threatvector.cylance.com Open in urlscan Pro
34.223.126.14  Public Scan

22 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51

• https://cm.everesttech.net/cm/dd?d_uuid=46850288474922884600776743824106419956 HTTP 302
• https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xa4muQAAFFeZlTx0

Request Chain 66

• https://www.google-analytics.com/r/collect?v=1&_v=j79&a=800920645&t=pageview&_s=1&dl=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&ul=en-us&de=UTF-8&dt=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=KEBAAAAB~&jid=1517961003&gjid=1785914687&cid=1762079350.1571694265&tid=UA-33464378-1&_gid=1690983539.1571694265&_r=1&z=1088524385 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_gid=1690983539.1571694265&gjid=1785914687&_v=j79&z=1088524385 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_v=j79&z=1088524385 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_v=j79&z=1088524385&slf_rd=1&random=559481277

Request Chain 86

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=37262&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&time=1571694265617 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D37262%26url%3Dhttps%253A%252F%252Fthreatvector.cylance.com%252Fen_us%252Fhome%252Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html%26time%3D1571694265617%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=37262&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&time=1571694265617&liSync=true

Request Chain 93

• https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
• https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
• https://segments.company-target.com/log?vendor=choca&user_id=AAVkJk67XE0AAD_-9FLRQQ HTTP 303
• https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAVkJk67XE0AAD_-9FLRQQ&verifyHash=7899abf3803c29fac33c7dbc5f81bff6b397acac

Request Chain 103

• https://s.adroll.com/j/exp/OU3SUNRJWBHPTCY5X23OHE/index.js HTTP 302
• https://s.adroll.com/j/exp/index.js

108 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Show response threatvector.cylance.com/en_us/home/	95 KB 22 KB	905ms 348ms	Document text/html	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 523c248bebd78510b3d41ef90931cf023caedfae53145e409a3546b9e1eb5608 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host threatvector.cylance.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers Accept-Ranges bytes Cache-control no-cache="set-cookie" Content-Encoding gzip Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Type text/html;charset=utf-8 Date Mon, 21 Oct 2019 21:44:24 GMT ETag "17d92-5956fc5a344b8-gzip" Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Last-Modified Mon, 21 Oct 2019 18:22:53 GMT Referrer-Policy no-referrer-when-downgrade Server Apache Set-Cookie AWSELB=4D0BDD9F0A163D48ECFEF400CB706ACF82CD0195C8103937592FB679C084F1DB4FBF9937A7A65005DB13B5CC961C67EC4A82E113711D6D70A536F9B759B0F5D706ABCD580A;PATH=/;MAX-AGE=900 Strict-Transport-Security max-age=63072000; includeSubdomains; Vary Accept-Encoding,User-Agent X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-XSS-Protection 1; mode=block Content-Length 21541 Connection keep-alive
GET H/1.1	200 OK	main.731db1757391070f3ea2ead82acaf408.css threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/	12 KB 3 KB	175ms 175ms	Stylesheet text/css	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/main.731db1757391070f3ea2ead82acaf408.css Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash d4e42e78d5938248bc7eeac03bfacee8cd2a392daa3885637a7899ca4fb30e3c Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "2eda-591e577dc0700-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 2403 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:08 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type text/css;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	jquery.5e8d3382f82b03b0bf3fea3024eecd61.js Show response threatvector.cylance.com/etc.clientlibs/clientlibs/granite/	288 KB 87 KB	705ms 358ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery.5e8d3382f82b03b0bf3fea3024eecd61.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 45e2f85e3aab6c36988703f5cc06444289bb795a25736b74975073c98de18498 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "47f04-591e577eb4940-gzip" transfer-encoding chunked Strict-Transport-Security max-age=63072000; includeSubdomains; X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	utils.7a49486e1c734bd5d7fd0c1c68c83d9b.js Show response threatvector.cylance.com/etc.clientlibs/clientlibs/granite/	47 KB 11 KB	523ms 177ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/utils.7a49486e1c734bd5d7fd0c1c68c83d9b.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash e35896fcd15b2238b1b5e2d4fbbd2b287f57dbbded51ab1a2217c38ce6a51d2f Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "bcc7-591e577eb4940-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 10676 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	granite.ed0d934d509c9dab702088c125c92b4f.js Show response threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/	10 KB 4 KB	521ms 174ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash fe7b1fa106b52fd3b7a72421171503eee8ec0c911d495be3ce168f76ed7cc8b1 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "28d6-591e577eb4940-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 2974 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	jquery.26df26a88f9f71ceabb6a15e7cb9c550.js Show response threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/	471 B 1 KB	529ms 173ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/jquery.26df26a88f9f71ceabb6a15e7cb9c550.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 2afa0193eebc6dcba6256c02ba126cd809b278a8c271ba1344af1d54520fb173 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "1d7-591e577eb4940-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 316 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	shared.06a50b23d97647c86982b7801a20508a.js Show response threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/	98 KB 19 KB	868ms 349ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/shared.06a50b23d97647c86982b7801a20508a.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 1cac386a226657759d39c04b26768f03915090f0f1a5b4e6ca815d7478228159 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "18868-591e577eb4940-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 18634 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	main.e2198d73b3e90f0b787085da720eb46e.js Show response threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/	22 KB 7 KB	695ms 174ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc.clientlibs/foundation/clientlibs/main.e2198d73b3e90f0b787085da720eb46e.