt0IqtRAR9yge614vbm7tDcW1Uc9VqFSGNKrAnymRb1a5a8woGmpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b202c52-FRA
alt-svc
h3=":443"; ma=86400
ep_shortcodes.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		326 B
676 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_shortcodes.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de9dcd951b7dd88f17da2fd7a573b3bf63dd16c9ecada6b61a93acfba7fc299d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"6455b665-146"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1bne%2BYsqfamLERPyI%2Fz1mQ9J4cFpf99h5MVVQFnkZjM5dL5QOZKtFO%2FNdv%2BuvpL3F6FMYu1WlhXpJtGYx32OVecD0iLVDCMHTfxOj%2FBLti9QsbfnDzxMcOLTaxhv%2B5dsPvIId7ate%2BVx1cHCxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b212c52-FRA
alt-svc
h3=":443"; ma=86400
ep_flickity_slider.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		2 KB
941 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_flickity_slider.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcc8a30d38eeacb30158d0d90764bb7a725996874d5884b5017b10cc9ff14a34

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6455b665-750"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BtG7NtrAT1i83OeFaOBBo3XwZxEnoAsmgrerpG1JVHp%2FBjjYObWcipIT61OHwza5nkr0MgN1AQRiaILBvq4idNgA%2FVTBJ%2F7j%2BMu0Jf2KgHxybMpme6qxCg27dOUq6Kni3JTFFt5Z8tqYyQlTmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b232c52-FRA
alt-svc
h3=":443"; ma=86400
ep_item_grid.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		1 KB
907 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_item_grid.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfced0621406b56297852f394a4b93825c69defcd20ce9e67b439bea504405cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"6455b665-4d2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLfiyWXzOmy0pH1e5J2LnWHosqbl5PvljZvb4kkCwzXa0HrnMuTWc2vdj%2FDueRghi71L67syf05NGDSRkjqodkgTkEIRgHUZgNi71VFQ%2FL4pE8p%2Ff3DEtfHL58S3TNOAhm7Ct3FL1ZWOpY6%2B5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b242c52-FRA
alt-svc
h3=":443"; ma=86400
ep_posts_grid.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus/assets/js/ep_posts_grid.js?ver=0.1.9.61
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
288bbc61b1fd7bd02c2b83b541df031df382cefda06ff841f1649e5af83201fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sat, 06 May 2023 02:07:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6455b665-c5b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XEx7%2BRcOoOy30NcqZebJapOH9e5Si8rRtr3BXYI0SFFFEoKcYDPPoGqMEhFNOCJhhoLebHOc3qPJjLx867DXDyDH1vSjPoHO0DzAAJYfKFJ%2BGDAYyUPCOizcYL2XwQoNUHou1MFzrbj9AYXalw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b262c52-FRA
alt-svc
h3=":443"; ma=86400
lottie-web.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/dist/ 		246 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/dist/lottie-web.js?ver=1.2.9
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
41121032744ae3e098d01b42d02ee46b3daccb5f691d97c1bc0fe62a514fea28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64117055-3d85b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MyHpeq%2BNV%2Bj%2FCGX76HAQSzyb6TXkXGbaTdcqyxrVuT%2BTCq%2FZrwxHJcIJ2jW09atX3cG%2F%2F%2FstpYq4colSA4%2BH%2BQ5%2Fo%2FvtH4XVZzjc%2BfoQALoBIl2THen8wQJpldpQDIa%2BVSN3lnAoSCaYre46ow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b272c52-FRA
alt-svc
h3=":443"; ma=86400
lottie.js
adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/plugins/enfold-plus-lotties/assets/js/lottie.js?ver=1.2.9
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3832e82ea699d49c21735de895113445cc59f618fe265473a4bca421527844a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64117054-672"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gMo32NtQ%2BNDk7w2C%2F%2BJoXpAwrLfu6JcVkyoXoWGZwRp2HTkF%2B8UJ40oT6MCPdQ%2FLjFJv5V35H%2B%2BVb6vYf8f0FpBB%2BLv1zv07KNAqlGw%2FxZAaNtUgoL6mj1dgrIrDr0jVgmHUTVttNkVHPI3QFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b282c52-FRA
alt-svc
h3=":443"; ma=86400
waypoints.min.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/waypoints/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/waypoints/waypoints.min.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
083d39b7748a145d540f729bc5d7e75301a1aed0b943e69ef2fd5fca2acb6ef2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-2307"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fCAjqU51PzplV1Yt7MAQ%2BTJPNXGmqv%2BnJUVYyLWH4wcH7CNfIOUztFNpkpfRulLdTg7TXcXNzl8rQjRzzdU5unYKKklzzSP0vhU3Z0zKhG3aBE55nkLtlYEdkr1r%2Fdnb3FuEj%2BpC3xxnCIpKTA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b292c52-FRA
alt-svc
h3=":443"; ma=86400
avia.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		56 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f63669d5736e8a7e1cbc565d3fe5542cd740af555683ba036b081dde590e21fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-e1b6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AV%2BddpE0XvFgwPGUcp3LJhTmaBtwRXg5gT1EuRXJHL13ODE57NSTFMTkdkhRFznuYPqkTuIH7bSRyNp%2BgJJYb9u%2FUVPet7n8ezPEK7uMW8FjIDnuiz4Qj6GvlETiT3YhNUejLueR8AtrXSgx2g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b2a2c52-FRA
alt-svc
h3=":443"; ma=86400
shortcodes.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		45 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/shortcodes.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f09972b6d95a87c5ee3b1e96ddfaf98090fc4229df485fb868efe318644de756

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-b468"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=punEY%2B5yhRX888y%2BncLqd4QMpFfdMHm0jAVMhgGQ5mprR8jXDgZyI1ttulKkWEtZbSj03akecA0aJndw9We8XAKmBS1iuhqMTuV8R35mQpZzJlWgVqO3kVrU5Q%2FgOZ73VsjLagICCajoHI%2Brxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b2b2c52-FRA
alt-svc
h3=":443"; ma=86400
gallery.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/gallery/gallery.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6893c5cd767bf16f8814ae4b820a8996ed49895f2e9a59fe18a587c094fee8fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-136b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gZLnRQt%2B8XzRuBALoChI40BFghng65SUAST3TgBVbyPeUGuTLSnmwdSWM3n5uCk6kUangWonco9M5MDzTWH4n5UXpq%2F2PnJMeMWVc1HRLgvsW1dBw5zLHQO4TuDwRrLdpHknEMYSLFluKE5kdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b2d2c52-FRA
alt-svc
h3=":443"; ma=86400
isotope.min.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/portfolio/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/portfolio/isotope.min.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
11787a8b7542fbe98867b211d0e9cea087163816cd3ec38ed231bbc41dc38479

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-bfb9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BWCnQhuGAinIwiqnVdTdFIQ76wBPM1oPJR4LJzeGNB4fNtBRx7OvSmydEbXdM9eJSEZwtSek2BuGCayY%2BVZuchAt6zLCaX7bWSjXlHf%2FsUPD8xT5T8aq7EjA5dCMb4EngQIyEoL6lC%2Fmfr16TQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b2f2c52-FRA
alt-svc
h3=":443"; ma=86400
masonry_entries.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/masonry_entries/masonry_entries.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
315f0c14fd6545931f5a916462fb2f07d4b984731db6da38eb0a204097b9ffa8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"64513063-25b1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=27AO2yi%2Bd%2BM93ExFm8Rkf43gz%2F16ZMR6ankg7EE2qqmxNoM6%2BvUpOTbqFSUl%2FCoPprlUAMU2p6WYOZXfsWXZR50eGD3evtPykklPPHWIZQbpOdifNoS8AsO0VccdXMyFHnvLZrMqMA2i7mzaqg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b302c52-FRA
alt-svc
h3=":443"; ma=86400
slideshow.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/slideshow.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dbdcd13c7b6cefee26516ae098ea682009d06d6054007368b788312b5d03f6e6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"64513063-9199"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jo6tAEcCJg5XZ74oe5ZgueEW4L7NTPPe7QTUycT4CxjUEroOvkFu1MQquurGRdBQTdSuY7Kpip1seZlytr67FqEkGlsSzFPRd84NcbggUbpEWbfrUm0f3jrA8OM%2FE3nOv%2BFnz7d6C1boN3KqZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b312c52-FRA
alt-svc
h3=":443"; ma=86400
slideshow-video.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/slideshow/slideshow-video.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5c7eb7503144f6cd57bbddb0ad78d77bcad37d88ecf46585dd340a61449661b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-5cd6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rcSXM1mfXX3MD83m%2B6%2Fk5hWV3%2FBRaoEtShdJxeNMTOFh7IHo1iCSMs%2F73P%2BMHBOiN6MERiRk2A8UMgGGzQDQJ3bAbVmWHF31Xb14xEJbMJpDp%2BMOVWYDD82V8vQS7pHukJ2AI4Rib4cUaQcrPg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b322c52-FRA
alt-svc
h3=":443"; ma=86400
tabs.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/tabs/tabs.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f15165c519a5b39ca782e60dbc18b9d40f4c79ef56b39102ee91f2b8666792f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-ea3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pc5EO%2BK8wd1%2BxL80iiM%2BtqGYVbUfvfvTLvi9gP538sZUTXAgv0sdVK3e%2BWZgdEA%2FfDbO5qpmn62q%2FCCQimdQ%2BzNqLZvqHZIC4odm25WomM%2F3gfYRNgYd9g8Jb0trkL%2BYdIAJ6bcz9nQ3z2X%2B3w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b332c52-FRA
alt-svc
h3=":443"; ma=86400
testimonials.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/ 		709 B
784 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/testimonials/testimonials.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
42b0903c54be2539d57e2b47bcc2ce6970a484eaf1081d712ad40a637f567134

