www.ired.team Open in urlscan Pro
2606:4700::6812:91 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Submission: On June 16 via manual (June 16th 2021, 2:28:52 pm UTC) from US

Summary HTTP 89 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 21 IPs in 2 countries across 18 domains to perform 89 HTTP transactions. The main IP is 2606:4700::6812:91, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.ired.team.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 27th 2020. Valid for: a year.

This is the only time www.ired.team was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700::68... 2606:4700::6812:91	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:7daf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
29	2606:4700::68... 2606:4700::6812:86f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.129.26 151.101.129.26	54113 (FASTLY) (FASTLY)
4	143.204.98.24 143.204.98.24	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:802::2001	15169 (GOOGLE) (GOOGLE)
2	2606:4700:7::... 2606:4700:7::a29f:9804	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.71.28 172.67.71.28	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3035::6815:327f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2006	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2016	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
8	2600:1901:0:9... 2600:1901:0:94b6::	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
89	21

1 2606:4700::6812:91 (United States)

ASN13335 (CLOUDFLARENET, US)

www.ired.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7daf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2606:4700::6812:86f (United States)

ASN13335 (CLOUDFLARENET, US)

gstatic.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
gblobscdn.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.26 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 143.204.98.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-24.fra50.r.cloudfront.net

cdn.iframe.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh5.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:7::a29f:9804 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn-images-1.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.71.28 (United States)

ASN13335 (CLOUDFLARENET, US)

www.mdsec.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:327f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.lr-ingest.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:1901:0:94b6:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

gitbook-28427.firebaseio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-usc1c-nss-230.firebaseio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	gitbook.com gstatic.gitbook.com gblobscdn.gitbook.com app.gitbook.com www.gitbook.com	2 MB
17	youtube.com www.youtube.com	1 MB
8	firebaseio.com gitbook-28427.firebaseio.com s-usc1c-nss-230.firebaseio.com	3 KB
5	doubleclick.net 1 redirects googleads.g.doubleclick.net static.doubleclick.net	1 KB
5	gstatic.com fonts.gstatic.com www.gstatic.com	48 KB
4	iframe.ly cdn.iframe.ly	21 KB
3	google-analytics.com www.google-analytics.com	19 KB
2	ytimg.com i.ytimg.com	207 KB
2	ggpht.com yt3.ggpht.com	3 KB
2	google.com www.google.com	26 KB
2	mdsec.co.uk www.mdsec.co.uk	32 KB
2	medium.com cdn-images-1.medium.com	58 KB
2	googleusercontent.com lh5.googleusercontent.com	13 KB
1	lr-ingest.io cdn.lr-ingest.io	133 KB
1	polyfill.io polyfill.io	531 B
1	unpkg.com unpkg.com	14 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	ired.team www.ired.team	418 KB
89	18

	Domain	Requested by
19	gblobscdn.gitbook.com	www.ired.team gstatic.gitbook.com
17	www.youtube.com	cdn.iframe.ly www.youtube.com
8	gstatic.gitbook.com	www.ired.team gstatic.gitbook.com
7	s-usc1c-nss-230.firebaseio.com	gstatic.gitbook.com
4	cdn.iframe.ly	www.ired.team gstatic.gitbook.com
3	www.google-analytics.com	gstatic.gitbook.com
3	googleads.g.doubleclick.net	1 redirects www.youtube.com
3	fonts.gstatic.com	fonts.googleapis.com www.youtube.com
2	www.gstatic.com	www.youtube.com
2	i.ytimg.com	www.youtube.com
2	yt3.ggpht.com	www.youtube.com
2	www.google.com	www.youtube.com
2	static.doubleclick.net	www.youtube.com
2	www.mdsec.co.uk	www.ired.team
2	cdn-images-1.medium.com	www.ired.team
2	lh5.googleusercontent.com	www.ired.team gstatic.gitbook.com
1	www.gitbook.com	gstatic.gitbook.com
1	gitbook-28427.firebaseio.com	gstatic.gitbook.com
1	app.gitbook.com	gstatic.gitbook.com
1	cdn.lr-ingest.io	gstatic.gitbook.com
1	polyfill.io	www.ired.team
1	unpkg.com	www.ired.team
1	fonts.googleapis.com	www.ired.team
1	www.ired.team
89	24

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
github.com
twitter.com
www.patreon.com
www.gitbook.com
medium.com
www.mdsec.co.uk

Subject Issuer	Validity	Valid
www.ired.team Cloudflare Inc ECC CA-3	`2020-11-27` - `2021-11-26`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-17` - `2021-08-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-02` - `2021-08-02`	a year	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2020	`2021-06-04` - `2022-07-06`	a year	crt.sh
*.iframe.ly Amazon	`2020-12-17` - `2022-01-15`	a year	crt.sh
*.googleusercontent.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
medium.com Cloudflare Inc ECC CA-3	`2021-05-06` - `2021-08-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-05-24` - `2021-08-16`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-05-24` - `2021-08-16`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2021-05-24` - `2021-08-16`	3 months	crt.sh
firebaseio.com GTS CA 1O1	`2021-01-12` - `2021-07-11`	6 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-24` - `2021-08-16`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Frame ID: 5339793A3EB55D079FB3EB0CDD17BF7F
Requests: 47 HTTP requests in this frame

Frame: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
Frame ID: 9EA67AA26A31B019AEC83FE91202E370
Requests: 18 HTTP requests in this frame

Frame: https://gitbook-28427.firebaseio.com/.lp?start=t&ser=55489355&cb=1&v=5
Frame ID: 2FFFCBE457AE7AAA943962155909CBD9
Requests: 7 HTTP requests in this frame

Frame: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
Frame ID: F4E051ADF51206B626503415C03A71AB
Requests: 18 HTTP requests in this frame

Frame: https://s-usc1c-nss-230.firebaseio.com/.lp?dframe=t&id=9865512&pw=tcs1ePfMpr&ns=gitbook-28427
Frame ID: EE50E43C55FC2E75B43960873BF48549
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/polyfill\.min\.js/i

Page Statistics

89
Requests

98 %
HTTPS

85 %
IPv6

18
Domains

24
Subdomains

21
IPs

2
Countries

3992 kB
Transfer

13942 kB
Size

3
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/in/mantvydasb/
Title: linkedin

Search URL Search Domain Scan URL

URL: https://github.com/mantvydasb/RedTeam-Tactics-and-Techniques
Title: github

Search URL Search Domain Scan URL

URL: https://twitter.com/spotheplanet
Title: @spotheplanet

Search URL Search Domain Scan URL

URL: https://www.patreon.com/iredteam
Title: patreon

Search URL Search Domain Scan URL

URL: https://www.gitbook.com/?utm_source=content&utm_medium=trademark&utm_campaign=mantvydas
Title: Powered by GitBook

Search URL Search Domain Scan URL

URL: https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
Title: https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6

Search URL Search Domain Scan URL

URL: https://www.mdsec.co.uk/2019/03/silencing-cylance-a-case-study-in-modern-edrs/
Title: Silencing Cylance: A Case Study in Modern EDRs – MDSecA Case Study in Modern EDRswww.mdsec.co.uk

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

89 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis Show response
www.ired.team/offensive-security/defense-evasion/ 2 MB
418 KB 140ms
88ms Document
text/html 2606:4700::6812:91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:91 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec0227facf3b97f028e09c3f92c8c7f569046b5dd8ed214b77680a392baacca7

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' gstatic.gitbook.com .gitbook-staging.com .gitbook.com .firebaseio.com wss://.firebaseio.com .cloudfunctions.net .googleapis.com .gstatic.com data: .google.com .github.com .algolianet.com .algolia.net sentry.io .logrocket.io .lr-ingest.io .stripe.com .clearbit.com .google-analytics.com d3hb14vkzrxvla.cloudfront.net d1j8pt39hxlh3d.cloudfront.net .iframe.ly blob: cdn.jsdelivr.net cdnjs.cloudflare.com api.amplitude.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://js.intercomcdn.com https://intercom.help; script-src 'self' gstatic.gitbook.com 'unsafe-inline' .firebaseio.com .google.com polyfill.io cdn.lr-ingest.io cdn.logrocket.io .stripe.com .clearbit.com .google-analytics.com .iframe.ly .gstatic.com cdnjs.cloudflare.com .intercom.io .intercomcdn.com gitbookio.github.io https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' gstatic.gitbook.com 'unsafe-inline' fonts.googleapis.com unpkg.com cdnjs.cloudflare.com cdn.jsdelivr.net; img-src * data: blob: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://messenger-apps.intercom.io https://.intercom-attachments.com; frame-src ; object-src 'none'; child-src 'self' blob:; worker-src 'self' blob:; frame-ancestors https:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.ired.team
:scheme: https
:path: /offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
content-type: text/html; charset=utf-8
cf-ray: 6604b9ae0fc59ac2-FRA
age: 71521
cache-control: public, max-age=86400, s-maxage=86400, stale-while-revalidate=3600, stale-if-error=43200
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding, Authorization, Cookie, X-CDN-Host
cf-cache-status: HIT
cf-request-id: 0ab6d260c400009ac2bdaf0000000001
content-security-policy: default-src 'self' gstatic.gitbook.com *.gitbook-staging.com *.gitbook.com *.firebaseio.com wss://*.firebaseio.com *.cloudfunctions.net *.googleapis.com *.gstatic.com data: *.google.com *.github.com *.algolianet.com *.algolia.net sentry.io *.logrocket.io *.lr-ingest.io *.stripe.com *.clearbit.com *.google-analytics.com d3hb14vkzrxvla.cloudfront.net d1j8pt39hxlh3d.cloudfront.net *.iframe.ly blob: cdn.jsdelivr.net cdnjs.cloudflare.com api.amplitude.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://js.intercomcdn.com https://intercom.help; script-src 'self' gstatic.gitbook.com 'unsafe-inline' *.firebaseio.com *.google.com polyfill.io cdn.lr-ingest.io cdn.logrocket.io *.stripe.com *.clearbit.com *.google-analytics.com *.iframe.ly *.gstatic.com cdnjs.cloudflare.com *.intercom.io *.intercomcdn.com gitbookio.github.io https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' gstatic.gitbook.com 'unsafe-inline' fonts.googleapis.com unpkg.com cdnjs.cloudflare.com cdn.jsdelivr.net; img-src * data: blob: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://messenger-apps.intercom.io https://*.intercom-attachments.com; frame-src *; object-src 'none'; child-src 'self' blob:; worker-src 'self' blob:; frame-ancestors https:
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
function-execution-id: hfdn61r7idry
referrer-policy: no-referrer-when-downgrade
x-cdn-cache-group: -LFEMnER3fywgFHoroYn
x-cloud-trace-context: eb4bcbf9c50e0e5e89297ecb06c732ff
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
server: cloudflare
content-encoding: gzip