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash f6281f4fc0c8b4cd0ecb0cf382c080d9e5f01b58c816d5f071969f3734465fc6 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "5963-591e577eb4940-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 6275 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	cylance-blogs.css threatvector.cylance.com/etc/designs/	0 756 B	355ms 178ms	Stylesheet text/css	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc/designs/cylance-blogs.css Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Referrer-Policy no-referrer-when-downgrade Last-Modified Wed, 18 Oct 2017 04:24:09 GMT Server Apache Date Mon, 21 Oct 2019 21:44:24 GMT X-Frame-Options SAMEORIGIN, SAMEORIGIN Content-Type text/css;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; X-Content-Type-Options nosniff Strict-Transport-Security max-age=63072000; includeSubdomains; Vary User-Agent Content-Length 0 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	main.d6fc6f0b35c968dde40b02af38f21447.css threatvector.cylance.com/etc/clientlibs/cylance-blogs/	154 KB 26 KB	690ms 348ms	Stylesheet text/css	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash ce11c18967ab30115878af2f6c6dc88fce05dbda48df9cea5a7abf9fb311ef5f Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "2685c-591e577eb4940-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 25287 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type text/css;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	dependencies.d41d8cd98f00b204e9800998ecf8427e.css threatvector.cylance.com/etc/clientlibs/cylance-blogs/	0 774 B	518ms 174ms	Stylesheet text/css	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/dependencies.d41d8cd98f00b204e9800998ecf8427e.css Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; ETag "0-591e577eb4940" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 0 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary User-Agent Content-Type text/css;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H2	200	launch-EN9a198e584a4641e5a638d027ddddb3cf.min.js Show response assets.adobedtm.com/	149 KB 46 KB	14ms 13ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/launch-EN9a198e584a4641e5a638d027ddddb3cf.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 7fbbeba68616ec3cd21955086a765a1c74d81b3f2772babba4f8f9719adb2d5c Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:24 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:25 GMT server Apache etag "5aebb26c4d05b067a5277a6a715dfbac:1560460645" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * expires Mon, 21 Oct 2019 22:44:24 GMT
GET H2	200	css fonts.googleapis.com/	3 KB 558 B	17ms 16ms	Stylesheet text/css	2a00:1450:4001:821::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Titillium+Web:200,300,400,600 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash e85d93603219c7af97e29b183b6f22d04991b9b01c4a79ae824e62ea7aa809b5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Mon, 21 Oct 2019 21:44:24 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin status 200 date Mon, 21 Oct 2019 21:44:24 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 expires Mon, 21 Oct 2019 21:44:24 GMT
GET H2	200	forms2.min.js Show response app-sj16.marketo.com/js/forms2/js/	169 KB 58 KB	226ms 30ms	Script application/x-javascript	104.16.95.80 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://app-sj16.marketo.com/js/forms2/js/forms2.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.95.80 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 321bbcc4cc57483b7e329186e5159498b668ddde87cb64696ddcdc95176cce82 Security Headers Name Value Strict-Transport-Security max-age=63113904 X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:24 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 5275 status 200 vary Accept-Encoding last-modified Wed, 25 Sep 2019 18:55:06 GMT server cloudflare etag "18610b5-2a536-5936530f69680" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=63113904 content-type application/x-javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 529669a10c122724-FRA expires Tue, 22 Oct 2019 01:44:24 GMT
GET H2	200	featherlight.min.css cdn.rawgit.com/noelboss/featherlight/1.7.9/release/	2 KB 1 KB	20ms 6ms	Stylesheet text/css	151.139.237.11 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://cdn.rawgit.com/noelboss/featherlight/1.7.9/release/featherlight.min.css Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.237.11 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 96904bcac47ca5d98b664970580ea473e1e6a6b285c87e8cb3caa2f1928e7219 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:24 GMT content-encoding gzip x-content-type-options nosniff server NetDNA-cache/2.2 status 200 etag W/"817cdef4a8ec3dc545361453f69e4209a3c4d809" vary Accept-Encoding x-cache HIT content-type text/css;charset=utf-8 access-control-allow-origin * cache-control max-age=315569000, immutable strict-transport-security max-age=31536000; preload x-robots-tag none rawgit-cache-status HIT
GET H2	200	fig1-pcshare s7d2.scene7.com/is/image/cylance/	15 KB 15 KB	26ms 6ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig1-pcshare?&wid=395&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 13b235252eea80ce031a71d6a5659aedede897ac505a1f36f3d2b248ccb8fea4 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:24 GMT last-modified Tue, 17 Sep 2019 03:44:42 GMT server Unknown etag "5574247003a2a41b21c8805c1ce8f749" status 200 content-type image/jpeg access-control-allow-origin * content-length 14905 expires Tue, 22 Oct 2019 02:45:19 GMT
GET H2	200	fig3-pcshare s7d2.scene7.com/is/image/cylance/	85 KB 85 KB	7ms 6ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig3-pcshare?&wid=910&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash e4bd40934761d3891a22d90f13cfe6f775442fcf13b83eac829b9024a06f335e Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:25:54 GMT server Unknown etag "9905931f0be4a98222c6f87b180d1a3b" status 200 content-type image/jpeg access-control-allow-origin * content-length 86997 expires Mon, 21 Oct 2019 18:15:43 GMT
GET H2	200	fig4-pcshare s7d2.scene7.com/is/image/cylance/	9 KB 9 KB	7ms 5ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig4-pcshare?&wid=592&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash f45499152558d17dbdd39c09d27111ed0fad9af5dbd30e6351c1b1390807ed4c Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:25:41 GMT server Unknown etag "bc9dadf0c815e580b53b60ae46bec03e" status 200 content-type image/jpeg access-control-allow-origin * content-length 9296 expires Mon, 21 Oct 2019 18:15:43 GMT
GET H2	200	fig5-pcshare s7d2.scene7.com/is/image/cylance/	42 KB 43 KB	9ms 6ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig5-pcshare?&wid=913&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash efea95a7162c97d70422b3958968b09abaf078e42a8893c556aabb18fb69a173 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:26:47 GMT server Unknown etag "0466a86c2177884a9e2fd01937d8579f" status 200 content-type image/jpeg access-control-allow-origin * content-length 43440 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig6-pcshare s7d2.scene7.com/is/image/cylance/	38 KB 38 KB	11ms 8ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig6-pcshare?&wid=910&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 950534a2baee28ee099bcba9f0bcb3d92e2be367cce585df5d5fcedf9ab6e145 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:27:12 GMT server Unknown etag "4af87a64f4613a5d3ae4495d437c8be4" status 200 content-type image/jpeg access-control-allow-origin * content-length 38591 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig7-pcshare s7d2.scene7.com/is/image/cylance/	74 KB 75 KB	13ms 10ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig7-pcshare?&wid=910&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 3bd7c88770e3f1efd6e82edee52063f87525895622ec5f3d29d906811c76f8ae Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:28:18 GMT server Unknown etag "3ff57b813e1d2515c740ac9b1f6e5558" status 200 content-type image/jpeg access-control-allow-origin * content-length 76130 expires Mon, 21 Oct 2019 18:15:43 GMT