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-2c5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ky59IeWywAmVy%2FbYtOz6p%2FSUkA2aGd6kNf%2FidZDc4r95hPffIye%2BHGBVND3S9vCFoFx17NrGStHF76f0iie625sya8jB5RSFJyNYENjdxjpUHcOwOmreBN1bmNAKoSWj60Q%2B%2B%2BJM%2B9xrOYFvbA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b352c52-FRA
alt-svc
h3=":443"; ma=86400
toggles.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/toggles/toggles.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5db82c8597446f4cf4eb225f222a0249538d12ebefa8cc7d33833c062fd56ded

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-10c2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HHLzyRdKpkdMsNiZeq8TGMxbJLCeidhy2sON7nIYV%2FbrxIfLysKa7RaexEpSk69O9fVTHJO8LBYXFnNXTXv3qege2T21HPxRhN0N0dsNHqirX4uRjcBHXL9DKzoy%2B7%2BDt3Gv7aETxefD7Ht8IQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b372c52-FRA
alt-svc
h3=":443"; ma=86400
video.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/video/video.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d900c5255ac8e336b38606f70a16748693db8f6cd5a374f4af5ab1e37c9eb11

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"64513063-8fc"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KtBLiTQ2zpPWQhXqoTffCIJK1E80cJeMqFYdEGXgA5I0I1Tkg7palgAHWAwx4yDQIEs9F18%2BM8NrjNc7tdetBTgIaaiawKgqUdxE7JsbEfm1RIk%2Ff5t1tHe8iYNo9FD3H%2FL0sUGjtZDqDjXbpQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b382c52-FRA
alt-svc
h3=":443"; ma=86400
3431514.js
js.hs-scripts.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/3431514.js?integration=WordPress&ver=10.1.24
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:863b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
916826478fe8f1448b2d42ccdb7f1a50eabece238e9c4ea07d79ee3ae23f6f17

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
x-hubspot-correlation-id
54b2f9d0-8598-43c0-8280-ba232c1ef727
x-evy-trace-route-service-name
envoyset-translator
cf-polished
origSize=2487
age
43
x-envoy-upstream-service-time
6
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
cc11dc81-0a45-495c-a7c8-3bec7627d2e2
cf-bgj
minify
last-modified
Wed, 07 Jun 2023 02:11:06 GMT
server
cloudflare
x-trace
2BC81C7AABDFE51B4E72AFEA0D330DB10F3FD66D53000000000000000000
access-control-max-age
3600
vary
origin, Accept-Encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-6htpc
cache-control
public, max-age=60
access-control-allow-credentials
true
x-evy-trace-virtual-host
all
cf-ray
7d355ddbaf933645-FRA
expires
Wed, 07 Jun 2023 02:12:49 GMT
avia-snippet-hamburger-menu.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-hamburger-menu.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a36e939c7f4f377f2517e46f736a16f3699054935d671db0cacf3e854252c5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-3f05"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FEhAuauz4ewyi9NiliaeLl8OjsdQdJa%2BBlamGGTHHuMaj59xMCAWJk63H42RRhXx9jzYReSbxEiqJ9%2FCcFu3uBl1OiYiqS5pRTrjYvEaz2f8VHzwWWQjEIf3ThpmbijoQ9pjAeLgdFN%2Bimiy7A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b392c52-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-parallax.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-parallax.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
07df6e8fe1d38912af3b18403253680bacbb6c58bff226707f0aac4d6bce8e02

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-3aa6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z6Xph5w6RaTBJOWHCJ0ntFMODeaRkds1VPMjSFBgjX6zMEl4n0b8EIN9qkLxN17gxr3us0WSNy%2BT3yR%2FrUkg98QOdIBMUiD5tIfpgtD9cMguQf5VcWlvkx4u4CgCZSmccjlNQ1gbqOVZoDrF4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b3a2c52-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-fold-unfold.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-fold-unfold.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bdfc85d0363b58d6a764d24b7fc6e76b3d42e7a1da5122001232776a17d8f916

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"64513063-216e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ihBtisL4CS%2FqWFtFRj42Az5AEn7YLEmfikisTFbxlYigNbyIi%2F7RERWcTdxbuHN1AoG8%2BUZjrB0nK3KKf58JWs0jAXPtpnSdUUUmt8DLhwVVBNgyTGFN5rdSHL3gIEACtMKH9zKfrw23Drx5%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b3b2c52-FRA
alt-svc
h3=":443"; ma=86400
jquery.magnific-popup.min.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/ 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/aviapopup/jquery.magnific-popup.min.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf9f44c82cdea699d3a3937cdd8a7caf60ca84cf3d87adfc9fd49fdb84f35261

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-50d3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cjkj6vI5bgNxPP%2F2LqDLK%2BExS7qV%2BkPqvtVCycLHJUqcQi9E7RzS6qGlAjJghin51Ae6SYXZmpEst%2BIDRT5s9Fz6mE8XqDJtjQxNfmgpcEoY07bQIqnNJbWMKWo3aEn2Y%2Fz%2F5nRdrqo%2FMw3Mgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b3c2c52-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-lightbox.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-lightbox.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb290d74839b8966e9bce909665d8df6261aec38566f0888b4650fb105ef6e4d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
645280
etag
W/"64513063-1c0c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iws30IGWkWtu5eGnppqBDO5K3rpNvziBaouHMk3Ue4KATQe2pnBYb7Hle6VHnutte0b7RVx%2BhcppbDxDKcC0WNX6ufCE8XZtuDNDvh7yQr4ePgS3222qwGpvvBQ1qgBoOddJKJ%2BnzfjXwSZToA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b3e2c52-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-megamenu.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-megamenu.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a105ff63907ec0bf35e5fd98ff61b59ad0ae49fd3d4aecce22f45783633d443

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-19b0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qafZX%2FiE04Xvazb62dRBIcyjtP9mRLiYqtsyzV2i5zhYVxzjGLOlQIgEKxPIm7qyyF7cdXH%2BCe44kzJXN3cAIYDM1U4UUWNbTOsnG7chgOiTwHhHJLac66oXUgW6vrB%2FMcMpE1L%2Fap2NyAH6sA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b3f2c52-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-sticky-header.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-sticky-header.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a89b0568abfaed7f5443f87ac130aa2d3f3be2551c7281a2e8abe05aa17ce2f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-f2b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fu3NGwU5023Mh%2FciBBS8gHQLsnwUtTtzBcgZ%2B1fcfwIb%2B0MnBlG1nJQUd8Uuhd2Xq%2FKl2PklCKdwl37Wo187YnswAebMweeZaC%2Fy%2F2rKyVRuJxM3RqTcn2UVW0zY9I540VCmu6BO8c0QuulnRw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b402c52-FRA
alt-svc
h3=":443"; ma=86400
avia-snippet-footer-effects.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/js/avia-snippet-footer-effects.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7befea011c9462df08a59bb28962c266a595bc8776826f15c9dd098b621c9fb0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-6bb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JQnkIl%2FRSndRc6pyHIwC3r21U2ROnmZpVQgiERZYhbMeCt3o02nYkplsEwhgS3n4gn5JDMAUpfbPszmiivDlqg%2BIIVB2E%2FTbYw9Bq8peAtGEOaeHD239mGkfVjViQ7IjFWsYYCT93TEEse7M8w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b412c52-FRA
alt-svc
h3=":443"; ma=86400
avia_blocks_front.js
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-gutenberg/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-gutenberg/js/avia_blocks_front.js?ver=5.6
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8882fb82e7ca754fe6c804688bb79940d2a5096e01a1a84a13aaec6b4229d65

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64513063-a9d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zAeXtT3wGs7PsUH%2BRCcjuhdSK3SoqApnenC6%2FYnIPPagUkNYiB272Z29rrfvqPKnDlQa7NrQG4o625djxJWZ%2FKgy45mf2Xth2V7soriwiAdtoCUNwJZ0jQA2Qp2%2FKwlqDNTm7vn1E%2B%2BKoS0zZA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b422c52-FRA
alt-svc
h3=":443"; ma=86400
main.js
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/js/main.js?ver=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
66f7fe1471de5f92502a38fcd2c796e92d3eb0154ec74be74195d93d79eadff6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55475
etag
W/"64117050-125b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pg4jDBOUA0smIDAb%2FWsEVcX8gzUwUmEtsPZsWGqc091Ml11brIop6jU2rXM7eSMRyqQ6Ko4wN2asWRurpMCpHXlJO%2BJgItNP4ZwgpyyqWBJiCMPgqg1Du0MJ54XZyzk5y9aQ8oXbAUgO9ywrcg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddb7b432c52-FRA
alt-svc
h3=":443"; ma=86400
gtm.js
www.googletagmanager.com/ 		209 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
78cc33bc376ddb2777903b0fdded0b9c75417af2f3cbd12a6c9f185da42d2c2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
77948
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 01:19:19 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 07 Jun 2023 02:11:49 GMT
Adlumin-Blue-Gradient-Background.webp
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/webp/ 		285 KB
285 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/webp/Adlumin-Blue-Gradient-Background.webp
Requested by
Host: adlumin.wpenginepowered.com
URL: https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/main.css?ver=7
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
579fc24acea0994521f241400c4a1a511932951a8cedda191380f4a8ad67d467

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/main.css?ver=7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"64117050-47262"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=efA8fSEkaPvnJT%2BeBGJrDftXLQ2QqaCNUJgUprX6wOiSA36p0rfvdmn31NeWH%2BcMsEjLTmtuiIrVm%2FVGjCXRug5Kps7n9HYnzTlVIO2%2BfepkaG0C%2B90wIgFDP8o7%2FSxAZQnc5Dhre5Qhvnd6UQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b512c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
291426
Adlumin-Single-Dots-Overlay-@2x.png
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/ 		227 KB
227 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/Adlumin-Single-Dots-Overlay-@2x.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9346f80745c549014461e4175c748cf7fb795544f2be0fe2c45dd0eff9643244