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 34ms
14ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Code+Pro:500&display=swap

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6da43a0ac4abcb5bc4b10164a762759e5cc81f37e00033643034a891fb490c82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 16 Jun 2021 13:02:30 GMT
server: ESF
date: Wed, 16 Jun 2021 14:28:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 16 Jun 2021 14:28:33 GMT

GET
H2 200 emojione-sprite-40.min.css
unpkg.com/emojione-assets@4.0.0/sprites/ 183 KB
14 KB 62ms
41ms Stylesheet
text/css 2606:4700::6810:7daf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/emojione-assets@4.0.0/sprites/emojione-sprite-40.min.css

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7405472
vary: Accept-Encoding
cf-request-id: 0ab6d2613a000032600d323000000001
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"2dc7c-MlEndlChcp6B66cJCh5yD8CB/Fo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: e0ac7d85fe9bfe99ddd0e0018c758a56
cache-control: public, max-age=31536000
cf-ray: 6604b9aec80a3260-FRA

GET
H2 200 6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 1 KB
1 KB 75ms
39ms Stylesheet
text/css 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4757653
cf-polished: origSize=1701
x-guploader-uploadid: ABg5-UwiIdAcAjrmRlFxwdUIs61NAokkry_-iZ807hfyhPF7n05ywV-MhhKGJXAj1nhFXaaZ1Wx1tw1RuwfcZvRBTHA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/css
cf-request-id: 0ab6d2615000004ea4dd9ff000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation: 1617785029532093
access-control-allow-origin: *
expires: Thu, 21 Apr 2022 20:23:08 GMT
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1701
cf-ray: 6604b9aeef164ea4-FRA
cf-bgj: minify

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 72 B
531 B 69ms
28ms Script
text/javascript 151.101.129.26
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?flags=gated&features=Intl

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.26 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 652065
detected-user-agent: Chrome/89.0.4389
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length: 74
referrer-policy: origin-when-cross-origin
last-modified: Tue, 08 Jun 2021 17:58:54 GMT
date: Wed, 16 Jun 2021 14:28:33 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/89.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 embed.js Show response
cdn.iframe.ly/ 22 KB
7 KB 79ms
24ms Script
application/javascript 143.204.98.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iframe.ly/embed.js
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-24.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 0226f11690adfd32f7a6c13588d35e8b59ab0ab7446919a154c2bd249da93434

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 16:59:40 GMT
content-encoding: br
last-modified: Fri, 30 Apr 2021 13:27:40 GMT
server: nginx
age: 77333
etag: W/"608c05cc-5630"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: NmyWViiL-d1V5Fkbz941hv36zZCjg_67apEQiL4KBuwBYI565cyERQ==
via: 1.1 055d899361491602a9ef1eb0cdc5e337.cloudfront.net (CloudFront)

GET
H2 200 spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 28 KB
29 KB 80ms
46ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?alt=media
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 4693498
x-guploader-uploadid: ABg5-UzTfWJh6V0B0k2lFPabkrMdmvV3nYkpS2yXi96O2qwxzor09DJgESW3o58wiAWT6dRVCB72aizzWA6t6Q6FplW3MkbWYA
x-goog-storage-class: STANDARD
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
content-type: image/png
content-length: 29066
cf-request-id: 0ab6d2614c00004e80792a3000000001
last-modified: Sat, 08 Sep 2018 20:00:14 GMT
server: cloudflare
etag: "2965c5f978755802debc0291c5574853"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation: 1536436814766237
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 29066
x-goog-meta-firebasestoragedownloadtokens: 1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges: bytes
cf-ray: 6604b9aed8db4e80-FRA
expires: Sat, 23 Apr 2022 06:43:34 GMT

GET
H2 200 photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 7 KB
7 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 12:22:15 GMT
x-content-type-options: nosniff
age: 7578
content-disposition: inline;filename=""
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6707
x-xss-protection: 0
server: fife
etag: "v5e"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 13 Jun 2021 05:06:22 GMT

GET
H2 200 iframe Show response
cdn.iframe.ly/api/ Frame 9EA6 8 KB
3 KB 78ms
29ms Document
text/html 143.204.98.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iframe.ly/api/iframe?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D7hP9HcaZtyA&key=4fb668ebc74b721f3c2230d81634c8bc
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-24.fra50.r.cloudfront.net
Software: nginx / iframe.ly
Resource Hash: 337c76ece4cf0aede97845625fbe3063251f24cc43c46f5a70c92d2df6d338b6

Request headers

:method: GET
:authority: cdn.iframe.ly
:scheme: https
:path: /api/iframe?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D7hP9HcaZtyA&key=4fb668ebc74b721f3c2230d81634c8bc
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Response headers

content-type: text/html; charset=utf-8
server: nginx
date: Wed, 16 Jun 2021 14:04:11 GMT
x-powered-by: iframe.ly
access-control-allow-origin: *
cache-control: public, max-age=3600
expires: Wed, 16 Jun 2021 15:04:11 GMT
etag: W/"002a4b3aeebbe71a4248af274fc10375"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 055d899361491602a9ef1eb0cdc5e337.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 7DJ9KMa5kqAqWgfOIKQRMFJxvpKO6MFJohUQSbUK64VYpN5R0piKBQ==
age: 1462

GET
H2 200 111.f142f50e.js Show response
gstatic.gitbook.com/js/ 3 MB
945 KB 69ms
51ms Script
application/javascript 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb929919479b2afe4e756a8ab718e9adbc8d94dbd0504da1cf4cea2b252833cc

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4693499
cf-polished: origSize=3418521
x-guploader-uploadid: ABg5-Uz3PpVS5rmLAQqyx-Bv43SHB5qBoEgLF9EGcOUffq1ADGmF9a4Yz68fHeL2roHduhQQGD7FQcctPucVTg5fsEA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: application/javascript
cf-request-id: 0ab6d2617500003250350fc000000001
expires: Fri, 22 Apr 2022 15:46:59 GMT
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: W/"876655ac803da8f0cf014bda9a896170"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=B4hFnA==, md5=h2ZVrIA9qPDPAUvamolhcA==
x-goog-generation: 1617785029720049
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3418521
cf-ray: 6604b9af2ad63250-FRA
cf-bgj: minify

GET
H2 200 1*fNWQ3Rr0v1sCGy5pqkGS3A.png
cdn-images-1.medium.com/max/1368/ 29 KB
29 KB 72ms
51ms Image
image/png 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/max/1368/1*fNWQ3Rr0v1sCGy5pqkGS3A.png

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1383858d1e421fbfcfbe7925ad8691c402df16d682e4dfd0177513fe55de66a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 891354
x-envoy-upstream-service-time: 31
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 29367
cf-request-id: 0ab6d261bb00004edf32315000000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20210524-162717-f383c62fea
accept-ranges: bytes
cf-ray: 6604b9af889a4edf-FRA
expires: Fri, 16 Jul 2021 14:28:33 GMT

GET
H2 200 Cylance_company_logo.png
www.mdsec.co.uk/wp-content/uploads/2019/03/ 15 KB
16 KB 111ms
47ms Image
image/png 172.67.71.28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mdsec.co.uk/wp-content/uploads/2019/03/Cylance_company_logo.png
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd440068e8dbc8285996a56a566503f74d6997af7f03439c8d6b89583b825787

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7177
cf-polished: origSize=20881
content-length: 15849
cf-request-id: 0ab6d261f000004e9e5828a000000001
last-modified: Sat, 18 Jul 2020 18:49:16 GMT
server: cloudflare
etag: "5191-5aabbbaffc59c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qIfcODY%2FcnHEz7GHM96B5iQGneSnXA1gNBMy3Ptbqr%2Fb33axkMhXZUYGlKVDttGPflZCIPnj9pYtsJc4RujqZgQNlRv%2FWzU5Q2%2BLPR0YYIGRrDImljYoF3rtcXg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6604b9afebfe4e9e-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 f4fa50c4003f87e7dc10459e500933c3.woff
gstatic.gitbook.com/fonts/ 92 KB
93 KB 27ms
26ms Font
font/woff 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/f4fa50c4003f87e7dc10459e500933c3.woff
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 4692212
x-guploader-uploadid: ABg5-UxyEzdcNSdaJtXWOu_1a_Udqa_IwHrRlOjvAN1WdWLiRwt_LkJphbV5J8YSQYHy5mSn7RZDeP804aUQsKcyUKyG167dEA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: font/woff
content-length: 94368
cf-request-id: 0ab6d261a7000032502ea5f000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: "f4fa50c4003f87e7dc10459e500933c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=FUjfEA==, md5=9PpQxAA/h+fcEEWeUAkzww==
x-goog-generation: 1617785029592662
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94368
accept-ranges: bytes
cf-ray: 6604b9af7b7a3250-FRA
expires: Wed, 20 Apr 2022 06:41:18 GMT

GET
H2 200 72e37e5bf95a8dba938c78b1d7d91253.woff
gstatic.gitbook.com/fonts/ 92 KB
92 KB 34ms
34ms Font
font/woff 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/72e37e5bf95a8dba938c78b1d7d91253.woff
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 4692211
x-guploader-uploadid: ABg5-UzxMRvnWuUe4Am1soA1IEY0fTbTsCQH3JGMbwYAJB2ar3ndl9M08YuIU70qf4xw3V9sSwauwoM0moUUX62ZaFzL1i-mvQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: font/woff
content-length: 94040
cf-request-id: 0ab6d261a8000032507f0f6000000001
last-modified: Fri, 19 Mar 2021 17:17:25 GMT
server: cloudflare
etag: "72e37e5bf95a8dba938c78b1d7d91253"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=TBIniA==, md5=cuN+W/lajbqTjHix19kSUw==
x-goog-generation: 1616174245162428
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94040
accept-ranges: bytes
cf-ray: 6604b9af7b7b3250-FRA
expires: Wed, 06 Apr 2022 19:16:43 GMT