GET H2	200	fig8-pcshare s7d2.scene7.com/is/image/cylance/	67 KB 67 KB	13ms 11ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig8-pcshare?&wid=910&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash d1fa48428b323e4e31098ab8f5209845ac0fb786b48b16d8a4e62fed5ee39872 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:29:01 GMT server Unknown etag "b45ce545109d9d08f194089a759369ec" status 200 content-type image/jpeg access-control-allow-origin * content-length 68555 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig9-pcshare s7d2.scene7.com/is/image/cylance/	73 KB 73 KB	18ms 15ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig9-pcshare?&wid=911&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 5b845dc5c1008ab2b0c6b9ece13571a94baca13a2e490d3f546fc7bbd823c951 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:29:28 GMT server Unknown etag "2bddc2f8e87991b9bab5e5d3fe294e88" status 200 content-type image/jpeg access-control-allow-origin * content-length 74467 expires Tue, 22 Oct 2019 03:58:08 GMT
GET H2	200	fig10-pcshare s7d2.scene7.com/is/image/cylance/	41 KB 41 KB	18ms 16ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig10-pcshare?&wid=902&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 6d94949a6909c1d98fd9c2a72b89dae1731a548580815e7d62e48f1b98b6c6a3 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Wed, 25 Sep 2019 17:13:09 GMT server Unknown etag "6e986e868d72e292f098f3575d877395" status 200 content-type image/jpeg access-control-allow-origin * content-length 41983 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig11-pcshare s7d2.scene7.com/is/image/cylance/	95 KB 96 KB	19ms 17ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig11-pcshare?&wid=911&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash a88e68c61dc64fdc28fc83b5fdb005899e431aa0876309fe6fd3492b0ea35c36 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:30:37 GMT server Unknown etag "e75f44b94365caf683821dfd3a0d034a" status 200 content-type image/jpeg access-control-allow-origin * content-length 97416 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig12-pcshare s7d2.scene7.com/is/image/cylance/	66 KB 66 KB	20ms 17ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig12-pcshare?&wid=914&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 8998d02514181e175a6396b2f64315c5c6bc6f841df0ac4da0a0d1c540f2b5cd Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:31:26 GMT server Unknown etag "3910b3c510f3178bdf739dba4cbd942d" status 200 content-type image/jpeg access-control-allow-origin * content-length 67755 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig13-pcshare s7d2.scene7.com/is/image/cylance/	74 KB 74 KB	20ms 17ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig13-pcshare?&wid=915&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash e187051c75e35e69552cfaccb8171ed4c368f4694a8dda8f5f9ce719d94245c5 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:31:52 GMT server Unknown etag "a958d042b63f97ac6402d395ba8d025a" status 200 content-type image/jpeg access-control-allow-origin * content-length 75559 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig14-pcshare s7d2.scene7.com/is/image/cylance/	45 KB 45 KB	21ms 18ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig14-pcshare?&wid=955&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 4702a838cd03a5c4a9332d3cd9770a9b6705fbdcf298452a0fd753b8462e7d23 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:32:40 GMT server Unknown etag "1c5862778481088a818ddbad55ea3cd7" status 200 content-type image/jpeg access-control-allow-origin * content-length 45710 expires Mon, 21 Oct 2019 18:15:43 GMT
GET H2	200	fig15-pcshare s7d2.scene7.com/is/image/cylance/	35 KB 36 KB	24ms 21ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig15-pcshare?&wid=460&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash a93e0803827e14d153cc327d1799270a95bbcb7cd6f25ef9cf4a818c0c1ccd7c Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:33:01 GMT server Unknown etag "32645223c29b4ecf49339c4f3c3facb9" status 200 content-type image/jpeg access-control-allow-origin * content-length 36220 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig16-pcshare s7d2.scene7.com/is/image/cylance/	148 KB 149 KB	24ms 22ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig16-pcshare?&wid=913&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 3099ac17e82f99eca527fc7d510ef269f8b76cb9eb0388c54a3a9f2b79e16c83 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:33:49 GMT server Unknown etag "3af33205d0583f2ea55a8c416d4a89e4" status 200 content-type image/jpeg access-control-allow-origin * content-length 151643 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H2	200	fig17-pcshare s7d2.scene7.com/is/image/cylance/	96 KB 97 KB	26ms 24ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig17-pcshare?&wid=917&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 668b0b08f7ed00de790f28414f61cd11469ede4d2686a4f54c2d4243db5bdb9f Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:34:10 GMT server Unknown etag "87e397fb5faf654dd4a17f3133ebe76b" status 200 content-type image/jpeg access-control-allow-origin * content-length 98597 expires Tue, 22 Oct 2019 03:58:08 GMT
GET H2	200	fig18-pcshare s7d2.scene7.com/is/image/cylance/	73 KB 73 KB	26ms 24ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/fig18-pcshare?&wid=1100&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 3304641d4b193108b0729575226a653186c51120f21568ff2cd78a2880a543b4 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 17 Sep 2019 03:35:13 GMT server Unknown etag "1459d7dc789fa59724ca94b5f387971f" status 200 content-type image/jpeg access-control-allow-origin * content-length 74473 expires Tue, 22 Oct 2019 03:32:20 GMT
GET H/1.1	200 OK	author_thumbnail_default.jpg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/placeholder/	2 KB 3 KB	176ms 174ms	Image image/jpeg	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/placeholder/author_thumbnail_default.jpg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 2d9245daf2dcc8739b68091fc3afea1e48c3add85f07d57e551a2ab7a714853e Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 21 Oct 2019 21:44:25 GMT Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:09:24 GMT Server Apache ETag "8d7-591e57ff73900" X-Frame-Options SAMEORIGIN Content-Type image/jpeg Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; X-Content-Type-Options nosniff Strict-Transport-Security max-age=63072000; includeSubdomains; Accept-Ranges bytes Content-Length 2263 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	Cylance_BB_Logo_RGB_Horz_Black.png threatvector.cylance.com/content/dam/cylance-blog/en_us/logos/	19 KB 19 KB	176ms 174ms	Image image/png	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/content/dam/cylance-blog/en_us/logos/Cylance_BB_Logo_RGB_Horz_Black.png Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash eb2deec7e5394e29e51ff83e920f1ce3c092ae5c63b711a4b755b9861a8bc6cd Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache ETag "4aaf-591e577fa8b80" X-Frame-Options SAMEORIGIN Content-Type image/png X-XSS-Protection 1; mode=block Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Strict-Transport-Security max-age=63072000; includeSubdomains; Accept-Ranges bytes Content-Length 19119 Date Mon, 21 Oct 2019 21:44:25 GMT