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"64117050-38bdc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2xG6nycWzSQO9Ffeh6m6wL5yCEOzHhZwOYel0dPXCRYKPjhxFtPs1lL4mVIabGLyHJfycLjVTsXaoWXlMKt%2BMQRdgwlgXndS9X0Z2eBwxBp%2FO58nNESvyDbk2rf%2Bkkg0Q%2B92fIyyZ8vlo1SKVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddb7b522c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
232412
adlumin-icons.woff2
adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/adlumin-icons/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/adlumin-icons/adlumin-icons.woff2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
28ed5a75e655731a96ba917679810a9d9f22d5b0d33cd860235e3b82608763c2

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"64117050-6af4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6WzNJq3ytmMswaeA8XQf4x5PzKSwhYtBhsSdSizoDyN3Eg8iF%2F3LBUwNwDoaHbwa3MsrMq5Mq8wY1ObCxXvfp%2BXzCa%2BOyOfd2XCH8x8DtLTDvJ%2F5Xo%2BBuNi8e%2FiBnuM1%2BcAmJMDAX5BJyGewvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddba8d32c7e-FRA
alt-svc
h3=":443"; ma=86400
content-length
27380
xn7gYHE41ni1AdIRggexSg.woff2
fonts.gstatic.com/s/manrope/v14/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/manrope/v14/xn7gYHE41ni1AdIRggexSg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Manrope:wght@400;700&display=swap&family=Open+Sans:ital,wght@0,300;0,400;1,300&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
14be4114dcfde74652f19f9ffae8c9bb50707e9e88bd2b1fcd86fb50224109e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sat, 03 Jun 2023 19:43:23 GMT
x-content-type-options
nosniff
age
282506
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24376
x-xss-protection
0
last-modified
Tue, 02 May 2023 14:50:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 02 Jun 2024 19:43:23 GMT
fa-fontello.woff2
adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/fa-fontello/ 		4 KB
5 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/avia_fonts/fa-fontello/fa-fontello.woff2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
82c512c982d75150bb51f97cb89c9aa15f84dff4fa6a079e844e6e3578aef839

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:14:23 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"6411704f-11b0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PsNLrcsvQf8SO6C4MgC5pb%2Foi21QxGpjgpbtW62r1QFReRMBsOslkC%2BuM%2BWRwz1wTyyZZ7H5vdRIeGXwfhnoq9OR0x3%2FShsxXk6lHP3Q2zbkhpa910%2BRprBtlLUcqnmtzNhVQDL3pZITKr298g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddba8d12c7e-FRA
alt-svc
h3=":443"; ma=86400
content-length
4528
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Manrope:wght@400;700&display=swap&family=Open+Sans:ital,wght@0,300;0,400;1,300&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Sat, 03 Jun 2023 00:21:44 GMT
x-content-type-options
nosniff
age
352205
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 02 Jun 2024 00:21:44 GMT
entypo-fontello.woff2
adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-template-builder/assets/fonts/ 		38 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/enfold/config-templatebuilder/avia-template-builder/assets/fonts/entypo-fontello.woff2
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f260ff280b2e54e84e6f9c2790da49cc9abadc457b77d1df4dea121a8c8ab6e

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Tue, 02 May 2023 15:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"64513063-9934"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4wq52WCnOdQM5eZWY5aIpjvqApJnLuWNEymjvCtKV6RiLr%2FzT7RzGRBLE%2FuhvG2l%2FVw7WDkOXy6qWbl6B3UDMGnLuY2zBTV0ss3SJ91LeQqApBQmN8cNzjPaf5ABMO9sITbz%2FJNXhFpBiDyVLw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddba8d42c7e-FRA
alt-svc
h3=":443"; ma=86400
content-length
39220
adlumin_logo.png
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/img/png/adlumin_logo.png
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec96492be8a0ab58dd62f42849c8dc6e344a0183034f4111cc4bc12355117b15

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Wed, 15 Mar 2023 07:14:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"64117051-2b5d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IBfArqejjzjxctx9MU%2F6PCkCRk1D24PzfInCqheUR3Idl8t6hkk5F3bTk1XWcWgryTCSHZhkKg3JCIDHCU30mHK5N1hjjG%2Fnv7JzyXxJ2C4p66V9pUHznrmo%2BLGAjjDXE123%2BPdu07v9Nj1OcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddbeb7e2c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
11101
Women-of-the-Channel-Stephanie-BroylesBlog-Post.jpg
adlumin.wpenginepowered.com/wp-content/uploads/ 		136 KB
136 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/Women-of-the-Channel-Stephanie-BroylesBlog-Post.jpg
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a17fa945f3516e5fa99a51e2c4a954d848d9fbbc3a8608083e766f3e71f6c5a7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Mon, 08 May 2023 15:02:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"64590f11-21ff3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sOs6H5ayzZ3fcnlJeny3LuH74FKfcv8GHVUwQ7%2Fty8edEVF4078wSz1OlNRuinQLT1AbJ%2BQGnF3jVK6iqxq9iRS6EfgRRt86LtBCskqHYsrwXKH6JlQ5LKYkz9rd2isfTD0AFEFwnAzcIjm6eQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddbeb7f2c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
139251
How-AI-is-Used-to-Detect-Lateral-MovementBlog-Post.jpg
adlumin.wpenginepowered.com/wp-content/uploads/ 		99 KB
100 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adlumin.wpenginepowered.com/wp-content/uploads/How-AI-is-Used-to-Detect-Lateral-MovementBlog-Post.jpg
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5069325809fdaac7569d780bfa4b60b59f8ba652fca7f31aa9a7112f48a2fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
cf-cache-status
MISS
last-modified
Thu, 11 May 2023 14:06:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"645cf664-18cf9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H6PgaCKfoaBHoUZuqzGlVmL%2FwKWEGCCTD%2FCarVv0w%2BHa7%2FVEjNRO3QU5OnQ4pbV%2BKSoY72%2BxBPJQXwEA6kgVe4%2FfJdWiik1shTAH6CIHQoT8qQmIQ8QQDyNLgYxgqutQ6xwPq%2B6iO8c1scDNdA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7d355ddbeb802c52-FRA
alt-svc
h3=":443"; ma=86400
content-length
101625
insight.min.js
snap.licdn.com/li.lms-analytics/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=10357
server-timing
ak_p; desc="1686103909886_399430925_134455444_13_623_6_24_146";dur=1
accept-ranges
bytes
content-length
4777
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 07 Jun 2023 02:04:35 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
434
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Wed, 07 Jun 2023 04:04:35 GMT
3431514.js
js.hs-scripts.com/ 		2 KB
708 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/3431514.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:863b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab6a9de18f0239ec6f191049b7c4e1e55066893c8f9cc91cb32a9b36136680d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
cf-cache-status
HIT
x-hubspot-correlation-id
851429b2-2e99-4492-8ef4-1abe66c77b1c
x-evy-trace-route-service-name
envoyset-translator
cf-polished
origSize=2487
age
43
x-envoy-upstream-service-time
7
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
0cff49ba-d081-4e2f-bf23-fe95f0458fef
cf-bgj
minify
last-modified
Wed, 07 Jun 2023 02:11:06 GMT
server
cloudflare
x-trace
2B24FD8D8ED11A1ED951C9579C6E0044E1E0FC8C57000000000000000000
access-control-max-age
3600
vary
origin, Accept-Encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-h5kcm
cache-control
public, max-age=60
access-control-allow-credentials
true
x-evy-trace-virtual-host
all
cf-ray
7d355ddc782a3645-FRA
expires
Wed, 07 Jun 2023 02:12:49 GMT
628500581c800e0014526cc8
ws.zoominfo.com/pixel/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.zoominfo.com/pixel/628500581c800e0014526cc8
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
fc48c47e11a8c62eab7917b9075a6ee3682ec39e10cbbe21cba552697fc1a443
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
7d355ddc9ed71c7f-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok
alt-svc
h3=":443"; ma=86400
lftracker_v1_ywVkO4X2ngW8Z6Bj.js
sc.lfeeder.com/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sc.lfeeder.com/lftracker_v1_ywVkO4X2ngW8Z6Bj.js
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:3200:4:d7e1:700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a9e6567358df53f9b31e7eccc1e537dcf6a99cb5924024f1b9cd015bd0c35a9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

x-amz-version-id
1yuxTgLtN2UWFIYIO6_GO3dpBBjcsvDD
content-encoding
gzip
via
1.1 a3c1615d6bdfc01a05a0b3a742d10d38.cloudfront.net (CloudFront)
date
Wed, 07 Jun 2023 02:11:51 GMT
last-modified
Thu, 18 May 2023 07:05:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P4
x-amz-server-side-encryption
AES256
etag
W/"71ccb70348746d2ab1b2153681ec86f3"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
cache-control
max-age=3600
x-amz-cf-id
DhShJInaJ-RegZNhrAqNI4LtKz4v9ZO21xtyuUfptlMm-fu0tVOIJQ==
js
www.googletagmanager.com/gtag/ 		240 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-8LEMRP9CBR&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54QK5F8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7b15ce040beec8eda0d08fba407bbe5ddd1c16144cfb5a9f902aeafde30d08a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
84422
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 07 Jun 2023 02:11:49 GMT
conversations-embed.js
js.usemessages.com/ 		75 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:64ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a39c3cdbdb987dee562a2de964a1d39e27e889fea5e108c3b4ba49fcea2fdc8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
x-amz-version-id
tpkjbFWgcaEMzfLPc7S4pq7_HxVMVYYE
via
1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P3
age
96
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13373/bundles/project.js&cfRay=7d355b806a4918b3-FRA
x-cache
Hit from cloudfront
cache-tag
staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
be9cb3bc-40c9-4af3-b0ca-d12d2d7ecab3
last-modified
Fri, 02 Jun 2023 04:38:53 UTC
server
cloudflare
etag
W/"087fd2cd45ce20566625b1ec1f62b5c4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-xhv87
cf-ray
7d355ddccf2a36df-FRA
x-amz-cf-id
u2snEL6WJ3RsBnRAL2FnMfaKzL_bN-9FFuGvzMgvWHOxrrToXkR2GQ==
x-hs-target-asset
conversations-embed/static-1.13373/bundles/project.js
collectedforms.js
js.hscollectedforms.net/ 		69 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6dc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e1bce508370a6994bd3e0e67c257f06875e16ca2038c27f498616a0f0d55687