GET
H2 200 fc3d4b35e4d07d4e0485cc2db0e57c77.woff
gstatic.gitbook.com/fonts/ 92 KB
92 KB 29ms
29ms Font
font/woff 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/fc3d4b35e4d07d4e0485cc2db0e57c77.woff
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 2911819
x-guploader-uploadid: ABg5-UwGan3w8btTIOf0-1SNEwpK9JOOZoD4LEnV2f8danvAeKtwlLE3CqzpT_qB0OsDZnlApI2ADMahkX2V5j6snsU
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: font/woff
content-length: 93788
cf-request-id: 0ab6d261a9000032504b957000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: "fc3d4b35e4d07d4e0485cc2db0e57c77"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=7TN+QQ==, md5=/D1LNeTQfU4EhcwtsOV8dw==
x-goog-generation: 1613469465501597
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 93788
accept-ranges: bytes
cf-ray: 6604b9af7b833250-FRA
expires: Wed, 20 Apr 2022 06:26:20 GMT

GET
H2 200 HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq.woff2
fonts.gstatic.com/s/sourcecodepro/v14/ 13 KB
14 KB 25ms
6ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f29cd3a2bdcacf9f9f7285c9b74d89f55634f4d43752d81a48914afa7442eb66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ired.team
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 03:36:30 GMT
x-content-type-options: nosniff
age: 384723
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13540
x-xss-protection: 0
last-modified: Wed, 24 Mar 2021 17:51:24 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 03:36:30 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBCoqPbTxHufU7LzR9%2FScreenshot%20from%202019-04-19%2000-04-00.png
gblobscdn.gitbook.com/ 21 KB
21 KB 44ms
42ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBCoqPbTxHufU7LzR9%2FScreenshot%20from%202019-04-19%2000-04-00.png?alt=media&token=9e4bcd77-d8d9-4dcc-b099-d8e39a28d316
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99f65b3924546660202c56a0ea9287f6ab7276c51b3e9d7153c500c3a52d1506

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 891352
x-guploader-uploadid: ABg5-UzNFrMGfpOg76XmNuttLvHzOv8KcKqJkOZIK-vtKsbNCwwrrtEoJG75aqIHW1uUevKWonyDB9n33EgZZtvSAFCVCh4Ynw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-19%2000-04-00.png
content-type: image/png
content-length: 21380
cf-request-id: 0ab6d2620400004e806a92b000000001
last-modified: Tue, 23 Apr 2019 22:04:44 GMT
server: cloudflare
etag: "d2079bfe53dfb0eabda1965598970672"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=M6FgDQ==, md5=0geb/lPfsOq9oZZVmJcGcg==
x-goog-generation: 1556057084009317
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 21380
x-goog-meta-firebasestoragedownloadtokens: 9e4bcd77-d8d9-4dcc-b099-d8e39a28d316
accept-ranges: bytes
cf-ray: 6604b9b00c404e80-FRA
expires: Mon, 06 Jun 2022 06:52:41 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBCxasFUTWwd_Fbkty%2FScreenshot%20from%202019-04-18%2023-28-34.png
gblobscdn.gitbook.com/ 7 KB
8 KB 52ms
49ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBCxasFUTWwd_Fbkty%2FScreenshot%20from%202019-04-18%2023-28-34.png?alt=media&token=445f824d-913f-4470-8986-aecbaad20594
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65f08d830fee3f9441bad3dbf98bd71aa2743aa9c5176fc93353545444a1737b

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 3513876
x-guploader-uploadid: ABg5-Uz-9GhQkZ5ZwOJfjigjMTNVbfEriUSTTlN-NdDkrij2yA4PctZP4UXbyUoRfRU-BGJTnRTn7_sbIaAJqoyVoMp4PubAwA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-28-34.png
content-type: image/png
content-length: 7527
cf-request-id: 0ab6d2620400004e806d037000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "12685e10b5361aa17aac8a56ed2aa717"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=LylA9w==, md5=EmheELU2GqF6rIpW7SqnFw==
x-goog-generation: 1556057083949440
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 7527
x-goog-meta-firebasestoragedownloadtokens: 445f824d-913f-4470-8986-aecbaad20594
accept-ranges: bytes
cf-ray: 6604b9b00c474e80-FRA
expires: Fri, 06 May 2022 22:23:56 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBD56sqdh0kZGVvlou%2FScreenshot%20from%202019-04-18%2023-39-47.png
gblobscdn.gitbook.com/ 7 KB
7 KB 41ms
39ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBD56sqdh0kZGVvlou%2FScreenshot%20from%202019-04-18%2023-39-47.png?alt=media&token=38a0d8d5-4593-4a46-a3ad-2ba7d3c6e832
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e93ae0ee86f96e98d740acc26d5298c4ba647cf70764c9125d18bccb5287796

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 3779272
x-guploader-uploadid: ABg5-UykcZmEbq0YSUF0joFjQ43tKvONouetZMBH3tflGYsCyvdwaZ_hLkp8Bb9oLZ2XSGesJSFeLJ_LtWlV3g7DXQP9aNYLyA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-39-47.png
content-type: image/png
content-length: 6663
cf-request-id: 0ab6d2620600004e8083123000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "95d95b9c72d3bf3759fda97dd4eeb55f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Mchffg==, md5=ldlbnHLTvzdZ/al91O61Xw==
x-goog-generation: 1556057083755010
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 6663
x-goog-meta-firebasestoragedownloadtokens: 38a0d8d5-4593-4a46-a3ad-2ba7d3c6e832
accept-ranges: bytes
cf-ray: 6604b9b00c4b4e80-FRA
expires: Tue, 03 May 2022 20:40:41 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDBC7b4Xp77fPrfdO%2FScreenshot%20from%202019-04-18%2023-41-59.png
gblobscdn.gitbook.com/ 4 KB
4 KB 35ms
33ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDBC7b4Xp77fPrfdO%2FScreenshot%20from%202019-04-18%2023-41-59.png?alt=media&token=23d37e81-c5c6-4102-bfba-6357b43e337a
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 429fa33aba08cdbcede02dd082255bba7faa54ff019a576c936ac942a807ddd6

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 3740707
x-guploader-uploadid: ABg5-UzrXOHNI3AIrVQ0e_KieF_fYsmcr6Q2KmjECKs8OYaE1V9OAfT38HQdsuwOBDvrSSPB7d30C2qUppaeBjb0iFx8-EHzFg
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-41-59.png
content-type: image/png
content-length: 3760
cf-request-id: 0ab6d2620300004e803d199000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "87d69c9d7ead4e8bf348178624966253"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=YQYGEQ==, md5=h9acnX6tTovzSBeGJJZiUw==
x-goog-generation: 1556057083992805
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3760
x-goog-meta-firebasestoragedownloadtokens: 23d37e81-c5c6-4102-bfba-6357b43e337a
accept-ranges: bytes
cf-ray: 6604b9b00c4e4e80-FRA
expires: Wed, 04 May 2022 07:23:26 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDEXTL40YFa1-84Bb%2FScreenshot%20from%202019-04-18%2023-44-31.png
gblobscdn.gitbook.com/ 25 KB
26 KB 48ms
46ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDEXTL40YFa1-84Bb%2FScreenshot%20from%202019-04-18%2023-44-31.png?alt=media&token=eee77813-09cb-4951-9919-88c4b000fce9
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43a3740ee76f0d181f893a127a3cdbdfedf9779670ca56642859e1dd7643d02e

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 3464511
x-guploader-uploadid: ABg5-UzRC95JKMBZDOrtk0Rkijm8mQHWqW4JU08Yga7SAtJyq68Ua2KpnzZzShAw1mmWnFFzfGLOkrQQTd3-WDcs5UEtZ2_rvQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-44-31.png
content-type: image/png
content-length: 26024
cf-request-id: 0ab6d2620600004e80b011b000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "cb7b0eaa3ae7fc4739ae197ea6e1594f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=P5oC7Q==, md5=y3sOqjrn/Ec5rhl+puFZTw==
x-goog-generation: 1556057083748277
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 26024
x-goog-meta-firebasestoragedownloadtokens: eee77813-09cb-4951-9919-88c4b000fce9
accept-ranges: bytes
cf-ray: 6604b9b00c4f4e80-FRA
expires: Sat, 07 May 2022 12:06:41 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDHuVJhw-3ubLaCPs%2FScreenshot%20from%202019-04-18%2023-57-31.png
gblobscdn.gitbook.com/ 13 KB
13 KB 35ms
33ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDHuVJhw-3ubLaCPs%2FScreenshot%20from%202019-04-18%2023-57-31.png?alt=media&token=90b39d40-1254-4e9f-929c-69c9668c1cc6
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9be596f2db501153d6ea13bc7ea2c6bad86f00c8ae2b5f93e944165ed633b65

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 3464511
x-guploader-uploadid: ABg5-Uy8NFsoHOj7ZRgJTcRcqMlgkoM3NDUAH4eSYoxvEzFM9qIpAua7NZY-fY2hlbuD_e3U2LfhdXyT59T1YpFmMIdk23wqXg
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-57-31.png
content-type: image/png
content-length: 12839
cf-request-id: 0ab6d2620500004e80b9afd000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "d06f2746bea1ffdbbe6b309c5013c6f6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=jfrr9Q==, md5=0G8nRr6h/9u+azCcUBPG9g==
x-goog-generation: 1556057083749411
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 12839
x-goog-meta-firebasestoragedownloadtokens: 90b39d40-1254-4e9f-929c-69c9668c1cc6
accept-ranges: bytes
cf-ray: 6604b9b00c574e80-FRA
expires: Sat, 07 May 2022 12:06:42 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDLHZWSiph5XErfBY%2FScreenshot%20from%202019-04-19%2000-17-09.png
gblobscdn.gitbook.com/ 4 KB
4 KB 84ms
83ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDLHZWSiph5XErfBY%2FScreenshot%20from%202019-04-19%2000-17-09.png?alt=media&token=c2986940-650d-4c7f-bddb-de4b78eeec26
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5fe0c569ed4d498ca5d4a9b47e513217c1bb8c03712b040db0fdea592d218725

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 3740707
x-guploader-uploadid: ABg5-Uwjedhy_sTn8yIdOfvCaXeB8HkeMSMogsVrrJozyxj8M57n4HYkHKk4FgiAg_rz3V0v-ccw0vrMjBTLoTNBK20OJRAxYw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-19%2000-17-09.png
content-type: image/png
content-length: 3784
cf-request-id: 0ab6d2620600004e808836b000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "03bd6f029c278f79caf2ac45710f33f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=9nfa8Q==, md5=A71vApwnj3nK8qxFcQ8z8g==
x-goog-generation: 1556057083729448
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3784
x-goog-meta-firebasestoragedownloadtokens: c2986940-650d-4c7f-bddb-de4b78eeec26
accept-ranges: bytes
cf-ray: 6604b9b00c5a4e80-FRA
expires: Wed, 04 May 2022 07:23:26 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDWfI9LCXB-RgrZkC%2FScreenshot%20from%202019-04-19%2000-18-40.png
gblobscdn.gitbook.com/ 9 KB
10 KB 41ms
40ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDWfI9LCXB-RgrZkC%2FScreenshot%20from%202019-04-19%2000-18-40.png?alt=media&token=d25a86de-dae4-4a1e-a33b-b75d614eaa73
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12a47375c2e9ebcdcf7901998b514b6e48f9b7adedafc3ee0a20b330da01cd2f