GET H/1.1	200 OK	dependencies.a089e038f1a299472aab3599efb8d481.js Show response threatvector.cylance.com/etc/clientlibs/cylance-blogs/	668 KB 158 KB	187ms 187ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/dependencies.a089e038f1a299472aab3599efb8d481.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash adc2c8e679ffd8f0cbc9270749db4f687b9201280b2913c2817f230584ea4e1d Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "a70c1-591e577eb4940-gzip" transfer-encoding chunked Strict-Transport-Security max-age=63072000; includeSubdomains; X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:09 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	main.97c9aac6ee7df8531607278a78c5c231.js Show response threatvector.cylance.com/etc/clientlibs/cylance-blogs/	236 KB 63 KB	184ms 183ms	Script application/javascript	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.97c9aac6ee7df8531607278a78c5c231.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 1017b2b6551aca43896313770d3c3041d58cee227ce35861c60ef0a10dc38c64 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "3b09d-591e577fa8b80-gzip" transfer-encoding chunked Strict-Transport-Security max-age=63072000; includeSubdomains; X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:24 GMT Vary Accept-Encoding,User-Agent Content-Type application/javascript;charset=utf-8 Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H2	200	featherlight.min.js Show response cdn.rawgit.com/noelboss/featherlight/1.7.9/release/	9 KB 4 KB	6ms 5ms	Script application/javascript	151.139.237.11 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://cdn.rawgit.com/noelboss/featherlight/1.7.9/release/featherlight.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.139.237.11 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 0e41a843709f19f5327078ad0e4fca7ff8485d280f2458c15b555957a0e646cd Security Headers Name Value Strict-Transport-Security max-age=31536000; preload X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip x-content-type-options nosniff server NetDNA-cache/2.2 status 200 etag W/"2f5a26ba5509a7f0235bf1f53ed375289bfc91bd" vary Accept-Encoding x-cache HIT content-type application/javascript;charset=utf-8 access-control-allow-origin * cache-control max-age=315569000, immutable strict-transport-security max-age=31536000; preload x-robots-tag none rawgit-cache-status HIT
GET H/1.1	200 OK	token.json Show response threatvector.cylance.com/libs/granite/csrf/	2 B 763 B	180ms 180ms	XHR application/json	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://threatvector.cylance.com/libs/granite/csrf/token.json Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Referrer-Policy no-referrer-when-downgrade Server Apache Date Mon, 21 Oct 2019 21:44:25 GMT X-Frame-Options SAMEORIGIN, SAMEORIGIN Connection keep-alive Content-Type application/json;charset=iso-8859-1 Cache-Control no-cache Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; X-Content-Type-Options nosniff Strict-Transport-Security max-age=63072000; includeSubdomains; Vary User-Agent Content-Length 2 X-XSS-Protection 1; mode=block Expires -1
GET H/1.1	200 OK	id Show response dpm.demdex.net/	366 B 1 KB	34ms 34ms	XHR application/json	52.211.89.62 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/id?d_visid_ver=4.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=2297E09A576BB9677F000101%40AdobeOrg&d_nsid=0&ts=1571694265290 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.211.89.62 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-211-89-62.eu-west-1.compute.amazonaws.com Software / Resource Hash 7739d3d729f51743d5cd93946d6c1adfbe1b6ddce95b44649fead59ebdd302b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Sec-Fetch-Mode cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers DCS dcs-prod-irl1-v048-0b73edff1.edge-irl1.demdex.com 5.61.0.20191015084456 3ms (+1ms) Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains Content-Encoding gzip X-TID 1XieR28CRYU= Vary Origin, Accept-Encoding, User-Agent P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin https://threatvector.cylance.com Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json;charset=utf-8 Content-Length 303 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	AppMeasurement.min.js Show response assets.adobedtm.com/extensions/EP4c3fcccffd524251ae198bf677f3b6e9/	34 KB 13 KB	9ms 7ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EP4c3fcccffd524251ae198bf677f3b6e9/AppMeasurement.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 7848472b4e994bcd2cb522201f6c123b50c4b37e5aab979ac50db3244eb894d5 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Mon, 15 Apr 2019 20:43:53 GMT server Apache etag "f005ac758d3bc63fa30fe4a4bd80448d:1555361033" vary Accept-Encoding content-type application/x-javascript status 200 cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 12786 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	43 KB 17 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:825::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Mon, 19 Aug 2019 17:22:41 GMT server Golfe2 age 590 date Mon, 21 Oct 2019 21:34:35 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 17803 expires Mon, 21 Oct 2019 23:34:35 GMT
GET H2	200	NaPecZTIAOhVxoMyOr9n_E7fdMPmDaZRbrw.woff2 fonts.gstatic.com/s/titilliumweb/v8/	12 KB 12 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:825::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/titilliumweb/v8/NaPecZTIAOhVxoMyOr9n_E7fdMPmDaZRbrw.woff2 Requested by Host: app-sj16.marketo.com URL: https://app-sj16.marketo.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash dd1dad45fd0dd168ad46427307aa8a206b857b783ca3afbcfe2bc8b8724acec0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode cors Referer https://fonts.googleapis.com/css?family=Titillium+Web:200,300,400,600 Origin https://threatvector.cylance.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 16 Oct 2019 03:31:22 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 19:24:34 GMT server sffe age 497583 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 12344 x-xss-protection 0 expires Thu, 15 Oct 2020 03:31:22 GMT
GET H2	200	NaPDcZTIAOhVxoMyOr9n_E7ffGjEGItzY5abuWI.woff2 fonts.gstatic.com/s/titilliumweb/v8/	12 KB 12 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:825::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/titilliumweb/v8/NaPDcZTIAOhVxoMyOr9n_E7ffGjEGItzY5abuWI.woff2 Requested by Host: app-sj16.marketo.com URL: https://app-sj16.marketo.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 0e23b84d6736b1645a695282788cee2070cd3f5cd2c5c2e31ea0b44a942294c2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode cors Referer https://fonts.googleapis.com/css?family=Titillium+Web:200,300,400,600 Origin https://threatvector.cylance.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 08 Oct 2019 20:51:47 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 19:18:52 GMT server sffe age 1126358 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 12524 x-xss-protection 0 expires Wed, 07 Oct 2020 20:51:47 GMT