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:49 GMT
x-amz-version-id
SGo7xq5b6d1kUu6c8SU5YR.mobmUICUY
via
1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
cf-cache-status
EXPIRED
content-encoding
br
x-amz-cf-pop
IAD12-P3
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.370/bundles/project.js&cfRay=7d355ddcbae318e7-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
5817870c-378f-4f5b-93a5-4d994e3dedfa
last-modified
Tue, 09 May 2023 08:44:18 UTC
server
cloudflare
etag
W/"d1b16df440198d59c993c4956b7fded6"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-x5fmx
cf-ray
7d355ddcbae318e7-FRA
x-amz-cf-id
xfPr2EfKum5acNLb_XzGM83wlsT9ch19o21cFYMMZ4-8OWR-GVpZ-Q==
x-hs-target-asset
collected-forms-embed-js/static-1.370/bundles/project.js
leadflows.js
js.hsleadflows.net/ 		545 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:836e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53c6e25ad853b5a6ad922795465a0e178c87af06b8a7ab3bde53b7b6939902c8

Request headers

Referer
https://adlumin.com/
Origin
https://adlumin.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

content-encoding
br
age
45166
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1213/bundle/main/lead-flows-release.js&cfRay=7d310f290e159a24-IAD
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"e0a28490756bd60883ddd702b459f472"
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=86400, max-age=0
x-hs-target-asset
lead-flows-js/static-1.1213/bundle/main/lead-flows-release.js
date
Wed, 07 Jun 2023 02:11:49 GMT
x-amz-version-id
8pz0uDcBGYlrsmWQyDnHbF47HkG8cM.I
via
1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
6
x-evy-trace-route-configuration
listener_https/all
x-request-id
0f2e85cc-916f-4cc3-80f8-675f18b04786
last-modified
Tue, 06 Jun 2023 12:07:08 UTC
server
cloudflare
access-control-max-age
3000
x-hs-cache-status
MISS
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-cxzff
cf-ray
7d355ddccee39a1d-FRA
x-amz-cf-id
8qc9uekSjyeLO167bfm3-aeax679lfixODZMhVgNTFF83_ZUmWopwg==
3431514.js
js.hs-analytics.net/analytics/1686103800000/ 		66 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1686103800000/3431514.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:89ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
21e9d17948a7b309d6fa4d32665e5dbb35656d796b55f02144a373de1013e9df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
P1TZ2B1MDF39HSQK
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
25
x-amz-id-2
hvV+VvwHPlWqkPda/t5NJwC6ogkv+94gmC+30dWp9b3BdD73OCYy8WXCZcoNgnExVeS2nuVCTlU=
x-evy-trace-listener
listener_https
x-request-id
f2b55da9-44f0-4442-bbac-7f70ffd127f2
x-evy-trace-route-configuration
listener_https/all
last-modified
Wed, 31 May 2023 18:51:24 GMT
server
cloudflare
etag
W/"bc9738c39e8976f80d37f028b2483278"
vary
origin, Accept-Encoding
content-type
text/javascript
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
cache-control
max-age=300,public
access-control-allow-credentials
false
cf-ray
7d355ddcc9d0916e-FRA
expires
Wed, 07 Jun 2023 02:16:49 GMT
3431514.js
js.hs-banner.com/ 		60 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/3431514.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3431514.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66c3443dee1a703e927e8269976d576393b4b86e551c859b4bebcc45cef6f663

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
x-amz-version-id
u17G_TGE2NekeilBvsrO8P9gfgT.A8YA
content-encoding
br
cf-cache-status
REVALIDATED
x-amz-request-id
45R7TJDETSYRPB6D
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
17
x-amz-id-2
xp+XwkdZLWHu5N3x07v7RHJKG/YTWX/+Qu2/OcFwKTO0ywM7/NvIv49btB12/T5hssk3G6BdkMxHIl743ROGRXmIeEZeNL4B+qHbAHf4+g8=
x-evy-trace-listener
listener_https
x-request-id
30f10152-4502-42af-abfa-46f80710e14a
x-evy-trace-route-configuration
listener_https/all
last-modified
Mon, 17 Apr 2023 15:13:48 GMT
server
cloudflare
etag
W/"bb25eb05bea9e9ad56fc55349e803baf"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-v9vn7
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
7d355ddccb4118ed-FRA
expires
Wed, 07 Jun 2023 02:16:50 GMT
collect
region1.google-analytics.com/g/ 		0
251 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-8LEMRP9CBR&gtm=45je3650&_p=348659084&cid=1854189199.1686103910&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1686103909&sct=1&seg=0&dl=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&dt=PowerDrop%3A%20A%20New%20Insidious%20PowerShell%20Script%20for%20Command%20and%20Control%20Attacks%20Targets%20U.S.%20Aerospace%20Defense%20Industry%20%7C%20Adlumin%20SaaS%20Security&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8LEMRP9CBR&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 07 Jun 2023 02:11:49 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://adlumin.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		4 B
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=348659084&t=pageview&_s=1&dl=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&ul=en-us&de=UTF-8&dt=PowerDrop%3A%20A%20New%20Insidious%20PowerShell%20Script%20for%20Command%20and%20Control%20Attacks%20Targets%20U.S.%20Aerospace%20Defense%20Industry%20%7C%20Adlumin%20SaaS%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=428376897&gjid=358194244&cid=1854189199.1686103910&tid=UA-96193909-1&_gid=594046865.1686103910&_r=1&_slc=1&gtm=45He3650n8154QK5F8&z=1428242217
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 07 Jun 2023 02:11:49 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://adlumin.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
token
cdn.linkedin.oribi.io/partner/4470834/domain/adlumin.com/ 		36 B
378 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.linkedin.oribi.io/partner/4470834/domain/adlumin.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:237d:2000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 00:17:51 GMT
content-encoding
gzip
via
1.1 9f8416bf8a85d328bf3649469ef2a474.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P2
age
6838
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=39141
x-amz-cf-id
iQcurQe7fIqtgl-5-EtGhyfzxHJqdGS3yK8WcU5jYsLI9UOmGWJLaQ==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targ...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targ...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4470834%26time%3D1686103909959%26url%3Dhttps%253A%252F%252Fadlumin.com%252Fpost%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targ...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-tar...
0
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true&e_ipv6=AQKr1sZPDmw9lAAAAYiTn-kKPG_7FqknzoX8BQOpVDGbxBGP7qkMtPB8vNMuAnJOn-JgP-7yAzvV
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 47CE0DCA6E444B81B6604CA271E6682C Ref B: FRAEDGE1818 Ref C: 2023-06-07T02:11:50Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX9gKipNkdlh9dPdIHkxw==

Redirect headers

date
Wed, 07 Jun 2023 02:11:49 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 31C69C1C897A4C448FC5B916DA04E8E8 Ref B: FRAEDGE1720 Ref C: 2023-06-07T02:11:50Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4470834&time=1686103909959&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&cookiesTest=true&liSync=true&e_ipv6=AQKr1sZPDmw9lAAAAYiTn-kKPG_7FqknzoX8BQOpVDGbxBGP7qkMtPB8vNMuAnJOn-JgP-7yAzvV
x-li-proto
http/2
content-length
0
x-li-uuid
AAX9gKimNnErRUUMRto4RQ==
collect
stats.g.doubleclick.net/j/ 		4 B
346 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-96193909-1&cid=1854189199.1686103910&jid=428376897&gjid=358194244&_gid=594046865.1686103910&_u=YCDACEAABAAAACAAI~&z=298735162
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Wed, 07 Jun 2023 02:11:50 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://adlumin.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-96193909-1&cid=1854189199.1686103910&jid=428376897&_u=YCDACEAABAAAACAAI~&z=1627067336
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 07 Jun 2023 02:11:50 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-96193909-1&cid=1854189199.1686103910&jid=428376897&_u=YCDACEAABAAAACAAI~&z=1627067336
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 07 Jun 2023 02:11:50 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
json
forms.hscollectedforms.net/collected-forms/v1/config/ 		115 B
469 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3431514&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:6dc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f89193713a99ccc53de54f35294edd840a87e0c8021aec68a6ce3ad34d777110