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 1051976
x-guploader-uploadid: ABg5-Uz3tr_8l9evOMb5dByTZDMwC9AFXQ1A3xorUmMnFUxUSWHHDmI2OsQyweDaDZMVEf5QrlgayRRWs569gcRIYaI16zFQBw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-19%2000-18-40.png
content-type: image/png
content-length: 9331
cf-request-id: 0ab6d2620600004e8094846000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "dae0a0017461c572303f262af03040e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Jw37rw==, md5=2uCgAXRhxXIwPyYq8DBA4g==
x-goog-generation: 1556057083950310
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 9331
x-goog-meta-firebasestoragedownloadtokens: d25a86de-dae4-4a1e-a33b-b75d614eaa73
accept-ranges: bytes
cf-ray: 6604b9b00c5c4e80-FRA
expires: Sat, 04 Jun 2022 10:15:36 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDbR3flvNHEZ50M8Z%2FScreenshot%20from%202019-04-18%2023-34-05.png
gblobscdn.gitbook.com/ 64 KB
64 KB 70ms
69ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDbR3flvNHEZ50M8Z%2FScreenshot%20from%202019-04-18%2023-34-05.png?alt=media&token=2f2b2f16-0ca3-4444-aec1-843e4a385f67
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f26fc0c7805e3c161370aa37856ae518c9259f744ec44473daff8c5ac5b0586

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:33 GMT
cf-cache-status: HIT
age: 3464511
x-guploader-uploadid: ABg5-UxHjMgR02Pnlb-5atKx-_Ixn1zpCpdTX4IYPeVS6AhHBNbX19C9HrqSF3yOfz6-zYkQnaYYcBjXxLUPeeloWVV-tcw3gg
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-34-05.png
content-type: image/png
content-length: 65198
cf-request-id: 0ab6d2620600004e80bba87000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "cbb6ec5ab7e4d572ab7bcb72950e6351"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=2U+FXw==, md5=y7bsWrfk1XKre8tylQ5jUQ==
x-goog-generation: 1556057083922818
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 65198
x-goog-meta-firebasestoragedownloadtokens: 2f2b2f16-0ca3-4444-aec1-843e4a385f67
accept-ranges: bytes
cf-ray: 6604b9b00c5d4e80-FRA
expires: Sat, 07 May 2022 12:06:42 GMT

GET
H2 200 7hP9HcaZtyA Show response
www.youtube.com/embed/ Frame 9EA6 53 KB
22 KB 82ms
62ms Document
text/html 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Requested by

Host: cdn.iframe.ly
URL: https://cdn.iframe.ly/api/iframe?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D7hP9HcaZtyA&key=4fb668ebc74b721f3c2230d81634c8bc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2b06784ec9a61676e2d505d486939b636b1d05560c4cb81c28298005d4108575

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/7hP9HcaZtyA?rel=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cdn.iframe.ly/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cdn.iframe.ly/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 16 Jun 2021 14:28:34 GMT
strict-transport-security: max-age=31536000
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=mSc79usAXbA; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none VISITOR_INFO1_LIVE=EcvnHqswAcs; Domain=.youtube.com; Expires=Mon, 13-Dec-2021 14:28:34 GMT; Path=/; Secure; HttpOnly; SameSite=none CONSENT=PENDING+454; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 logger.min.js Show response
cdn.lr-ingest.io/ 715 KB
133 KB 89ms
70ms Script
text/javascript 2606:4700:3035::6815:327f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.lr-ingest.io/logger.min.js

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:327f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b269df1356bec1c74e9ba7ffe0eae57c7d8edb60ac5539d24d95de08c8d064b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
content-encoding: br
vary: x-fh-requested-host, accept-encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 280
x-cache: HIT
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0ab6d262be00004e7f823a8000000001
x-served-by: cache-fra19128-FRA
last-modified: Tue, 15 Jun 2021 20:36:56 GMT
server: cloudflare
x-timer: S1623789609.328709,VS0,VE1
etag: W/"fc81c79ef7f05a0ca69750d4cc6ecc91a9634790b278f43f9c234d6f60c2354c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31556926
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cNTVK9W9kGnzKjzn9rFLkCtMBzL0BtQ0OkmVd778BlFmyvyN6U2FsUhwrTA9%2FjVe%2B38R%2F2uihBPoDmfocuu3kL13OzZAoFuDdRtNG%2F8Ps8hUpAra7TPAS1gt%2BbZKHOJjGBVEPkDaDJPn6g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 6604b9b12dee4e7f-FRA
x-cache-hits: 1

GET
H2 200 __session Show response
app.gitbook.com/ 52 B
620 B 215ms
206ms Fetch
application/json 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.gitbook.com/__session?proposed=6b5cffcf-990f-46af-9ae4-2f8a427dd40bR
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 2f09c0c1ee961a0aa3b26a18e9aded3030c2ae567a7e8de045f87d491a1ae59d

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
x-magic-hash: 590b4fe02dc55aa9fde6dfdbc1a33d82273fc9c6a576984b78f97aca99a7ec32
x-powered-by: Express
x-cache: MISS
x-release: gitbook-28427-6.25.11
cf-request-id: 0ab6d263de00004ea4d02f7000000001
access-control-allow-origin: https://www.ired.team
server: cloudflare
etag: W/"34-zu9nzoTOBHenx6N8TCv/tk7RAmw"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
via: no cache
x-cloud-trace-context: 810948a52ee88b2039a97b9dae089b70
cache-control: private
access-control-allow-credentials: true
function-execution-id: bgutguv4e8b7
cf-ray: 6604b9b2fb2e4ea4-FRA
expires: Wed, 16 Jun 2021 14:28:34 GMT

GET
H3-29 200 www-player-webp.css
www.youtube.com/s/player/997fe684/ Frame 9EA6 359 KB
45 KB 21ms
6ms Stylesheet
text/css 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb2261167a008616c0620bf0bec8a9b6969ff99250864f3e8702b3c59c9ee175

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84334
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46281
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:03:00 GMT

GET
H3-29 200 www-embed-player.js Show response
www.youtube.com/s/player/997fe684/www-embed-player.vflset/ Frame 9EA6 194 KB
64 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3648ff9c18270446e4106c1b332ea27992dc0ac33e1b1b2d35f4ed59598eee71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84484
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65602
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:30 GMT

GET
H3-29 200 base.js Show response
www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/ Frame 9EA6 2 MB
483 KB 32ms
18ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

823b19bdfd38969d4800b9e876b4d11eba38e00bd576e5e11c60bb0d20aa168f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84484
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 494431
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:30 GMT

GET
H3-29 200 fetch-polyfill.js Show response
www.youtube.com/s/player/997fe684/fetch-polyfill.vflset/ Frame 9EA6 8 KB
3 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84484
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2830
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:30 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 9EA6 15 KB
15 KB 20ms
6ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.youtube.com
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 04:48:34 GMT
x-content-type-options: nosniff
age: 380400
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 04:48:34 GMT

GET
BLOB 200
OK b4c630ac-89d9-40bd-9515-1d0990a7a8a0
https://www.ired.team/ 406 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.ired.team/b4c630ac-89d9-40bd-9515-1d0990a7a8a0
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c44180e29960bd5cfc40c11b874d7fba61d2756a9b6868dce8c13a707c40202

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 416100

GET
H3-29

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame 9EA6
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

113 B
161 B

28ms
14ms

XHR
application/json

2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43cfe82acc865a830725f59b0397227d3f914c194a4675476375ed4c65deefc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 16 Jun 2021 14:28:34 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame 9EA6 29 B
424 B 26ms
6ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:14:00 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
age: 874
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
expires: Wed, 16 Jun 2021 14:29:00 GMT

GET
H3-29 200 remote.js Show response
www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/ Frame 9EA6 93 KB
29 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5dee1ca0646a4d4b316fd25e6f4ffda67f3650ff369522b7d8aef3b70ac15ef1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:52 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84462
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29283
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:52 GMT

GET
H2 200 Fgp6JbVAIDw6L-khUL8_4GfhXpb-l_w93hK8L7OfCkE.js Show response
www.google.com/js/th/ Frame 9EA6 35 KB
13 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/Fgp6JbVAIDw6L-khUL8_4GfhXpb-l_w93hK8L7OfCkE.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a7a25b540203c3a2fe92150bf3fe067e15e96fe97fc3dde12bc2fb39f0a41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 08:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 366910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13288
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 13:30:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 12 Jun 2022 08:33:24 GMT

GET
H3-29 200 embed.js Show response
www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/ Frame 9EA6 25 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a14b9320954426385bad57a756c93f0b5c8a16ad429fc1e792ad2da69dd1a305

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84480
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7448
x-xss-protection: 0
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 15 Jun 2022 15:00:34 GMT

GET
DATA 200
OK truncated
/ Frame 9EA6 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 AAUvwnhIG3UNHEO4aHTEm3W-xHmV9Nu4jsB9sWGc_Eqn=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 9EA6 1 KB
2 KB 27ms
6ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AAUvwnhIG3UNHEO4aHTEm3W-xHmV9Nu4jsB9sWGc_Eqn=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

43a29d1168b34810477ab73bca382e5f7d6157d09dce9d19ef6ebeb4012b39bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 10:33:57 GMT
x-content-type-options: nosniff
age: 14077
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1386
x-xss-protection: 0
server: fife
etag: "v2b2b"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 13 Jun 2021 13:29:49 GMT

GET
H2 200 maxresdefault.webp
i.ytimg.com/vi_webp/7hP9HcaZtyA/ Frame 9EA6 103 KB
104 KB 36ms
16ms Image
image/webp 2a00:1450:4001:800::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi_webp/7hP9HcaZtyA/maxresdefault.webp

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d841c8422feb1b339c0fba65b24972423b4129769dfb5eb547fa35985f441561