GET H/1.1	200 OK	mainLogo_rgb_h_white.png threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/branding/	10 KB 11 KB	175ms 175ms	Image image/png	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/branding/mainLogo_rgb_h_white.png Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 09bc1009eb3d9cbc800e4933a407c81b1920be72f28254baff513ee8f422f5b0 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 21 Oct 2019 21:44:25 GMT Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache ETag "2808-591e577fa8b80" X-Frame-Options SAMEORIGIN Content-Type image/png Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; X-Content-Type-Options nosniff Strict-Transport-Security max-age=63072000; includeSubdomains; Accept-Ranges bytes Content-Length 10248 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	main_search_close.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	938 B 1 KB	173ms 173ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/main_search_close.svg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 9913bba300e77cd7898ce5a11558bf789fd15cb686107a10a648109117816be1 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "3aa-591e577fa8b80-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 491 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	main_search_icon.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	1 KB 1 KB	173ms 173ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/main_search_icon.svg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 26ae4b0eb488fa35fca8b199e05b5b5236192cf04a2fa5a91ba6c5c4d5ffc06d Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "594-591e577fa8b80-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 693 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H2	200	092519-pcshare-fakenarrator-2-lrg s7d2.scene7.com/is/image/cylance/	78 KB 78 KB	9ms 7ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/092519-pcshare-fakenarrator-2-lrg?&wid=1280&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 65ddcb15af483433f9618ae7406a7646158a6628a3d2512715187cbb11526029 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 24 Sep 2019 20:33:42 GMT server Unknown etag "59730464556be4457735f2629866e268" status 200 content-type image/jpeg access-control-allow-origin * content-length 79774 expires Mon, 21 Oct 2019 18:15:43 GMT
GET H2	200	NaPDcZTIAOhVxoMyOr9n_E7ffAzHGItzY5abuWI.woff2 fonts.gstatic.com/s/titilliumweb/v8/	12 KB 12 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:825::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/titilliumweb/v8/NaPDcZTIAOhVxoMyOr9n_E7ffAzHGItzY5abuWI.woff2 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash f17a340f0388383e8d2a70632006d51e5d0e95f60f1cca3f774bd78b5d3dcd07 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode cors Referer https://fonts.googleapis.com/css?family=Titillium+Web:200,300,400,600 Origin https://threatvector.cylance.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 16 Oct 2019 05:49:33 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 19:25:18 GMT server sffe age 489292 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 12260 x-xss-protection 0 expires Thu, 15 Oct 2020 05:49:33 GMT
GET H2	200	NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzY5abuWI.woff2 fonts.gstatic.com/s/titilliumweb/v8/	12 KB 12 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:825::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/titilliumweb/v8/NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzY5abuWI.woff2 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 8658dcad983dacbb3bca7bc8217fd0b75f28df85bf9259bd0dccf69e58cb0ecd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode cors Referer https://fonts.googleapis.com/css?family=Titillium+Web:200,300,400,600 Origin https://threatvector.cylance.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 17 Oct 2019 10:14:24 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 19:25:27 GMT server sffe age 387001 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 12276 x-xss-protection 0 expires Fri, 16 Oct 2020 10:14:24 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	18ms 6ms	Script application/x-javascript	184.31.84.223 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 184.31.84.223 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a184-31-84-223.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 21 Oct 2019 21:44:25 GMT Content-Encoding gzip Last-Modified Fri, 05 Apr 2019 02:53:44 GMT Server Apache ETag "54520320df20b526337717d6d28181fc:1554432824" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	403	getForm app-sj16.marketo.com/index.php/form/	0 0	14ms 14ms	Script text/html	104.16.95.80 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://app-sj16.marketo.com/index.php/form/getForm?munchkinId=524-DOM-989&form=3163&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&callback=jQuery112407774306050961701_1571694265303&_=1571694265304 Requested by Host: app-sj16.marketo.com URL: https://app-sj16.marketo.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.95.80 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software / Resource Hash Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	Cookie set dest5.html cylance.demdex.net/ Frame 8499	0 0	134ms 29ms	Document text/html	34.254.4.203 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cylance.demdex.net/dest5.html?d_nsid=0 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.254.4.203 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-254-4-203.eu-west-1.compute.amazonaws.com Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Host cylance.demdex.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Accept-Encoding gzip, deflate, br Cookie demdex=46850288474922884600776743824106419956 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Response headers Accept-Ranges bytes Cache-Control max-age=21600 Content-Encoding gzip Content-Type text/html Expires Thu, 01 Jan 1970 00:00:00 GMT Last-Modified Wed, 16 Oct 2019 10:21:06 GMT P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Pragma no-cache Set-Cookie demdex=46850288474922884600776743824106419956;Path=/;Domain=.demdex.net;Expires=Sat, 18-Apr-2020 21:44:25 GMT;Max-Age=15552000 Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding, User-Agent X-TID Z/TFPPK/So0= Content-Length 2764 Connection keep-alive
GET H/1.1	200 OK	ibs:dpid=411&dpuuid=Xa4muQAAFFeZlTx0 dpm.demdex.net/ Redirect Chain https://cm.everesttech.net/cm/dd?d_uuid=46850288474922884600776743824106419956 https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xa4muQAAFFeZlTx0	42 B 840 B	34ms 33ms	Image image/gif	52.211.89.62 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xa4muQAAFFeZlTx0 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.211.89.62 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-211-89-62.eu-west-1.compute.amazonaws.com Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers DCS dcs-prod-irl1-v048-0e18a720a.edge-irl1.demdex.com 5.61.0.20191015084456 2ms (+1ms) Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains X-TID XmINEfEKS5w= P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Connection keep-alive Content-Type image/gif Content-Length 42 Expires Thu, 01 Jan 1970 00:00:00 GMT Redirect headers Date Mon, 21 Oct 2019 21:44:25 GMT Server AMO-cookiemap/1.1 P3P CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM" Location https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xa4muQAAFFeZlTx0 Cache-Control no-cache Connection Keep-Alive Keep-Alive timeout=15,max=100 Content-Length 0
GET H2	200	102219-data-dystopia-2-lrg s7d2.scene7.com/is/image/cylance/	10 KB 10 KB	9ms 8ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/102219-data-dystopia-2-lrg?&wid=319&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash a9b13bb94e37de7d2225fdaf3d7211ccb9ed2688f4f76050096c044d357805bd Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Thu, 17 Oct 2019 21:08:23 GMT server Unknown etag "b9fab8423a589a15ff950381adaac413" status 200 content-type image/jpeg access-control-allow-origin * content-length 9838 expires Tue, 22 Oct 2019 02:24:53 GMT