Request headers

Accept
application/json, text/plain, */*
Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
1f189b02-d763-437d-909f-1bd7c6cb2eb3
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
8
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
149461be-028e-49bc-93a8-50774bf31c08
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
cache-control
max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-nnm64
access-control-max-age
180
x-robots-tag
none
access-control-allow-headers
*
cf-ray
7d355dddfb9f18e7-FRA
/
tr.lfeeder.com/ 		43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.lfeeder.com/?sid=ywVkO4X2ngW8Z6Bj&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTk2MTkzOTA5LTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLThMRU1SUDlDQlIiXSwiZ2FDbGllbnRJZHMiOlsiMTg1NDE4OTE5OS4xNjg2MTAzOTEwIl0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNjEuMCJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly9hZGx1bWluLmNvbS9wb3N0L3Bvd2VyZHJvcC1hLW5ldy1pbnNpZGlvdXMtcG93ZXJzaGVsbC1zY3JpcHQtZm9yLWNvbW1hbmQtYW5kLWNvbnRyb2wtYXR0YWNrcy10YXJnZXRzLXUtcy1hZXJvc3BhY2UtZGVmZW5zZS1pbmR1c3RyeS8iLCJwYWdlVGl0bGUiOiJQb3dlckRyb3A6IEEgTmV3IEluc2lkaW91cyBQb3dlclNoZWxsIFNjcmlwdCBmb3IgQ29tbWFuZCBhbmQgQ29udHJvbCBBdHRhY2tzIFRhcmdldHMgVS5TLiBBZXJvc3BhY2UgRGVmZW5zZSBJbmR1c3RyeSB8IEFkbHVtaW4gU2FhUyBTZWN1cml0eSIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiOWM5YzI1NGNkNmFjNGU0MCIsInNjcmlwdElkIjoieXdWa080WDJuZ1c4WjZCaiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuZjA2ZTE5ODVkOTc0NjFhOC4xNjg2MTAzOTEwMDg2IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.192.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-192-114.muc50.r.cloudfront.net
Software
CloudFront /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
via
1.1 6ef87569c26a159f552948d3c30a2be0.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
MUC50-P1
x-cache
LambdaGeneratedResponse from cloudfront
content-type
image/gif
content-length
43
x-amz-cf-id
WY4b2NmCvoi3kRe1xdTvQW1d_bzYK41fDqJytT2HTxEjweKMnU0pqg==
body.css
adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/ 		76 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adlumin.wpenginepowered.com/wp-content/themes/adlumin/assets/css/body.css?v=7
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9038dbea3c17e614c865c4390694bbc9b2e453859496e709a97d37d9e0866c0b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Mar 2023 07:14:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
55476
etag
W/"64117050-131f4"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R%2Brrku1e0rLS4ZnjrnlIujzgOpKfbeL0CHykidXaTfq0H5BiY4B3fHEgt8Y0Thfg8mrztu1KKAVxhvkXL7e9AOV0UiPOqkEoN5VRsbFeet7p1NXGzQyPPwJR7EmeZEvScG783tV5dTP83sm3kQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7d355ddedd112c52-FRA
alt-svc
h3=":443"; ma=86400
css
fonts.googleapis.com/ 		6 KB
812 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap
Requested by
Host: adlumin.com
URL: https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d3743c6f1dd7dbe1a3677bc1304a36ea74dca1aeb1c5a687cfd4cdf5574e9925
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 01:04:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 07 Jun 2023 02:11:50 GMT
public
api.hubspot.com/livechat-public/v1/message/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=3431514&conversations-embed=static-1.13373&mobile=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&traceId=b20a4b809ae341899a1ab4b4bb814af7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
x-hubspot-messages-uri
Access-Control-Request-Method
GET
Origin
https://adlumin.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin
https://adlumin.com
allow
HEAD,GET,OPTIONS
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d355ddf5f61bbf2-FRA
content-length
18
content-type
text/plain; charset=utf-8
date
Wed, 07 Jun 2023 02:11:50 GMT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=syuaEjyDoi%2BkNs%2FeQHobkDFY%2BnNhigAc%2BoWGNT%2BpYOHq1TjhoksR0VK51XsO8TRdB8OmjdlFn3rnmjmV4BmieXnKm4EDD7E35EFc2WMt0%2BqPXObigwkiLC7jwPCw3Qm5jU7S0GxjQS0i31t2xA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
x-envoy-upstream-service-time
2
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-qcqs6
x-evy-trace-virtual-host
all
x-hubspot-correlation-id
3ee09881-ae9f-485e-a701-c681a6a517f0
x-request-id
50a6da4e-04ac-496d-9b4e-a119ace3d0db
x-trace
2B554BF97E87EB2360494D9E460FD0191558803903000000000000000000
public
api.hubspot.com/livechat-public/v1/message/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=3431514&conversations-embed=static-1.13373&mobile=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&traceId=b20a4b809ae341899a1ab4b4bb814af7
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22ce8e9a15d594adbb0017e75c6c48bbd2ee85f90f5f450ad1c5e332fde17c8e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://adlumin.com/
accept-language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
7f89ec3c-2a22-410b-8d55-8aed7be26f6f
x-envoy-upstream-service-time
82
alt-svc
h3=":443"; ma=86400
content-length
1459
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
dac3f4ee-41a7-4495-a14b-fbebee5a8afe
server
cloudflare
x-trace
2B512AC950F63F244AB826916312F83EBBA7C2E704000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-fmst8
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T1%2F6SraxtDqAQ6uFlc%2F35YMUDpAdW71FzbndhR96p3HpIqLAKWPrm60FYg39WkUQJNL3zRSXp2y6BUaU7f1pc9%2B6FK2GRpjFQahJ00L8R5EPnKCeKPw9GzUfoht9FP%2BpEx%2BVfFOi7iIIUG9rbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7d355de01fd4bbf2-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
b20a4b809ae341899a1ab4b4bb814af7
app.hubspot.com/conversations-visitor/3431514/threads/utk/ Frame 390A 		53 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/conversations-visitor/3431514/threads/utk/b20a4b809ae341899a1ab4b4bb814af7?uuid=9bfb843a173a40cda8b49f5141720c0a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca786bace1f36b0b1d1a2d25124d30eb6a30c7f51f71f3737635698e791e7365
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://adlumin.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
false
age
1322
alt-svc
h3=":443"; ma=86400
cache-control
max-age=600
cache-tag
staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod
cf-cache-status
DYNAMIC
cf-ray
7d355de19f636964-FRA
content-encoding
br
content-security-policy-report-only
script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-visitor-ui/static-1.15825/html/index.html&cfRay=7d355de19f636964&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F3431514%2Fthreads%2Futk%2Fb20a4b809ae341899a1ab4b4bb814af7%3Fuuid%3D9bfb843a173a40cda8b49f5141720c0a%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dadlumin.com%26inApp53%3Dfalse%26messagesUtk%3Db20a4b809ae341899a1ab4b4bb814af7%26url%3Dhttps%253A%252F%252Fadlumin.com%252Fpost%252Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%252F%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fadlumin.com%2F&cfenv=prod&pdt=2023-06-07&csp=ro
content-type
text/html; charset=utf-8
date
Wed, 07 Jun 2023 02:11:50 GMT
etag
W/"661a867d93501974cc7c96c4781ccb23"
last-modified
Fri, 02 Jun 2023 04:38:53 UTC
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
reporting-endpoints
default="https://send.hsbrowserreports.com/csp/reports?cfRay=7d355de19f636964&resource=conversations-visitor-ui/static-1.15825/html/index.html"
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
via
1.1 c0b0d7167cc2eb52d8d154aa7fc03a0a.cloudfront.net (CloudFront)
x-amz-cf-id
lP_PM22fhN6Vi3Bm53RDsUnbg-fICjQWEoolUQEnXIlpZtY-RgsvZQ==
x-amz-cf-pop
IAD12-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
wJrloj_F60dJKWh_zms736Mc9w2KFz4o
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
5
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5c7n7
x-evy-trace-virtual-host
all
x-hs-cache-status
MISS
x-hs-target-asset
conversations-visitor-ui/static-1.15825/html/index.html
x-hs-worker-debug-mode
false
x-request-id
5adb0eb1-eccb-48a7-a1f6-89ebfe943348
bundle.production.js
static.hsappstatic.net/head-dlb/static-1.338/ Frame 390A 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/head-dlb/static-1.338/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/b20a4b809ae341899a1ab4b4bb814af7?uuid=9bfb843a173a40cda8b49f5141720c0a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
x-amz-version-id
uq4ahwTgbmdDVq3iqHPHE8OZSufTo1wc
via
1.1 9dcbfb7225622c2aeed01d74cae329de.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
DFW56-P3
age
543490
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 28 Apr 2023 15:18:57 GMT
server
cloudflare
etag
W/"d4a36ffcc533bcbae2a557884d3059e8"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D0etScidkXTY%2BUhV0g8veeGMr1x9a%2F%2Bvc69lFMhWDH3LetcPOJwJeJ1myQu2n4Yrs46sCbTsAAidHcN7pU6aqx8tOtjn4EdLAbj0QLqVOYuby8HpISJ6TDoORolCFC9%2FBfXh32JLwb4GADiTmQt7LEjxQWc%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d355de308c53a92-FRA
x-amz-cf-id
WCB6sbsj641bNkTUZYeHeQqqPFvy0eG6CW_nsGKruKsQOlnSKL3EdQ==
expires
Thu, 06 Jun 2024 02:11:50 GMT
visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/ Frame 390A 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/visitor.css