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
x-content-type-options: nosniff
server: sffe
age: 0
etag: "0"
vary: Origin
content-type: image/webp
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 105702
x-xss-protection: 0
expires: Wed, 16 Jun 2021 16:28:34 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 9EA6 4 KB
2 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
x-content-type-options: nosniff
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
expires: Wed, 16 Jun 2021 14:28:34 GMT

GET
H3-29 204 generate_204
www.youtube.com/ Frame 9EA6 0
9 B 6ms
6ms Image
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?rGmYDw
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBCxasFUTWwd_Fbkty%2FScreenshot%20from%202019-04-18%2023-28-34.png
gblobscdn.gitbook.com/ 7 KB
8 KB 58ms
58ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBCxasFUTWwd_Fbkty%2FScreenshot%20from%202019-04-18%2023-28-34.png?alt=media&token=445f824d-913f-4470-8986-aecbaad20594
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65f08d830fee3f9441bad3dbf98bd71aa2743aa9c5176fc93353545444a1737b

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3513877
x-guploader-uploadid: ABg5-Uz-9GhQkZ5ZwOJfjigjMTNVbfEriUSTTlN-NdDkrij2yA4PctZP4UXbyUoRfRU-BGJTnRTn7_sbIaAJqoyVoMp4PubAwA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-28-34.png
content-type: image/png
content-length: 7527
cf-request-id: 0ab6d265fa00004e809a9c8000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "12685e10b5361aa17aac8a56ed2aa717"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=LylA9w==, md5=EmheELU2GqF6rIpW7SqnFw==
x-goog-generation: 1556057083949440
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 7527
x-goog-meta-firebasestoragedownloadtokens: 445f824d-913f-4470-8986-aecbaad20594
accept-ranges: bytes
cf-ray: 6604b9b65f524e80-FRA
expires: Fri, 06 May 2022 22:23:56 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBD56sqdh0kZGVvlou%2FScreenshot%20from%202019-04-18%2023-39-47.png
gblobscdn.gitbook.com/ 7 KB
7 KB 40ms
40ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBD56sqdh0kZGVvlou%2FScreenshot%20from%202019-04-18%2023-39-47.png?alt=media&token=38a0d8d5-4593-4a46-a3ad-2ba7d3c6e832
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e93ae0ee86f96e98d740acc26d5298c4ba647cf70764c9125d18bccb5287796

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3779273
x-guploader-uploadid: ABg5-UykcZmEbq0YSUF0joFjQ43tKvONouetZMBH3tflGYsCyvdwaZ_hLkp8Bb9oLZ2XSGesJSFeLJ_LtWlV3g7DXQP9aNYLyA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-39-47.png
content-type: image/png
content-length: 6663
cf-request-id: 0ab6d265f800004e803a210000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "95d95b9c72d3bf3759fda97dd4eeb55f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Mchffg==, md5=ldlbnHLTvzdZ/al91O61Xw==
x-goog-generation: 1556057083755010
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 6663
x-goog-meta-firebasestoragedownloadtokens: 38a0d8d5-4593-4a46-a3ad-2ba7d3c6e832
accept-ranges: bytes
cf-ray: 6604b9b65f764e80-FRA
expires: Tue, 03 May 2022 20:40:41 GMT

GET
H/1.1 200
OK .lp Show response
gitbook-28427.firebaseio.com/ Frame 2FFF 422 B
664 B 253ms
112ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gitbook-28427.firebaseio.com/.lp?start=t&ser=55489355&cb=1&v=5

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

984f5bfba92537c78ca996a341ae8812376ff065d7d35460e3b87ae36d6fd9e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 14:28:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 422
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H2 200 6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 1 KB
613 B 25ms
25ms Stylesheet
text/css 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4757654
cf-polished: origSize=1701
x-guploader-uploadid: ABg5-UwiIdAcAjrmRlFxwdUIs61NAokkry_-iZ807hfyhPF7n05ywV-MhhKGJXAj1nhFXaaZ1Wx1tw1RuwfcZvRBTHA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/css
cf-request-id: 0ab6d265fa00004ea4e1244000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation: 1617785029532093
access-control-allow-origin: *
expires: Thu, 21 Apr 2022 20:23:08 GMT
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1701
cf-ray: 6604b9b65b6b4ea4-FRA
cf-bgj: minify

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDBC7b4Xp77fPrfdO%2FScreenshot%20from%202019-04-18%2023-41-59.png
gblobscdn.gitbook.com/ 4 KB
4 KB 33ms
33ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDBC7b4Xp77fPrfdO%2FScreenshot%20from%202019-04-18%2023-41-59.png?alt=media&token=23d37e81-c5c6-4102-bfba-6357b43e337a
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 429fa33aba08cdbcede02dd082255bba7faa54ff019a576c936ac942a807ddd6

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3740708
x-guploader-uploadid: ABg5-UzrXOHNI3AIrVQ0e_KieF_fYsmcr6Q2KmjECKs8OYaE1V9OAfT38HQdsuwOBDvrSSPB7d30C2qUppaeBjb0iFx8-EHzFg
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-41-59.png
content-type: image/png
content-length: 3760
cf-request-id: 0ab6d265fb00004e807ba36000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "87d69c9d7ead4e8bf348178624966253"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=YQYGEQ==, md5=h9acnX6tTovzSBeGJJZiUw==
x-goog-generation: 1556057083992805
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3760
x-goog-meta-firebasestoragedownloadtokens: 23d37e81-c5c6-4102-bfba-6357b43e337a
accept-ranges: bytes
cf-ray: 6604b9b65f914e80-FRA
expires: Wed, 04 May 2022 07:23:26 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDEXTL40YFa1-84Bb%2FScreenshot%20from%202019-04-18%2023-44-31.png
gblobscdn.gitbook.com/ 25 KB
26 KB 46ms
46ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDEXTL40YFa1-84Bb%2FScreenshot%20from%202019-04-18%2023-44-31.png?alt=media&token=eee77813-09cb-4951-9919-88c4b000fce9
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43a3740ee76f0d181f893a127a3cdbdfedf9779670ca56642859e1dd7643d02e

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3464512
x-guploader-uploadid: ABg5-UzRC95JKMBZDOrtk0Rkijm8mQHWqW4JU08Yga7SAtJyq68Ua2KpnzZzShAw1mmWnFFzfGLOkrQQTd3-WDcs5UEtZ2_rvQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-44-31.png
content-type: image/png
content-length: 26024
cf-request-id: 0ab6d265ff00004e805fb4d000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "cb7b0eaa3ae7fc4739ae197ea6e1594f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=P5oC7Q==, md5=y3sOqjrn/Ec5rhl+puFZTw==
x-goog-generation: 1556057083748277
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 26024
x-goog-meta-firebasestoragedownloadtokens: eee77813-09cb-4951-9919-88c4b000fce9
accept-ranges: bytes
cf-ray: 6604b9b66fa44e80-FRA
expires: Sat, 07 May 2022 12:06:41 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDHuVJhw-3ubLaCPs%2FScreenshot%20from%202019-04-18%2023-57-31.png
gblobscdn.gitbook.com/ 13 KB
13 KB 60ms
60ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDHuVJhw-3ubLaCPs%2FScreenshot%20from%202019-04-18%2023-57-31.png?alt=media&token=90b39d40-1254-4e9f-929c-69c9668c1cc6
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9be596f2db501153d6ea13bc7ea2c6bad86f00c8ae2b5f93e944165ed633b65

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3464512
x-guploader-uploadid: ABg5-Uy8NFsoHOj7ZRgJTcRcqMlgkoM3NDUAH4eSYoxvEzFM9qIpAua7NZY-fY2hlbuD_e3U2LfhdXyT59T1YpFmMIdk23wqXg
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-57-31.png
content-type: image/png
content-length: 12839
cf-request-id: 0ab6d2660000004e80a3b1c000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "d06f2746bea1ffdbbe6b309c5013c6f6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=jfrr9Q==, md5=0G8nRr6h/9u+azCcUBPG9g==
x-goog-generation: 1556057083749411
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 12839
x-goog-meta-firebasestoragedownloadtokens: 90b39d40-1254-4e9f-929c-69c9668c1cc6
accept-ranges: bytes
cf-ray: 6604b9b66faf4e80-FRA
expires: Sat, 07 May 2022 12:06:42 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDLHZWSiph5XErfBY%2FScreenshot%20from%202019-04-19%2000-17-09.png
gblobscdn.gitbook.com/ 4 KB
4 KB 58ms
58ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDLHZWSiph5XErfBY%2FScreenshot%20from%202019-04-19%2000-17-09.png?alt=media&token=c2986940-650d-4c7f-bddb-de4b78eeec26
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5fe0c569ed4d498ca5d4a9b47e513217c1bb8c03712b040db0fdea592d218725

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3740708
x-guploader-uploadid: ABg5-Uwjedhy_sTn8yIdOfvCaXeB8HkeMSMogsVrrJozyxj8M57n4HYkHKk4FgiAg_rz3V0v-ccw0vrMjBTLoTNBK20OJRAxYw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-19%2000-17-09.png
content-type: image/png
content-length: 3784
cf-request-id: 0ab6d2660500004e8089262000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "03bd6f029c278f79caf2ac45710f33f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=9nfa8Q==, md5=A71vApwnj3nK8qxFcQ8z8g==
x-goog-generation: 1556057083729448
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3784
x-goog-meta-firebasestoragedownloadtokens: c2986940-650d-4c7f-bddb-de4b78eeec26
accept-ranges: bytes
cf-ray: 6604b9b66fc44e80-FRA
expires: Wed, 04 May 2022 07:23:26 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDWfI9LCXB-RgrZkC%2FScreenshot%20from%202019-04-19%2000-18-40.png
gblobscdn.gitbook.com/ 9 KB
10 KB 34ms
34ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDWfI9LCXB-RgrZkC%2FScreenshot%20from%202019-04-19%2000-18-40.png?alt=media&token=d25a86de-dae4-4a1e-a33b-b75d614eaa73
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12a47375c2e9ebcdcf7901998b514b6e48f9b7adedafc3ee0a20b330da01cd2f