GET H2	200	000-InSecurity-Podcast-LRG s7d2.scene7.com/is/image/cylance/	4 KB 4 KB	9ms 8ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/000-InSecurity-Podcast-LRG?&wid=319&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 62d710d9bda1dbd522c180805ec2a66d82c84ec1093813ebf39d22f04b30d871 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Thu, 11 Apr 2019 19:54:05 GMT server Unknown etag "dd3973310906a18966ce86729e8f6c75" status 200 content-type image/jpeg access-control-allow-origin * content-length 4371 expires Tue, 22 Oct 2019 02:17:10 GMT
GET H2	200	011619-evaluate-insurance-5-lrg s7d2.scene7.com/is/image/cylance/	5 KB 5 KB	10ms 10ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/011619-evaluate-insurance-5-lrg?&wid=319&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 077cb490ecea2584bdfe6418c46d36e4663e2cc1b95b240a4d9eca1b0f1e8d65 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Wed, 16 Oct 2019 02:42:10 GMT server Unknown etag "5069e3be0a02cf1a5397f79742ac3eba" status 200 content-type image/jpeg access-control-allow-origin * content-length 4702 expires Mon, 21 Oct 2019 17:18:30 GMT
GET H2	200	101619-xmrig-2b-lrg s7d2.scene7.com/is/image/cylance/	9 KB 9 KB	11ms 10ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/101619-xmrig-2b-lrg?&wid=319&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 167bef6230e3e92eb9012e04a965fe446c9016276fbac5a752f1fd8be7d3a157 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 15 Oct 2019 02:35:04 GMT server Unknown etag "8bcda4c2c41291aac33efeb2e6162159" status 200 content-type image/jpeg access-control-allow-origin * content-length 9196 expires Tue, 22 Oct 2019 03:58:08 GMT
GET H2	200	101519-autonomous-cars-lrg s7d2.scene7.com/is/image/cylance/	6 KB 6 KB	11ms 10ms	Image image/jpeg	2a02:26f0:6c00:28b::9b6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://s7d2.scene7.com/is/image/cylance/101519-autonomous-cars-lrg?&wid=319&fit=constrain,1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28b::9b6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Unknown / Resource Hash 769defbccd06db0371d6d01b9ccb0b5237a7bdafc4bde17831262e971e7690b8 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT last-modified Tue, 15 Oct 2019 16:15:50 GMT server Unknown etag "c7bf03da9d0d7841ee4a6fb5b5e4c986" status 200 content-type image/jpeg access-control-allow-origin * content-length 6260 expires Tue, 22 Oct 2019 01:59:40 GMT
GET H2	200	iframe_api Show response www.youtube.com/	859 B 944 B	22ms 21ms	Script application/javascript	2a00:1450:4001:81d::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software YouTube Frontend Proxy / Resource Hash 16dd54686a3ed4ca169cba44af157ea072d91930a6b5ad3690b4651820e5e0b2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT x-content-type-options nosniff server YouTube Frontend Proxy content-type application/javascript status 200 cache-control no-cache alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 859 x-xss-protection 0 expires Tue, 27 Apr 1971 19:44:06 EST
GET H/1.1	200 OK	footer_social_icons_facebook.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	174ms 174ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/footer_social_icons_facebook.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 937fdd2761db8d890407be8c18e64a7f3c19ded89b4d67f5606e30a560bd63c5 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "6d1-591e577fa8b80-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 775 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	footer_social_icons_youtube.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	6 KB 3 KB	174ms 174ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/footer_social_icons_youtube.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash b194fd385666036162259f55563a017e78753671e0fbd3be31a272dc2b869876 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "16d2-591e577fa8b80-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 2247 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	footer_social_icons_twitter.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	174ms 173ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/footer_social_icons_twitter.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash af6f1a1d1ca5b44168e2d69e4e92daf576df150cc615c9e62adc6eb909a73114 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "7d3-591e577fa8b80-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 1002 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	footer_social_icons_linkedin.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	173ms 172ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/footer_social_icons_linkedin.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 099bace63963205abb1875d577e797bdac573989ab27a75960eafe3ccd5fa27a Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "714-591e577fa8b80-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 803 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	footer_social_icons_rss.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	173ms 173ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/footer_social_icons_rss.svg Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 8235e55fa7f1c889f552c3d7415b6bfff016a82035dc5c77da7a1789a3de95e3 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main.d6fc6f0b35c968dde40b02af38f21447.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "719-591e577fa8b80-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 827 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:10 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H2	200	RC45a65cb4bab44e65966fc1bfe9d6d8ed-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	460 B 487 B	7ms 6ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RC45a65cb4bab44e65966fc1bfe9d6d8ed-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 44df095afbcc3700bb27f3c430bce008b8074188be803787ce11b9b850ed6675 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:25 GMT server Apache etag "eb0abeded1d23a64ed81155c95cbb867:1560460645" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 254 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	RC795343619189407bb257bf77f37e4f32-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	458 B 491 B	7ms 6ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RC795343619189407bb257bf77f37e4f32-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b10bfe284fcea12155ae8def55a8ec14b8a804e198e06d985e6e8a1681851c63 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:25 GMT server AkamaiNetStorage etag "6c8d0a2b5eadfc79c1cea9bda4c63d3f:1560460645" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 252 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	RCa7a45d271f51412293463f49427635d0-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	472 B 499 B	8ms 7ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RCa7a45d271f51412293463f49427635d0-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash ae0d8091f974c66bea6d9f9aeba9feb785eb4e5a4e779060ec5f31b525f61f0f Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:25 GMT server Apache etag "1cd1f676e57143bd85e5f21bdd4785bb:1560460645" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 265 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j79&a=800920645&t=pageview&_s=1&dl=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fa... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_gid=1690983539.1571694265&gjid=1785914687&_v=j79&z=1088524385 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_v=j79&z=1088524385 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_v=j79&z=1088524385&slf_rd=1&random=559481277	42 B 109 B	17ms 17ms	Image image/gif	2a00:1450:4001:819::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_v=j79&z=1088524385&slf_rd=1&random=559481277 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33464378-1&cid=1762079350.1571694265&jid=1517961003&_v=j79&z=1088524385&slf_rd=1&random=559481277 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/155/	9 KB 4 KB	8ms 8ms	Script application/x-javascript	184.31.84.223 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/155/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 184.31.84.223 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a184-31-84-223.deploy.static.akamaitechnologies.com Software Apache / Resource Hash efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 21 Oct 2019 21:44:25 GMT Content-Encoding gzip Last-Modified Fri, 30 Nov 2018 03:18:20 GMT Server Apache ETag "c67dad42946949112916578f78706df8:1543547900" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 3923 Expires Wed, 29 Jan 2020 21:44:25 GMT
GET H2	200	www-widgetapi.js Show response s.ytimg.com/yts/jsbin/www-widgetapi-vfloS5Wsk/	23 KB 9 KB	18ms 5ms	Script text/javascript	2a00:1450:4001:824::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://s.ytimg.com/yts/jsbin/www-widgetapi-vfloS5Wsk/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash b631fccbe48b26dccef2b6eedeed2d6fb9020daf34dbc8010e587e280b6f498e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 06:21:03 GMT content-encoding gzip x-content-type-options nosniff age 55402 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 8680 x-xss-protection 0 last-modified Sun, 20 Oct 2019 04:15:26 GMT server sffe vary Accept-Encoding, Origin content-type text/javascript cache-control public, max-age=691200 accept-ranges bytes timing-allow-origin https://www.youtube.com expires Tue, 29 Oct 2019 06:21:03 GMT
GET H2	200	RC65049b1ee2da4bed9ece12f15b7d466f-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	835 B 587 B	8ms 5ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RC65049b1ee2da4bed9ece12f15b7d466f-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash c0aed91f1b10ec94f40fdf79c31d1f870fb4bf3eda63b61edb3bbaeff53a93e0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:25 GMT server Apache etag "3802beb763414589551c998a499408b3:1560460645" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 353 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	RC03553916c50b4787a671e14ccf605715-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	695 B 645 B	7ms 6ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RC03553916c50b4787a671e14ccf605715-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 1a7103ddeebf3a313febafe1aba08a1cec143c98a7b6e51cacbf8893093efaa2 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:24 GMT server Apache etag "d9f372492adb73ae3b7bff0cf0a90587:1560460644" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 412 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	bat.js Show response bat.bing.com/	23 KB 7 KB	47ms 47ms	Script application/javascript	2620:1ec:c11::200 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Tue, 10 Sep 2019 18:57:28 GMT x-msedge-ref Ref A: 2DAD0EFFCA7148948A815CF3B5F78111 Ref B: VIEEDGE0613 Ref C: 2019-10-21T21:44:25Z status 200 etag "09c5197968d51:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 7148
GET H2	200	RCcd4cfcbe6a2644318ee9f8727d5e7eb8-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	1 KB 775 B	6ms 6ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RCcd4cfcbe6a2644318ee9f8727d5e7eb8-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 93a431303f6163e1a1b17d0fe9ac4edb2b042333aec637187fa92f9ed1050ae8 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:24 GMT server Apache etag "eababff33cad8c9e414fb875be462778:1560460644" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 541 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	RCf28b419b6ee84d7a88134d7176e20bb3-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	1 KB 899 B	6ms 6ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RCf28b419b6ee84d7a88134d7176e20bb3-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash fe884e48d8d2602152678463aa5ac92bb7bd73b357851406aebcc046ab1d8b9f Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:24 GMT server Apache etag "6d94ea62691631fbad7ebecdcc6e04c3:1560460644" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 666 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	RCe330e30c9b774f238563c2f0317b145b-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	654 B 624 B	7ms 6ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RCe330e30c9b774f238563c2f0317b145b-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software Apache / Resource Hash f419df72131b2e7ec36c56950099c5c8f88e3e8ba7de2438b0484d0786e56200 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:24 GMT server Apache etag "cba2baa21d2761515a7b772732db4812:1560460644" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 391 expires Mon, 21 Oct 2019 22:44:25 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	85 KB 32 KB	41ms 6ms	Script application/x-javascript	93.184.220.178 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=cylance.com Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40B4) / ASP.NET Resource Hash 304bfe9eb3f7bd61580b2a74331e32e2c5bb918afa808dc35f01f32f2e693510 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip etag "13cba397f82d51:0" last-modified Mon, 14 Oct 2019 11:05:01 GMT server ECS (fcn/40B4) x-powered-by ASP.NET vary Accept-Encoding x-cache HIT content-type application/x-javascript status 200 accept-ranges bytes content-length 33061
GET H/1.1	200 OK	share_bar_icon_linkedin.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	174ms 173ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/share_bar_icon_linkedin.svg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash c6e538e6a9213d8d6cb6a1f3b7c03e5a06d68ff25ec57e6eb5b4868289464de0 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "809-591e578c0e8c0-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 876 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:23 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	share_bar_icon_twitter.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	285ms 174ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/share_bar_icon_twitter.svg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 7b86ac9779af83777789a7fc81940793f77b5bd3ff3d36ac8e925fccf656247a Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "8c8-591e578c0e8c0-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 1062 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:23 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	share_bar_icon_google.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	256ms 174ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/share_bar_icon_google.svg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 66de82969f617c85184ad351d55501233e538e7f54caa684368c8a155053874d Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "829-591e578c0e8c0-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 867 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:23 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	share_bar_icon_facebook.