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/b20a4b809ae341899a1ab4b4bb814af7?uuid=9bfb843a173a40cda8b49f5141720c0a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
x-amz-version-id
eTttM9S_vWGkXsa3G13R54bOHuRyRlPL
via
1.1 fd483560525589f421c8cca5c0a4a5da.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
BOM50-C1
age
695267
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Miss from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 06 Mar 2023 22:24:16 GMT
server
cloudflare
etag
W/"8b2053a9d9199e217c1f3e61d80f5d90"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=280XEo5mYTm9xcasCHRWEI6unvUxo6a7AdDgC7qvK9%2FD58Ny7MGai2AjwYpg6NMNuy5a7fbUW8N75iCUC48tjH8n43sAl7XbOnZrW2SxTvo3%2Fup2MbhOSHJylU3nRm%2FAbWmRuUm7ssAllp17rmSB2Q8Zdfo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31536000
cf-ray
7d355de30b1903f0-FRA
x-amz-cf-id
mlJcALXrZKTpqP9AMh34TzuKI1ApxqTwYCYzIcX9jLhe_0JncUdwIw==
expires
Thu, 06 Jun 2024 02:11:50 GMT
bundle.production.js
static.hsappstatic.net/hubspot-dlb/static-1.392/ Frame 390A 		294 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/hubspot-dlb/static-1.392/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/b20a4b809ae341899a1ab4b4bb814af7?uuid=9bfb843a173a40cda8b49f5141720c0a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
x-amz-version-id
GyJQrIoHDRIfCuwwSVVsJwX13g1Qp9_O
via
1.1 4a502b22092e94faddf9a5b056e273ae.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
1072989
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
RefreshHit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 06 Apr 2023 11:56:47 GMT
server
cloudflare
etag
W/"90cd3e4c19469ce68f12da7dbe18af11"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nES70Xqi1cx2KmaCTKLzXOKJJ0ylED40X5oYOOqXPezjoevBKXWJKyLIbqStAXvwRleeJUsrc9RaAF%2FHRao6D%2Btb6cdV16EmIGfQyE%2BQp08tSfeyUAo9m8qOTjpUHLWOEUkZcoQ4RK1lfddoJjl%2FWFZ546s%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d355de308c63a92-FRA
x-amz-cf-id
nMqgVUK1U6dxkmvZXUF0SXQiscRE_Qjq6yTuxlzQnbm4-tuKDKLgTg==
expires
Thu, 06 Jun 2024 02:11:50 GMT
visitor.js
static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/ Frame 390A 		609 KB
179 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/visitor.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/3431514/threads/utk/b20a4b809ae341899a1ab4b4bb814af7?uuid=9bfb843a173a40cda8b49f5141720c0a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96bffdfe121db413dae209a92d4f609fe19105176ac18131d9fce1c457dc2ff7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:50 GMT
x-amz-version-id
3a6Xw6UepSe4u.H7Oj9H8kmVoFO_v3Eq
via
1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
379963
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 02 Jun 2023 16:27:41 GMT
server
cloudflare
etag
W/"25632e87f7d9107e5279237e3b96a3b8"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EEeCzZZ%2Bc%2FcYDbVyeAqLrMBfDt5dWyJfJ532da%2BCxw247AYh7dgjP%2BIujlt0G5Q7V9fzL2HjI7xOm820GWPWIgCP2c8fyzq7N%2Fvw4%2BTt0rsdlO3cMLwoZdLxM%2FgLt0j01IBITtJi82HgzMWdAhXlV%2FQmEGo%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d355de308c73a92-FRA
x-amz-cf-id
9DP_MST4VM48RzQJu1kuMGNAkepVuYuBBLOF6xQzgxaGM5r9ho0IfQ==
expires
Thu, 06 Jun 2024 02:11:50 GMT
i18n-data-data-locales-en-us.js
static.hsappstatic.net/conversations-visitor-ui/static-1.15785/ Frame 390A 		776 B
915 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.15785/i18n-data-data-locales-en-us.js
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5773922958407876324a55ff40662ecd526f8829178ab8790a6e8dce853b3f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:51 GMT
x-amz-version-id
SpNiq4P9pGdDdfmtMtY74SmCGTt9GDKN
via
1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
649876
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 26 May 2023 19:36:10 GMT
server
cloudflare
etag
W/"28c9a8bedc7c9bf5c53a75a4a0be86eb"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MtYjH2gBBeGBipgytcuFlp5kA%2FbjxvMbD%2Fa%2FXFlylFYmGrOdU4lLqjKoW5Hq4ZLV%2BUkhF6ICAsKQ98LtuG7TTNQfoB4YKfpBTTcko3zrgNLeP7wT%2FM8nwmt4pdpR3rBf%2BoEHHrxTTfyjGidqErJP9HSMCpg%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7d355de3d9383a92-FRA
x-amz-cf-id
gWVgtDbY1DvfWkQHFfVHSgWnI0TtmkSZXffQJ0Ky8IIBXhxDXDdOnw==
expires
Thu, 06 Jun 2024 02:11:51 GMT
__ptq.gif
track.hubspot.com/ 		45 B
712 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=78086756&v=1.1&a=3431514&ct=blog-post&rcu=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&pu=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&t=PowerDrop%3A+A+New+Insidious+PowerShell+Script+for+Command+and+Control+Attacks+Targets+U.S.+Aerospace+Defense+Industry+%7C+Adlumin+SaaS+Security&cts=1686103911119&vi=265de4ab0b5d7da8e060cefc7e59a28e&nc=true&u=74644162.265de4ab0b5d7da8e060cefc7e59a28e.1686103911109.1686103911110.1686103911110.1&b=74644162.1.1686103911110&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:51 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
80ab441f-23b0-46d6-839d-a1b962b0f6b4
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
5
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
ec1bbb33-b440-49c6-948e-4a4395ffe915
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=caOZnkWCIRBl%2FHbq2E79iAv8E4hay4h9ht8VPcT2r1zr2vfJ21ZchoConXbu1cWv6w3w6XkHYE2W0%2FJSpOQY7jodzwkTpeMC%2Btb9Ohu7RUMctJATAu0fmemu7yXwd2n7eiSSnfrQcmqdxhRAUd%2Ff"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-kn6mk
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7d355de4885e6964-FRA
x-robots-tag
none
json
forms.hubspot.com/lead-flows-config/v1/config/ 		220 B
992 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3431514&utk=265de4ab0b5d7da8e060cefc7e59a28e&__hstc=74644162.265de4ab0b5d7da8e060cefc7e59a28e.1686103911109.1686103911110.1686103911110.1&__hssc=74644162.1.1686103911110&currentUrl=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d115944912fd1a9638bae458938c2fc4497c6339b01f7f9b2680b6430ae0947
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adlumin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:51 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
8ec93175-53b5-4b48-b8cc-9b480bacf896
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
28
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
1ea5b9a9-11bf-4e7b-b756-65c68454316c
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://adlumin.com
x-evy-trace-virtual-host
all
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CO22Wm87OxKe9b%2BET%2BQfrrcNAQOR7Twfem3pxQm%2BZCWpQJHak4Ri5Ady8CJ%2BFvLelP%2BJn9I%2F1in%2FufMrfa9iuJ5KCvG%2BLgwB2lHZg6WEOfV%2FO5HkuEjwHdVJpesjb4HZxSK%2BeOEEVIj9f5AC36p9"}],"group":"cf-nel","max_age":604800}
x-robots-tag
none
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
7d355de4ba97bbf2-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-jkmcj
adlumin_logo_mark_RGB.jpg
3431514.fs1.hubspotusercontent-na1.net/hub/3431514/hubfs/ Frame 390A 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://3431514.fs1.hubspotusercontent-na1.net/hub/3431514/hubfs/adlumin_logo_mark_RGB.jpg?width=108&height=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e8cf947efecf3277213601e403872e1afd3ecd0c12595ed3c440a07802e8442
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Wed, 07 Jun 2023 02:11:51 GMT
via
1.1 c59b5a542015c208c95d2ed3c65cdbcc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag
F-81116586854,P-3431514,FLS-ALL
content-length
2952
cf-resized
internal=ok/m q=0 n=306+0 c=1+8 v=2023.4.2 l=2952
last-modified
Thu, 04 Aug 2022 16:33:24 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfKMbZSlRkDBGh3IqPwzh8f7C7Un9Bg2vL7Sxl6y2PDQ:9edea622d10e7b80320bd3d9000a6a2e"
vary
Accept, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7d355de56f6435fd-FRA
rhumb
app.hubspot.com/api/cartographer/v1/ Frame 390A 		0
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.15825
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15825/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/conversations-visitor/3431514/threads/utk/b20a4b809ae341899a1ab4b4bb814af7?uuid=9bfb843a173a40cda8b49f5141720c0a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=adlumin.com&inApp53=false&messagesUtk=b20a4b809ae341899a1ab4b4bb814af7&url=https%3A%2F%2Fadlumin.com%2Fpost%2Fpowerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Wed, 07 Jun 2023 02:11:51 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
d9adde13-647c-440a-8956-901386bfaf09
x-envoy-upstream-service-time
3
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
ca426c1a-4e3f-4eef-bf48-eba6461015cd
server
cloudflare
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pc726Un1nvFvV6jZhYmNNVcu1SZBJz3MEG%2BmYwb1Cj%2Ft%2B8pq%2B%2BbVWYeXn7YJNLHZbT2%2Bgpyvu9ngVHIb%2F0xqZXRKpIY2n9Wli8bFx%2B%2FDfTLy9zm%2Fr0MY62Rt9hnUdkapdqmhwzpjXlo05WQR4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://app.hubspot.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-mv678
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure
access-control-max-age
604800
access-control-allow-credentials
true
x-evy-trace-virtual-host
all
cf-ray
7d355de528966964-FRA
access-control-allow-headers
Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
timing-allow-origin
*