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 1051977
x-guploader-uploadid: ABg5-Uz3tr_8l9evOMb5dByTZDMwC9AFXQ1A3xorUmMnFUxUSWHHDmI2OsQyweDaDZMVEf5QrlgayRRWs569gcRIYaI16zFQBw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-19%2000-18-40.png
content-type: image/png
content-length: 9331
cf-request-id: 0ab6d2660500004e806a9bc000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "dae0a0017461c572303f262af03040e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Jw37rw==, md5=2uCgAXRhxXIwPyYq8DBA4g==
x-goog-generation: 1556057083950310
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 9331
x-goog-meta-firebasestoragedownloadtokens: d25a86de-dae4-4a1e-a33b-b75d614eaa73
accept-ranges: bytes
cf-ray: 6604b9b66fca4e80-FRA
expires: Sat, 04 Jun 2022 10:15:36 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDbR3flvNHEZ50M8Z%2FScreenshot%20from%202019-04-18%2023-34-05.png
gblobscdn.gitbook.com/ 64 KB
64 KB 57ms
56ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDbR3flvNHEZ50M8Z%2FScreenshot%20from%202019-04-18%2023-34-05.png?alt=media&token=2f2b2f16-0ca3-4444-aec1-843e4a385f67
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f26fc0c7805e3c161370aa37856ae518c9259f744ec44473daff8c5ac5b0586

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3464512
x-guploader-uploadid: ABg5-UxHjMgR02Pnlb-5atKx-_Ixn1zpCpdTX4IYPeVS6AhHBNbX19C9HrqSF3yOfz6-zYkQnaYYcBjXxLUPeeloWVV-tcw3gg
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-34-05.png
content-type: image/png
content-length: 65198
cf-request-id: 0ab6d2660800004e8080be1000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "cbb6ec5ab7e4d572ab7bcb72950e6351"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=2U+FXw==, md5=y7bsWrfk1XKre8tylQ5jUQ==
x-goog-generation: 1556057083922818
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 65198
x-goog-meta-firebasestoragedownloadtokens: 2f2b2f16-0ca3-4444-aec1-843e4a385f67
accept-ranges: bytes
cf-ray: 6604b9b66fda4e80-FRA
expires: Sat, 07 May 2022 12:06:42 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDeuZoXam8bxZEmDk%2FScreenshot%20from%202019-04-18%2023-36-28.png
gblobscdn.gitbook.com/ 5 KB
5 KB 55ms
55ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LdBAnUjR7BhO6coxg82%2F-LdBDeuZoXam8bxZEmDk%2FScreenshot%20from%202019-04-18%2023-36-28.png?alt=media&token=32b3ae82-5d0d-437e-a2c1-6d0b94b97c02
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e981639898b27d887af896adc4acb7d6f0bb5d640ea8287d98c9f0b68a055e1

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
cf-cache-status: HIT
age: 3464512
x-guploader-uploadid: ABg5-UwAaFfqoXvbFQwzHWZVXn4-vEzJ1QG3JYtip6kBDabdjt69-9q7kojlZ-t-BUADEHhVeakalpLyCLhL60L3jtg
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-04-18%2023-36-28.png
content-type: image/png
content-length: 4721
cf-request-id: 0ab6d2660600004e8085aff000000001
last-modified: Tue, 23 Apr 2019 22:04:43 GMT
server: cloudflare
etag: "2aeacfeb7fbc147fb15d753022c1bd9d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=bN/KqA==, md5=KurP63+8FH+xXXUwIsG9nQ==
x-goog-generation: 1556057083936482
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 4721
x-goog-meta-firebasestoragedownloadtokens: 32b3ae82-5d0d-437e-a2c1-6d0b94b97c02
accept-ranges: bytes
cf-ray: 6604b9b66fdf4e80-FRA
expires: Sat, 07 May 2022 12:06:42 GMT

GET
H2 200 embed.js Show response
cdn.iframe.ly/ 22 KB
7 KB 25ms
24ms Script
application/javascript 143.204.98.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iframe.ly/embed.js
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-24.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 0226f11690adfd32f7a6c13588d35e8b59ab0ab7446919a154c2bd249da93434

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 16:59:40 GMT
content-encoding: br
last-modified: Fri, 30 Apr 2021 13:27:40 GMT
server: nginx
age: 77334
etag: W/"608c05cc-5630"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: aa2Pwm1n3LUyBtFVaEeZNqJlTdiQKetcOIofV1WMBKp9XJYufDXxTg==
via: 1.1 055d899361491602a9ef1eb0cdc5e337.cloudfront.net (CloudFront)

GET
H3-29 200 photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 7 KB
7 KB 23ms
6ms Image
image/jpeg 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 12:22:15 GMT
x-content-type-options: nosniff
age: 7580
content-disposition: inline;filename=""
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6707
x-xss-protection: 0
server: fife
etag: "v5e"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 13 Jun 2021 05:06:22 GMT

GET
H2 200 iframe Show response
cdn.iframe.ly/api/ Frame F4E0 8 KB
3 KB 27ms
27ms Document
text/html 143.204.98.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iframe.ly/api/iframe?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D7hP9HcaZtyA&key=4fb668ebc74b721f3c2230d81634c8bc
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-24.fra50.r.cloudfront.net
Software: nginx / iframe.ly
Resource Hash: 337c76ece4cf0aede97845625fbe3063251f24cc43c46f5a70c92d2df6d338b6

Request headers

:method: GET
:authority: cdn.iframe.ly
:scheme: https
:path: /api/iframe?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D7hP9HcaZtyA&key=4fb668ebc74b721f3c2230d81634c8bc
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Response headers

content-type: text/html; charset=utf-8
server: nginx
date: Wed, 16 Jun 2021 14:04:11 GMT
x-powered-by: iframe.ly
access-control-allow-origin: *
cache-control: public, max-age=3600
expires: Wed, 16 Jun 2021 15:04:11 GMT
etag: W/"002a4b3aeebbe71a4248af274fc10375"
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 055d899361491602a9ef1eb0cdc5e337.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: aohKjRcJh6WJxeWP5i7U_7iEWZGHHxiBIoiDzg79uD6VH0wjSE5mnQ==
age: 1464

POST atr
www.youtube.com/api/stats/ Frame 9EA6 0
0

GET
H3-29 200 1*fNWQ3Rr0v1sCGy5pqkGS3A.png
cdn-images-1.medium.com/max/1368/ 29 KB
29 KB 46ms
30ms Image
image/png 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-images-1.medium.com/max/1368/1*fNWQ3Rr0v1sCGy5pqkGS3A.png

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1383858d1e421fbfcfbe7925ad8691c402df16d682e4dfd0177513fe55de66a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:35 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 891356
x-envoy-upstream-service-time: 31
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 29367
cf-request-id: 0ab6d2669900004a9d653e9000000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20210524-162717-f383c62fea
accept-ranges: bytes
cf-ray: 6604b9b75bf14a9d-FRA
expires: Fri, 16 Jul 2021 14:28:35 GMT

GET
H2 200 Cylance_company_logo.png
www.mdsec.co.uk/wp-content/uploads/2019/03/ 15 KB
16 KB 65ms
64ms Image
image/png 172.67.71.28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mdsec.co.uk/wp-content/uploads/2019/03/Cylance_company_logo.png
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd440068e8dbc8285996a56a566503f74d6997af7f03439c8d6b89583b825787

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 7179
cf-polished: origSize=20881
content-length: 15849
cf-request-id: 0ab6d2669800004e9e3d97e000000001
last-modified: Sat, 18 Jul 2020 18:49:16 GMT
server: cloudflare
etag: "5191-5aabbbaffc59c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4GeBlhjUv9RRJcnWcFJu6vrBOQRKpUr6tNgePAjIytr5g4wmapm%2FFNwbwGu6LQkdMNgrLN97hTQHJk9INA%2FjiVJgF7zvW7AIfwnNcMJ6xBThHGBYoIWY%2B4nKjFs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6604b9b75a704e9e-FRA
cf-bgj: imgq:100,h2pri

POST
H2 200 / Show response
www.gitbook.com/__amp/ 7 B
184 B 814ms
806ms XHR
text/html 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gitbook.com/__amp/

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 16 Jun 2021 14:28:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=15768000
cf-ray: 6604b9b77c503250-FRA
content-length: 7
cf-request-id: 0ab6d266aa0000325051027000000001

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 5398
date: Wed, 16 Jun 2021 12:58:37 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Wed, 16 Jun 2021 14:58:37 GMT

GET
H2 200 7f9239ce726764aa22093884902e018d.svg
gstatic.gitbook.com/images/ 2 KB
1 KB 25ms
24ms Image
image/svg+xml 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gstatic.gitbook.com/images/7f9239ce726764aa22093884902e018d.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 6320207
x-guploader-uploadid: ABg5-Uwp2ZHpfP2KRh3gmr5OfeDUxp0R7u-PLsf10qcUQXhVLjI--w_PdPdPrcA3PFb9bG3JCWQm3A0kt0wXHHc68KoZV03s2A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: image/svg+xml
cf-request-id: 0ab6d266b300004ea4811ba000000001
last-modified: Fri, 19 Mar 2021 17:17:25 GMT
server: cloudflare
etag: W/"7f9239ce726764aa22093884902e018d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=VnuT0A==, md5=f5I5znJnZKoiCTiEkC4BjQ==
x-goog-generation: 1616174245138502
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 2137
cf-ray: 6604b9b78e0a4ea4-FRA
expires: Mon, 04 Apr 2022 10:51:47 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1838688479&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ired.team%2Foffensive-security%2Fdefense-evasion%2Fbypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis&dp=%2Foffensive-security%2Fdefense-evasion%2Fbypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis&ul=en-us&de=UTF-8&dt=Bypassing%20Cylance%20and%20other%20AVs%2FEDRs%20by%20Unhooking%20Windows%20APIs%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=1999614959&gjid=960331591&cid=2048689373.1623853715&tid=UA-57505611-10&_gid=1736738674.1623853715&_r=1&_slc=1&cd1=-LFEMnER3fywgFHoroYn&cd2=-LFEMnEQwqZOY6DtfrzY&cd3=-MbMRjQwLSFD3ErZcYXE&cd4=master&cd5=-LdBAsK-V-UkZD6G7knF&z=1960378042

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 14:28:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ired.team
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1838688479&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ired.team%2Foffensive-security%2Fdefense-evasion%2Fbypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis&dp=%2Foffensive-security%2Fdefense-evasion%2Fbypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis&ul=en-us&de=UTF-8&dt=Bypassing%20Cylance%20and%20other%20AVs%2FEDRs%20by%20Unhooking%20Windows%20APIs%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=1185833541&gjid=480389832&cid=2048689373.1623853715&tid=UA-128974775-1&_gid=1736738674.1623853715&_r=1&_slc=1&z=599956536

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 14:28:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ired.team
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 7hP9HcaZtyA Show response
www.youtube.com/embed/ Frame F4E0 53 KB
22 KB 56ms
56ms Document
text/html 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Requested by