Verdicts & Comments Add Verdict or Comment

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 boolean| credentialless object| onbeforetoggle object| onscrollend object| aviaJS boolean| avia_is_mobile object| _hsq object| dataLayer object| avia_framework_globals function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Flickity function| Unipointer function| Unidragger function| imagesLoaded object| enquire function| changeSlideClasses object| google_tag_manager object| google_tag_data string| _linkedin_data_partner_id string| GoogleAnalyticsObject function| ga function| ldfdr object| fs object| _hsp function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData function| lintrk boolean| _already_called_lintrk object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows object| hubspot function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN object| __hsCollectedFormsDebug object| _paq function| sanitizeKey boolean| _hstc_loaded object| __gaConnectorEventsEmitted undefined| $ function| jQuery object| lottie object| bodymovin function| Waypoint function| Outlayer function| Isotope function| Masonry function| Packery function| Froogaloop function| $f object| leadin_wordpress object| avia_js_shortcodes boolean| hubspot_live_messages_running object| HubSpotConversations object| ziws boolean| _hspb_ran boolean| _hspb_loaded boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| LEAD_FLOW_DOCUMENT_READY_RAN

23 Cookies

Domain/Path Name / Value
.adlumin.com/ Name: _gcl_au
Value: 1.1.966214911.1686103910
.adlumin.com/ Name: _ga_8LEMRP9CBR
Value: GS1.1.1686103909.1.0.1686103909.0.0.0
.adlumin.com/ Name: _ga
Value: GA1.2.1854189199.1686103910
.adlumin.com/ Name: _gid
Value: GA1.2.594046865.1686103910
.adlumin.com/ Name: _gat_UA-96193909-1
Value: 1
adlumin.com/ Name: ln_or
Value: eyI0NDcwODM0IjoiZCJ9
.adlumin.com/ Name: _lfa
Value: LF1.1.f06e1985d97461a8.1686103910086
.linkedin.com/ Name: li_sugr
Value: 2814c91a-4c14-42b2-80b3-9067e321f059
.linkedin.com/ Name: bcookie
Value: "v=2&4c3e133f-a09e-44ff-8ff2-608b95e28c69"
.linkedin.com/ Name: lidc
Value: "b=TGST07:s=T:r=T:a=T:p=T:g=2579:u=1:x=1:i=1686103910:t=1686190310:v=2:sig=AQFFpeCNIWrMi8PlkD4ugRcMFf9R62pP"
.ws.zoominfo.com/ Name: visitorId
Value: 2430ac692e401d55ffedcd41ab0f4484b58b3ebebbc641788b5e655d80001085
.zoominfo.com/ Name: __cf_bm
Value: Gk9rroktbWtn6bLA7n4tygRH5SpZFUC3D_.C0DjCvns-1686103910-0-Afi/h556YHuHnb7D+WTlLJ2Vw4qCQSev4bjHBQqz+76zoQx5O3stFIJhxPu+njG1vwDpenzCnPQzPFACmkf4XBs=
.zoominfo.com/ Name: _cfuvid
Value: 8j8XxMzBcJ5.TdnrdYWadfwHI0ryTyBHh1.Hj.y4Pxo-1686103910229-0-604800000
.linkedin.com/ Name: UserMatchHistory
Value: AQLBHvEDVEZ27wAAAYiTn-dUihca83f0LRCFWyfXJBQg_oz8ujnMOndJVfFzvoWX-yatHgLYnt74_A
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKKXCYONwt-ZAAAAYiTn-dUpGwXwnyNNUM5KH8whwoZW3LikZ9F1A3TzfXYrf7cVWXBmRP0Tuy2AI5n9uF4rQ
.www.linkedin.com/ Name: bscookie
Value: "v=1&202306070211502c2ae138-5de7-40c2-8a2d-7cf01215a02bAQEAZmwKWTNiOtV7eldlkns74LlN1Q0P"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODYxMDM5MTA7MjswMjF2C/bMzgisqOtchk8SQ7yuRU27LL78cLjg6W+1+BjwaA==
.hubspot.com/ Name: __cf_bm
Value: W9uC1YDIZh86uXGDkjacx2Syvm5dOsEBAzS97Vno9NA-1686103910-0-AeNU908gJqOE3XbwjHiRlMFcRUv64aS5ksNpG03zFW+EZ4ncsvjXc71/oGQLruVyvgkFsAU/iakH/FOUBXVf9TQ=
adlumin.com/ Name: __hstc
Value: 74644162.265de4ab0b5d7da8e060cefc7e59a28e.1686103911109.1686103911110.1686103911110.1
adlumin.com/ Name: hubspotutk
Value: 265de4ab0b5d7da8e060cefc7e59a28e
adlumin.com/ Name: __hssrc
Value: 1
adlumin.com/ Name: __hssc
Value: 74644162.1.1686103911110
.adlumin.com/ Name: messagesUtk
Value: b20a4b809ae341899a1ab4b4bb814af7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3431514.fs1.hubspotusercontent-na1.net
adlumin.com
adlumin.wpenginepowered.com
api.hubspot.com
app.hubspot.com
cdn.linkedin.oribi.io
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
forms.hubspot.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.hsleadflows.net
js.usemessages.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
sc.lfeeder.com
snap.licdn.com
static.hsappstatic.net
stats.g.doubleclick.net
tr.lfeeder.com
track.hubspot.com
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
13.107.42.14
141.193.213.10
18.66.192.114
2001:4860:4802:32::36
2001:4860:4802:34::178
2600:9000:225e:3200:4:d7e1:700:93a1
2600:9000:237d:2000:2:53b2:240:93a1
2606:4700::6810:650c
2606:4700::6810:89ce
2606:4700::6811:64ac
2606:4700::6811:6dc7
2606:4700::6811:836e
2606:4700::6812:18c4
2606:4700::6812:863b
2606:4700::6812:8d65
2606:4700::6812:e0f
2606:4700::6813:9a53
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:806::2003
2a00:1450:4001:806::2008
2a00:1450:4001:80b::2004
2a00:1450:4001:80f::200a
2a00:1450:4001:829::2003
2a00:1450:400c:c0c::9b
2a02:26f0:3500:16::215:148d
35.185.12.98
0276ecc6eb34688965af8f6b186f9d79f97505a31dd0cc983c3a3c6182ce97fc
0297edafcd54f53621088094296941c6a77cfb019026eee169349f32ed7af4da
0543d1876bd859425bd8984ac11f0eac32834426eedc15899cb277b84511fd9c
073a6079fa5c55602c328617cae71c68556c5ee1d5980ac51aab8bba61ffd929
07df6e8fe1d38912af3b18403253680bacbb6c58bff226707f0aac4d6bce8e02
083d39b7748a145d540f729bc5d7e75301a1aed0b943e69ef2fd5fca2acb6ef2
1049fae50c8abfe96ebcf379914f9c2691aaeab24ccdc9654acf9930fda7a4bc
112a239ebcf5597c720d13075140da5250b8b33a8cbd07a9b6f46e455a112e82
11787a8b7542fbe98867b211d0e9cea087163816cd3ec38ed231bbc41dc38479
1293e61be98cca98a373d776cff9b16a8637ea75e273e8aaf90a3b3b372705bb
12b42fe6d39673c1e85c63df6ef2906ce0120d5fb1010142b49e9bc09f1bb68a
14be4114dcfde74652f19f9ffae8c9bb50707e9e88bd2b1fcd86fb50224109e7
1c1c1e89fcccad125bb71e5e795545e1c19735ee63cfcb4e2df99e19cc14e8d0
1d016509bcdceb392c3b04f2b3691b706b35c649046fe249b2dd9efc14b9e26b
1e1bce508370a6994bd3e0e67c257f06875e16ca2038c27f498616a0f0d55687
1ec7c042190a170b4826bb36099933781563c611bcaaa5a5e9d406c63124d699
1f263adc7aa1e2753fa89385c468485645f3076acdcc8f0cd81edf00677c7dd4
200d1514b6b8b14cec7f01edbe31a348ca8716022772c1936facf61a338aef0c
203a8a704d1c184b461f12e49f4ef3374f2a54af046381826f90739bf67c13dc
217c9ab482899dd907452152ae6b87ea26e5fc0ee107d4a4ddc35bf239727436
21e9d17948a7b309d6fa4d32665e5dbb35656d796b55f02144a373de1013e9df
22790dd93a3e568eccc84db1a236e0bbf21007eb10a314ed8a364396649edfc4
22ce8e9a15d594adbb0017e75c6c48bbd2ee85f90f5f450ad1c5e332fde17c8e
2380e58b96bbcc7a29d91a0b6cc4b6c9e78294b4eeb2b707670a22ae553bac07
23c18d5450819b3f10a57f7ba33819719dafea8daef0bf4f4c81cb467dc71c89
288bbc61b1fd7bd02c2b83b541df031df382cefda06ff841f1649e5af83201fc
28ed5a75e655731a96ba917679810a9d9f22d5b0d33cd860235e3b82608763c2
29ed674055ed51be81f36c84c23c87a911775bcae6f8d158f4ec43b6f2bd606b
2a6fb021027df3628a394d95bb217f31bc1739932c0d581cdbefe88c78eebbd0
2ee3fb312c4f9dc98ade1b707b255ddfbcbaf18d656de422a17f574f0f7841fb
2f559133e795138a9e4836a6c22f45a9192d8f60bc51d58648840e8150c760a3
315f0c14fd6545931f5a916462fb2f07d4b984731db6da38eb0a204097b9ffa8
33d48d0f2713a68436e4e2d8726adc2541c2950e648b88c50c7bcc4d0c788bdf
36c200dc8adfd56fd5d1ca02e882d27ea1921e4ae06e88da926df6148c068d80
36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66
3832e82ea699d49c21735de895113445cc59f618fe265473a4bca421527844a3
3f0310c1ab27ea2a728f8d5adcc98460dfe171f20e96f03e43593338eda99acd
41121032744ae3e098d01b42d02ee46b3daccb5f691d97c1bc0fe62a514fea28
42b0903c54be2539d57e2b47bcc2ce6970a484eaf1081d712ad40a637f567134
444a2d579e0730495e430d37ba6f4aa4dde136665b5a565749462dfdbf4f207a
4977c0573a102dbccc34e80e55c4822d4adefd5361c0095a45e2f28443c49d53
4a89b0568abfaed7f5443f87ac130aa2d3f3be2551c7281a2e8abe05aa17ce2f
4d900c5255ac8e336b38606f70a16748693db8f6cd5a374f4af5ab1e37c9eb11
4f15165c519a5b39ca782e60dbc18b9d40f4c79ef56b39102ee91f2b8666792f
53c6e25ad853b5a6ad922795465a0e178c87af06b8a7ab3bde53b7b6939902c8
579fc24acea0994521f241400c4a1a511932951a8cedda191380f4a8ad67d467
587927ba416073d732643851c80a8f73f202fbdaf2d409e3bef44a48a8fd6e26
5a105ff63907ec0bf35e5fd98ff61b59ad0ae49fd3d4aecce22f45783633d443
5a36e939c7f4f377f2517e46f736a16f3699054935d671db0cacf3e854252c5b
5a54ad83059bb321221bdac36b08d6806f4de4d5db1695080ffdd80815205c29
5b438219488cb104cc30a2e5ce6dc29a0bc3fa7ebe6d101d7fab1feec1952b06
5bf5262d2b65c72708c054c0e5d9fd374295547d0f1ee4dcb082d11ff7fc8a42
5d9ccc96ded6b593317eced6f7dcf8b6a49cb2d7f9632d7b64df1bee868eac11
5db82c8597446f4cf4eb225f222a0249538d12ebefa8cc7d33833c062fd56ded
5e8cf947efecf3277213601e403872e1afd3ecd0c12595ed3c440a07802e8442
626a1b45dfb726aa02dba6eb4015b75a221174f91f5371b913a60c3a86b92424
645c85c47a096414f80fb2a589c4086ea33b22204c08c2c2db86f45d3bda9ad6
66c3443dee1a703e927e8269976d576393b4b86e551c859b4bebcc45cef6f663
66f7fe1471de5f92502a38fcd2c796e92d3eb0154ec74be74195d93d79eadff6
6893c5cd767bf16f8814ae4b820a8996ed49895f2e9a59fe18a587c094fee8fd
6cb59666c173ea6887d2c29f37c3d2c5ac95d648aad9ad6493a9247af3215192
6d489ed7659a9807cebb71e700fb6ae6ae8b8be566ea5d116be3c4470f57cf1b
7082f515e51ca981be0d22e9647f586770d6cba06de2f73d3d29c47d60918758
715b3f8974434ad1f23845b14088738f2d3d484b77a510559e022ec3ad592216
73d6e5d1826e94ad196ca526bf3e0a373c3309520bb2b7fd4c2fb43d0c259466
7668e9a8ee3f3506685b2269a26f589ef6ada1fdea931242003f1e7db5ddc152
78cc33bc376ddb2777903b0fdded0b9c75417af2f3cbd12a6c9f185da42d2c2e
7a6cc7acf572850a7396cd004598b7d9585fc4cb4256eedcf36472df9f63c24b
7b15ce040beec8eda0d08fba407bbe5ddd1c16144cfb5a9f902aeafde30d08a4
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7befea011c9462df08a59bb28962c266a595bc8776826f15c9dd098b621c9fb0
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7ee6bd4bd09278d65d934110778277ff7f43039d2625930ed3c657049fa00475
7f260ff280b2e54e84e6f9c2790da49cc9abadc457b77d1df4dea121a8c8ab6e
82c512c982d75150bb51f97cb89c9aa15f84dff4fa6a079e844e6e3578aef839
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
9038dbea3c17e614c865c4390694bbc9b2e453859496e709a97d37d9e0866c0b
916826478fe8f1448b2d42ccdb7f1a50eabece238e9c4ea07d79ee3ae23f6f17
9346f80745c549014461e4175c748cf7fb795544f2be0fe2c45dd0eff9643244
9348fa7f55ae75656a1c330fea76789f4ac1f5a05e338902af8b05210e7ef61c
9369f01b809edd4c69b4b8dbe586c6fa0fd737e801d485b11f3ba0a01518e43b
95965900d54c7e7f0ca243ae8770ed860f2eded07a9a2e873e29cc4c44ab486c
96bffdfe121db413dae209a92d4f609fe19105176ac18131d9fce1c457dc2ff7
99e15e21fe8fead546f6621fbc85685a0b22d77da44231a7a50fdf508731caf9
9c054c233ba0597c8d83a9f54fa67bf318ec262c588d2086ac4245f2d16a1ea4
9c5db6ce4dc5dd7260f21f7fcde1b035cfcca54224da6b394cf15e97096d8c80
9ce14806bc51adaa71c9b8832f7c57f18ca8cbfea36fbf94ddf5eec194182ac9
9d115944912fd1a9638bae458938c2fc4497c6339b01f7f9b2680b6430ae0947
a17fa945f3516e5fa99a51e2c4a954d848d9fbbc3a8608083e766f3e71f6c5a7
a39c3cdbdb987dee562a2de964a1d39e27e889fea5e108c3b4ba49fcea2fdc8c
a73f82214e6aa9bd554f0c894fa57d7fe152170c7f4157d610614d088137a41d
a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075
a9e6567358df53f9b31e7eccc1e537dcf6a99cb5924024f1b9cd015bd0c35a9f
ab6a9de18f0239ec6f191049b7c4e1e55066893c8f9cc91cb32a9b36136680d6
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ad664e38b3726ad7583729d98cbc9cdf4200bb8a9f7d5fd2edee2c164275e98a
ae892a0647d1a73896aea016960a1060fec53ac0898a51d5d95d0fe169bc32e9
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af8586fb875a51c0b7a6fdf14d75d3ddf0497771a461d6e852c5375da7f1249a
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1b5e616447d7dd30bb411495b4d2772e6a13f9dbfe917a7211dd8f367cd87bf
b243ae266676dccee611c6ed9eff868b5c1425110010164b31fa120c1fbf26b4
b5c7eb7503144f6cd57bbddb0ad78d77bcad37d88ecf46585dd340a61449661b
b9a3829921f030601d923482197968bd87d9e00904316282225e02756ddf3014
bb290d74839b8966e9bce909665d8df6261aec38566f0888b4650fb105ef6e4d
bb6d369417c05fcafb12428480c1df5c3662aae9982339e8d4228a2171ac8422
bcddae7c91da7bd97a182b850f395405f8345e360f631b475ecf09dfe1068dd4
bdfc85d0363b58d6a764d24b7fc6e76b3d42e7a1da5122001232776a17d8f916
bfd63a3670df6dabce2d1982ee7e058d763cb2fc3fdf4922fc8df7ebad69b151
c1bd651cea184b004cb55a78dbfeabd2768ce75576af8114f4185b640520c06a
c5ec3b8830ed916eebffd15f4518f9a87333b50c3b0c10d108ed239b795c0b2a
ca786bace1f36b0b1d1a2d25124d30eb6a30c7f51f71f3737635698e791e7365
cacbbb7f3cef11f7c7285558291685348abab2396fc8da6ef1388792942cb724
cb04c84b625847684f6b428b2acc5772b549e12d18acf8ca9b6a356cdb661fbc
cc2fc51fc5ade58e3350056a062f6817c41544909061ca953f4aaa41c1ea6d1b
cd09b4ba242a8b4e112ac76ce830dd343409d09e39815b24801672c68e46b311
cf9f44c82cdea699d3a3937cdd8a7caf60ca84cf3d87adfc9fd49fdb84f35261
d3252dd0b99f05fca9861c280ab9df2949ea88206b207a770a8fa8a42dcd3d0c
d3743c6f1dd7dbe1a3677bc1304a36ea74dca1aeb1c5a687cfd4cdf5574e9925
d480d8c899f7bae61b8985b1b73a92b828bb087f57e0c5902f11942ea96750b1
d5773922958407876324a55ff40662ecd526f8829178ab8790a6e8dce853b3f5
d637dae1aa80d0dd5ba985ac364cf9d541e3152949a4f234c010319c8e1f0a02
d77f2bc29b21dcd3e2656f073dd09cc1a658da77bd8d9ab0fcefda0a21fa7fb3
d9ba04e90ac17399077da403dcec63d6cd544ea42152828539571c0b5caccfea
dbdcd13c7b6cefee26516ae098ea682009d06d6054007368b788312b5d03f6e6
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de9dcd951b7dd88f17da2fd7a573b3bf63dd16c9ecada6b61a93acfba7fc299d
df5520815d1855bbe6788df257595be644bf27b1662e485605b2784c70e499b6
dfb99dee1e029d51d6cfb672d847929890b1585402de17f5ed092edd72a688b4
dfced0621406b56297852f394a4b93825c69defcd20ce9e67b439bea504405cb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5069325809fdaac7569d780bfa4b60b59f8ba652fca7f31aa9a7112f48a2fc4
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e9c5b1987a9c832d022b74eeeb75ad59e6d5192cb85584932da668f9d7f6f5c1
ec595c4c1f819f1b18211993b250c2deb88918d06db5b8292f2de9eda0cbd83a
ec96492be8a0ab58dd62f42849c8dc6e344a0183034f4111cc4bc12355117b15
ecdc3e1733b4465431016227c1c31cd75bb931a284b9728a4478217e8a57eee0
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5
ef99bfee0210da514c96937252ea791f0a0552e0aaf5e18513221bec3cd10cca
f09972b6d95a87c5ee3b1e96ddfaf98090fc4229df485fb868efe318644de756
f0aa888761e5eef0bf608f1c73787ae9a925a762932ba393ebd387627a0ad897
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f63669d5736e8a7e1cbc565d3fe5542cd740af555683ba036b081dde590e21fe
f8882fb82e7ca754fe6c804688bb79940d2a5096e01a1a84a13aaec6b4229d65
f89193713a99ccc53de54f35294edd840a87e0c8021aec68a6ce3ad34d777110
fc48c47e11a8c62eab7917b9075a6ee3682ec39e10cbbe21cba552697fc1a443
fcc8a30d38eeacb30158d0d90764bb7a725996874d5884b5017b10cc9ff14a34