Host: cdn.iframe.ly
URL: https://cdn.iframe.ly/api/iframe?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D7hP9HcaZtyA&key=4fb668ebc74b721f3c2230d81634c8bc

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6c59682fc39ef5b8afecd0c593ff1d324b711e7a656fc8a877d9c992d358331a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/7hP9HcaZtyA?rel=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cdn.iframe.ly/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: YSC=mSc79usAXbA; VISITOR_INFO1_LIVE=EcvnHqswAcs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cdn.iframe.ly/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 16 Jun 2021 14:28:35 GMT
strict-transport-security: max-age=31536000
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: CONSENT=PENDING+421; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-230.firebaseio.com/ Frame EE50 420 B
649 B 241ms
113ms Document
text/html 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-230.firebaseio.com/.lp?dframe=t&id=9865512&pw=tcs1ePfMpr&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

8506ebb30c186ffbd3c928ea6bab6156de738dab21966f2641965ef6fe7da5ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Host: s-usc1c-nss-230.firebaseio.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

Response headers

Server: nginx
Date: Wed, 16 Jun 2021 14:28:35 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 420
Connection: keep-alive
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-230.firebaseio.com/ Frame 2FFF 15 B
256 B 241ms
112ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-230.firebaseio.com/.lp?id=9865512&pw=tcs1ePfMpr&ser=55727551&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 14:28:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 15
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-230.firebaseio.com/ Frame 2FFF 58 B
299 B 241ms
112ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-230.firebaseio.com/.lp?id=9865512&pw=tcs1ePfMpr&ser=55727552&ns=gitbook-28427&seg0=0&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MSwiYSI6InMiLCJiIjp7ImMiOnsic2RrLmpzLjctMTQtMSI6MX19fX0.

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 14:28:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 58
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H3-29 200 www-player-webp.css
www.youtube.com/s/player/997fe684/ Frame F4E0 359 KB
45 KB 8ms
6ms Stylesheet
text/css 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb2261167a008616c0620bf0bec8a9b6969ff99250864f3e8702b3c59c9ee175

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84335
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46281
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:03:00 GMT

GET
H3-29 200 www-embed-player.js Show response
www.youtube.com/s/player/997fe684/www-embed-player.vflset/ Frame F4E0 194 KB
64 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3648ff9c18270446e4106c1b332ea27992dc0ac33e1b1b2d35f4ed59598eee71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84485
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65602
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:30 GMT

GET
H3-29 200 base.js Show response
www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/ Frame F4E0 2 MB
483 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

823b19bdfd38969d4800b9e876b4d11eba38e00bd576e5e11c60bb0d20aa168f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84485
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 494431
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:30 GMT

GET
H3-29 200 fetch-polyfill.js Show response
www.youtube.com/s/player/997fe684/fetch-polyfill.vflset/ Frame F4E0 8 KB
3 KB 19ms
17ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84485
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2830
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:30 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F4E0 15 KB
15 KB 12ms
10ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.youtube.com
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 04:48:34 GMT
x-content-type-options: nosniff
age: 380401
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 04:48:34 GMT

GET
H3-29 200 id Show response
googleads.g.doubleclick.net/pagead/ Frame F4E0 113 B
159 B 16ms
16ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/www-embed-player.vflset/www-embed-player.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5830f9e5632de0777d5db7a0a070bbb2b62e5cd9402a56a438ced19669ea161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame F4E0 29 B
52 B 20ms
6ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/www-embed-player.vflset/www-embed-player.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:14:00 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
age: 875
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
expires: Wed, 16 Jun 2021 14:29:00 GMT

GET
H3-29 200 remote.js Show response
www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/ Frame F4E0 93 KB
29 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5dee1ca0646a4d4b316fd25e6f4ffda67f3650ff369522b7d8aef3b70ac15ef1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:52 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
age: 84463
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29283
x-xss-protection: 0
expires: Wed, 15 Jun 2022 15:00:52 GMT

GET
H3-29 200 Fgp6JbVAIDw6L-khUL8_4GfhXpb-l_w93hK8L7OfCkE.js Show response
www.google.com/js/th/ Frame F4E0 35 KB
13 KB 22ms
6ms Script
text/javascript 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/Fgp6JbVAIDw6L-khUL8_4GfhXpb-l_w93hK8L7OfCkE.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a7a25b540203c3a2fe92150bf3fe067e15e96fe97fc3dde12bc2fb39f0a41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 08:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 366911
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13288
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 13:30:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 12 Jun 2022 08:33:24 GMT

GET
H3-29 200 embed.js Show response
www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/ Frame F4E0 25 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a14b9320954426385bad57a756c93f0b5c8a16ad429fc1e792ad2da69dd1a305

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 15:00:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84481
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7448
x-xss-protection: 0
last-modified: Tue, 15 Jun 2021 01:01:25 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 15 Jun 2022 15:00:34 GMT

GET
DATA 200
OK truncated
/ Frame F4E0 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 AAUvwnhIG3UNHEO4aHTEm3W-xHmV9Nu4jsB9sWGc_Eqn=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame F4E0 1 KB
1 KB 20ms
6ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AAUvwnhIG3UNHEO4aHTEm3W-xHmV9Nu4jsB9sWGc_Eqn=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

43a29d1168b34810477ab73bca382e5f7d6157d09dce9d19ef6ebeb4012b39bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 10:33:57 GMT
x-content-type-options: nosniff
age: 14078
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1386
x-xss-protection: 0
server: fife
etag: "v2b2b"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 13 Jun 2021 13:29:49 GMT

GET
H3-29 200 maxresdefault.webp
i.ytimg.com/vi_webp/7hP9HcaZtyA/ Frame F4E0 103 KB
103 KB 21ms
7ms Image
image/webp 2a00:1450:4001:800::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi_webp/7hP9HcaZtyA/maxresdefault.webp

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d841c8422feb1b339c0fba65b24972423b4129769dfb5eb547fa35985f441561

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:34 GMT
x-content-type-options: nosniff
server: sffe
age: 1
etag: "0"
vary: Origin
content-type: image/webp
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 105702
x-xss-protection: 0
expires: Wed, 16 Jun 2021 16:28:34 GMT

GET
H3-29 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame F4E0 4 KB
2 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/player_ias.vflset/en_US/base.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:35 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
x-content-type-options: nosniff
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
expires: Wed, 16 Jun 2021 14:28:35 GMT

GET
H3-29 204 generate_204
www.youtube.com/ Frame F4E0 0
9 B 6ms
6ms Image
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?7_k0KA
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-230.firebaseio.com/ Frame 2FFF 58 B
299 B 137ms
137ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-230.firebaseio.com/.lp?id=9865512&pw=tcs1ePfMpr&ser=55727553&ns=gitbook-28427&seg0=1&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MiwiYSI6InEiLCJiIjp7InAiOiIvc3BhY2VzLy1MRkVNbkVSM2Z5d2dGSG9yb1luL3VzZXJQYWdlUmF0aW5ncy8tTGRCQXNLLVYtVWtaRDZHN2tuRi8tTWNGeFVOVXJzRlJsYTZXMGdsZiIsImgiOiIifX19&seg1=2&ts1=1&d1=eyJ0IjoiZCIsImQiOnsiciI6MywiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRnd3dyUyRXlvdXR1YmUlMkVjb20lMkZ3YXRjaD92PTdoUDlIY2FadHlBIiwiZCI6eyJvdXRkYXRlZCI6dHJ1ZX19fX0.&seg2=3&ts2=1&d2=eyJ0IjoiZCIsImQiOnsiciI6NCwiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRm1lZGl1bSUyRWNvbSUyRkBmc3gzMCUyRmJ5cGFzcy1lZHJzLW1lbW9yeS1wcm90ZWN0aW9uLWludHJvZHVjdGlvbi10by1ob29raW5nLTJlZmIyMWFjZmZkNiIsImQiOnsib3V0ZGF0ZWQiOnRydWV9fX19&seg3=4&ts3=1&d3=eyJ0IjoiZCIsImQiOnsiciI6NSwiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRnd3dyUyRW1kc2VjJTJFY28lMkV1ayUyRjIwMTklMkYwMyUyRnNpbGVuY2luZy1jeWxhbmNlLWEtY2FzZS1zdHVkeS1pbi1tb2Rlcm4tZWRycyUyRiIsImQiOnsib3V0ZGF0ZWQiOnRydWV9fX19

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

01fe65d4fd93c66f51043f540156e23f6c69ef7ca0b6a0484bb063888989eb0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 14:28:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 58
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-230.firebaseio.com/ Frame 2FFF 146 B
388 B 112ms
111ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-230.firebaseio.com/.lp?id=9865512&pw=tcs1ePfMpr&ser=55727554&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

1297df6a08a9d468838d7128f03eb06fb6194048cfeb74aa28806225165fb88f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 14:28:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 146
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-230.firebaseio.com/ Frame 2FFF 47 B
288 B 172ms
172ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-230.firebaseio.com/.lp?id=9865512&pw=tcs1ePfMpr&ser=55727555&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

431270143e9fb062562e977b4e3a627d721bfd1a97e45e87794e2515425f3f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 14:28:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 47
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-230.firebaseio.com/ Frame 2FFF 38 B
279 B 111ms
111ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-230.firebaseio.com/.lp?id=9865512&pw=tcs1ePfMpr&ser=55727556&ns=gitbook-28427&seg0=5&ts0=1&d0=eyJ0IjoiYyIsImQiOnsidCI6Im4iLCJkIjp7fX19

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

8e9bd0e2d3d483ebc55071a08a6b569aac5da3a6b7d473c4dd7f0288030f8dae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 14:28:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 38
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

POST
H2 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame F4E0 28 B
321 B 21ms
20ms XHR
application/json 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/997fe684/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 120
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/7hP9HcaZtyA?rel=0
X-YouTube-Client-Version: 1.20210614.1.0
X-YouTube-Time-Zone: Europe/Berlin
X-Goog-Visitor-Id: CgtFY3ZuSHFzd0FjcyiTlaiGBg%3D%3D
X-YouTube-Ad-Signals: dt=1623853715252&flash=0&frm=2&u_tz=120&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug&u_nmime&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C750%2C422&vis=1&wgl=true&ca_type=image&bid=ANyPxKqQrWlNLdNs8L7kBR1Ld6DpM8U6mI5TiTzu87snl5HxwKs0qbwGmm9WvBNabEm4g6APqHkGL4Ik9cCAe30fb-DyXIkarQ

Response headers

date: Wed, 16 Jun 2021 14:28:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Wed, 16 Jun 2021 14:28:37 GMT

GET
H2 200 chunk.966.9bcdd26c.js Show response
gstatic.gitbook.com/js/ 1 MB
135 KB 46ms
46ms Script
application/javascript 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/js/chunk.966.9bcdd26c.js
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b08085db82bdd556abf8dfe2c049e433274cd77fe15cadaa1437af9b5e928eb

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 14:28:39 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 6130565
cf-polished: origSize=1540766
x-guploader-uploadid: ABg5-UwpHqO3lEk5fGY24xMrxzKaUmsztOxRaJLPxdyRgqAeFBO9HlwfZkZiK-VlxtbNPv4e6b89Z03c6mD4LNmS6aO9oovXkg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: application/javascript
cf-request-id: 0ab6d2782e00004ea4ada74000000001
last-modified: Fri, 19 Mar 2021 17:17:25 GMT
server: cloudflare
etag: W/"1ee0a04f04f79506addc6f9cc9ade2c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=6ui4QQ==, md5=HuCgTwT3lQat3G+cya3iwA==
x-goog-generation: 1616174245205973
access-control-allow-origin: *
expires: Wed, 06 Apr 2022 15:32:34 GMT
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1540766
cf-ray: 6604b9d379664ea4-FRA
cf-bgj: minify

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.youtube.com
URL: https://www.youtube.com/api/stats/atr?ns=yt&el=embedded&cpn=Ti6Pwx1TwbYDYs7V&docid=7hP9HcaZtyA&ver=2&cmt=0&fs=0&rt=0&euri=https%3A%2F%2Fcdn.iframe.ly%2F&lact=317&cl=379363145&mos=0&volume=100&cbr=Chrome&cbrver=89.0.4389.72&c=WEB_EMBEDDED_PLAYER&cver=1.20210614.1.0&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=DE&len=776&fexp=23848210%2C23853953%2C23940237%2C23973490%2C23975651%2C23983296%2C24001373%2C24003586%2C24004644%2C24007246%2C24042868&muted=0&vis=3

Verdicts & Comments Add Verdict or Comment

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1970-01-19 23:23:25	Name: VISITOR_INFO1_LIVE Value: EcvnHqswAcs
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: mSc79usAXbA
.ired.team/	1970-01-23 10:40:13	Name: amplitude_id_fef1e872c952688acd962d30aa545b9eired.team Value: eyJkZXZpY2VJZCI6IjZiNWNmZmNmLTk5MGYtNDZhZi05YWU0LTJmOGE0MjdkZDQwYlIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTYyMzg1MzcxNDY0MywibGFzdEV2ZW50VGltZSI6MTYyMzg1MzcxNDY0MywiZXZlbnRJZCI6MCwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjB9

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://gstatic.gitbook.com/js/111.f142f50e.js(Line 1) Message: Application ready

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' gstatic.gitbook.com .gitbook-staging.com .gitbook.com .firebaseio.com wss://.firebaseio.com .cloudfunctions.net .googleapis.com .gstatic.com data: .google.com .github.com .algolianet.com .algolia.net sentry.io .logrocket.io .lr-ingest.io .stripe.com .clearbit.com .google-analytics.com d3hb14vkzrxvla.cloudfront.net d1j8pt39hxlh3d.cloudfront.net .iframe.ly blob: cdn.jsdelivr.net cdnjs.cloudflare.com api.amplitude.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://js.intercomcdn.com https://intercom.help; script-src 'self' gstatic.gitbook.com 'unsafe-inline' .firebaseio.com .google.com polyfill.io cdn.lr-ingest.io cdn.logrocket.io .stripe.com .clearbit.com .google-analytics.com .iframe.ly .gstatic.com cdnjs.cloudflare.com .intercom.io .intercomcdn.com gitbookio.github.io https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' gstatic.gitbook.com 'unsafe-inline' fonts.googleapis.com unpkg.com cdnjs.cloudflare.com cdn.jsdelivr.net; img-src * data: blob: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://messenger-apps.intercom.io https://.intercom-attachments.com; frame-src ; object-src 'none'; child-src 'self' blob:; worker-src 'self' blob:; frame-ancestors https:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.gitbook.com
cdn-images-1.medium.com
cdn.iframe.ly
cdn.lr-ingest.io
fonts.googleapis.com
fonts.gstatic.com
gblobscdn.gitbook.com
gitbook-28427.firebaseio.com
googleads.g.doubleclick.net
gstatic.gitbook.com
i.ytimg.com
lh5.googleusercontent.com
polyfill.io
s-usc1c-nss-230.firebaseio.com
static.doubleclick.net
unpkg.com
www.gitbook.com
www.google-analytics.com
www.google.com
www.gstatic.com
www.ired.team
www.mdsec.co.uk
www.youtube.com
yt3.ggpht.com
www.youtube.com
143.204.98.24
151.101.129.26
172.67.71.28
2600:1901:0:94b6::
2606:4700:3035::6815:327f
2606:4700:7::a29f:9804
2606:4700::6810:7daf
2606:4700::6812:86f
2606:4700::6812:91
2a00:1450:4001:800::2016
2a00:1450:4001:802::2001
2a00:1450:4001:80e::2003
2a00:1450:4001:812::2004
2a00:1450:4001:828::2002
2a00:1450:4001:829::2003
2a00:1450:4001:829::200a
2a00:1450:4001:829::200e
2a00:1450:4001:830::2006
2a00:1450:4001:831::2001
2a00:1450:4001:831::200e
01fe65d4fd93c66f51043f540156e23f6c69ef7ca0b6a0484bb063888989eb0e
0226f11690adfd32f7a6c13588d35e8b59ab0ab7446919a154c2bd249da93434
1297df6a08a9d468838d7128f03eb06fb6194048cfeb74aa28806225165fb88f
12a47375c2e9ebcdcf7901998b514b6e48f9b7adedafc3ee0a20b330da01cd2f
1383858d1e421fbfcfbe7925ad8691c402df16d682e4dfd0177513fe55de66a2
160a7a25b540203c3a2fe92150bf3fe067e15e96fe97fc3dde12bc2fb39f0a41
1b269df1356bec1c74e9ba7ffe0eae57c7d8edb60ac5539d24d95de08c8d064b
1e93ae0ee86f96e98d740acc26d5298c4ba647cf70764c9125d18bccb5287796
1f26fc0c7805e3c161370aa37856ae518c9259f744ec44473daff8c5ac5b0586
2b06784ec9a61676e2d505d486939b636b1d05560c4cb81c28298005d4108575
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2e981639898b27d887af896adc4acb7d6f0bb5d640ea8287d98c9f0b68a055e1
2f09c0c1ee961a0aa3b26a18e9aded3030c2ae567a7e8de045f87d491a1ae59d
337c76ece4cf0aede97845625fbe3063251f24cc43c46f5a70c92d2df6d338b6
3648ff9c18270446e4106c1b332ea27992dc0ac33e1b1b2d35f4ed59598eee71
3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a
429fa33aba08cdbcede02dd082255bba7faa54ff019a576c936ac942a807ddd6
431270143e9fb062562e977b4e3a627d721bfd1a97e45e87794e2515425f3f60
43a29d1168b34810477ab73bca382e5f7d6157d09dce9d19ef6ebeb4012b39bd
43a3740ee76f0d181f893a127a3cdbdfedf9779670ca56642859e1dd7643d02e
43cfe82acc865a830725f59b0397227d3f914c194a4675476375ed4c65deefc2
5b08085db82bdd556abf8dfe2c049e433274cd77fe15cadaa1437af9b5e928eb
5dee1ca0646a4d4b316fd25e6f4ffda67f3650ff369522b7d8aef3b70ac15ef1
5fe0c569ed4d498ca5d4a9b47e513217c1bb8c03712b040db0fdea592d218725
65f08d830fee3f9441bad3dbf98bd71aa2743aa9c5176fc93353545444a1737b
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6c44180e29960bd5cfc40c11b874d7fba61d2756a9b6868dce8c13a707c40202
6c59682fc39ef5b8afecd0c593ff1d324b711e7a656fc8a877d9c992d358331a
6da43a0ac4abcb5bc4b10164a762759e5cc81f37e00033643034a891fb490c82
823b19bdfd38969d4800b9e876b4d11eba38e00bd576e5e11c60bb0d20aa168f
8506ebb30c186ffbd3c928ea6bab6156de738dab21966f2641965ef6fe7da5ed
863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec
8e9bd0e2d3d483ebc55071a08a6b569aac5da3a6b7d473c4dd7f0288030f8dae
984f5bfba92537c78ca996a341ae8812376ff065d7d35460e3b87ae36d6fd9e7
99f65b3924546660202c56a0ea9287f6ab7276c51b3e9d7153c500c3a52d1506
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a14b9320954426385bad57a756c93f0b5c8a16ad429fc1e792ad2da69dd1a305
a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405
a5830f9e5632de0777d5db7a0a070bbb2b62e5cd9402a56a438ced19669ea161
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2
c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92
c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43
cd440068e8dbc8285996a56a566503f74d6997af7f03439c8d6b89583b825787
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
d841c8422feb1b339c0fba65b24972423b4129769dfb5eb547fa35985f441561
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb2261167a008616c0620bf0bec8a9b6969ff99250864f3e8702b3c59c9ee175
eb929919479b2afe4e756a8ab718e9adbc8d94dbd0504da1cf4cea2b252833cc
ec0227facf3b97f028e09c3f92c8c7f569046b5dd8ed214b77680a392baacca7
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9
f29cd3a2bdcacf9f9f7285c9b74d89f55634f4d43752d81a48914afa7442eb66
f9be596f2db501153d6ea13bc7ea2c6bad86f00c8ae2b5f93e944165ed633b65

www.ired.team Open in urlscan Pro 2606:4700::6812:91 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

89 Requests

98 %HTTPS

85 %IPv6

18 Domains

24 Subdomains

21 IPs

2 Countries

3992 kBTransfer

13942 kBSize

3 Cookies

7 Outgoing links

Redirected requests

89 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.ired.team Open in urlscan Pro
2606:4700::6812:91 Public Scan

Screenshot
Live screenshot

Full Image

89
Requests

98 %
HTTPS

85 %
IPv6

18
Domains

24
Subdomains

21
IPs

2
Countries

3992 kB
Transfer

13942 kB
Size

3
Cookies

89 HTTP transactions
2 data transactions