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	2 KB 2 KB	298ms 172ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/share_bar_icon_facebook.svg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash fe08d074a32f7c481cc425d22cdd787137feea90578e0b10556cebeefcfa3040 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "771-591e578c0e8c0-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 796 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:23 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	share_bar_icon_email.svg threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/	1 KB 1 KB	285ms 174ms	Image image/svg+xml	34.223.126.14 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://threatvector.cylance.com/etc/clientlibs/cylance-blogs/main/images/icons/share_bar_icon_email.svg Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.223.126.14 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-34-223-126-14.us-west-2.compute.amazonaws.com Software Apache / Resource Hash 87f55f0eb8ca3828f1f3c43da32e71933463b639ff59c86fab549600912ac687 Security Headers Name Value Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Strict-Transport-Security max-age=63072000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Security-Policy font-src https: data:; img-src http: https: data:; script-src http: https: blob: 'unsafe-inline' 'unsafe-eval'; Content-Encoding gzip ETag "49c-591e578c0e8c0-gzip" Strict-Transport-Security max-age=63072000; includeSubdomains; Content-Length 682 X-XSS-Protection 1; mode=block Referrer-Policy no-referrer-when-downgrade Last-Modified Fri, 06 Sep 2019 17:07:23 GMT Server Apache X-Frame-Options SAMEORIGIN Date Mon, 21 Oct 2019 21:44:25 GMT Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection keep-alive Feature-Policy geolocation 'none';midi 'none';sync-xhr *;microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker *;fullscreen *;payment 'none'; Accept-Ranges bytes X-Content-Type-Options nosniff
GET H/1.1	200 OK	visitWebPage Show response 524-dom-989.mktoresp.com/webevents/	2 B 303 B	758ms 153ms	XHR text/plain	192.28.147.68 MARKETO
General Check archive.org Show headers Download Go to Full URL https://524-dom-989.mktoresp.com/webevents/visitWebPage?_mchNc=1571694265565&_mchCn=&_mchId=524-DOM-989&_mchTk=_mch-cylance.com-1571694265564-35399&_mchHo=threatvector.cylance.com&_mchPo=&_mchRu=%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp= Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.147.68 , United States, ASN53580 (MARKETO - MARKETO, Inc., US), Reverse DNS Software akka-http/10.1.7 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Sec-Fetch-Mode cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Mon, 21 Oct 2019 21:44:26 GMT Content-Encoding gzip Server akka-http/10.1.7 Transfer-Encoding chunked X-Request-Id a8ec5123-0bd5-41f3-893e-b89a18d70ae2 Content-Type text/plain; charset=UTF-8
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	3 KB 2 KB	17ms 6ms	Script application/x-javascript	2a02:26f0:6c00:28c::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 21 Oct 2019 21:44:25 GMT Content-Encoding gzip Last-Modified Mon, 07 Oct 2019 16:41:31 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=25230 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	24 KB 9 KB	15ms 15ms	Script text/javascript	172.217.22.66 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.66 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s17-in-f66.1e100.net Software cafe / Resource Hash 04cc99186aa1ed2c9e0989ad7f6a2e180508c8656caef8cd2b153fa8dbba9038 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9198 x-xss-protection 0 server cafe etag 4566352449703540938 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Mon, 21 Oct 2019 21:44:25 GMT
GET H2	200	6e7b478b.min.js Show response tag.demandbase.com/	56 KB 15 KB	30ms 8ms	Script application/javascript	13.224.196.21 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://tag.demandbase.com/6e7b478b.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.21 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-21.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 4697ebaf632dba20350e471f46c9c1d576262de9006a41a7b630200ccea9a842 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 20 Oct 2019 20:44:37 GMT content-encoding gzip last-modified Tue, 15 Oct 2019 15:30:33 GMT server AmazonS3 age 632 vary Accept-Encoding x-cache Hit from cloudfront x-amz-version-id g52zQweoLQF5hL4f0g70.qpxrFSNvPUz status 200 cache-control public, max-age=3600 x-amz-cf-pop FRA2-C1 content-type application/javascript x-amz-cf-id Gu96vbe0AYxZIluK3AwUz1RP3qZ2y-9cNRMJcZ4_HmYMsRfth5w-5g== via 1.1 96ab38d99b79d57e5c7e9b8a07c0fad3.cloudfront.net (CloudFront)
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/858415995/	2 KB 1 KB	18ms 17ms	Script text/javascript	2a00:1450:4001:81e::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858415995/?random=1571694265614&cv=9&fst=1571694265614&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&tiba=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&async=1&rfmt=3&fmt=4 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash b03c85ff0253ad30cf7d0827eff9695a718a8e27e6031747235f8cabbded2b9f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1009 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=37262&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D37262%26url%3Dhttps%253A%252F%252Fthreatvector.cylance.com%252Fen_us%252Fhome%252... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=37262&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&...	0 88 B	102ms 101ms	Image application/javascript	2a05:f500:11:101::b93f:9005 LinkedIn Corporation
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=37262&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&time=1571694265617&liSync=true Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip server Play vary Accept-Encoding x-li-fabric prod-lva1 status 200 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 20 x-li-uuid l+QijpvHzxXAUCL2OCsAAA== Redirect headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip x-content-type-options nosniff status 302 vary Accept-Encoding content-length 20 x-li-uuid +t1zh5vHzxWQXZlMTCsAAA== server Play pragma no-cache x-li-pop prod-efr5 x-frame-options sameorigin expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=2592000 x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=37262&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&time=1571694265617&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 92 B	46ms 46ms	Image text/plain	2620:1ec:c11::200 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=5637515&tm=al001&Ver=2&mid=53266f50-e701-9c9c-49cd-9bdf612b463c&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&kw=BlackBerry%20Cylance,%20PcShare,%20backdoor,%20Windows,%20FakeNarrator,%20malware&p=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&r=&lt=2191&pt=1571694263364,,,,,0,1,39,39,557,211,558,906,906,908,2173,2173,2191,,,&pn=0,0&evt=pageLoad&msclkid=N&rn=456785 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 90969220051A454A80DA4554BD9CA3B3 Ref B: VIEEDGE0613 Ref C: 2019-10-21T21:44:25Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	s75377262578676 cylance.sc.omtrdc.net/b/ss/cylan-production/1/JS-2.12.0-L9TT/	43 B 395 B	105ms 31ms	Image image/gif	108.128.130.224 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://cylance.sc.omtrdc.net/b/ss/cylan-production/1/JS-2.12.0-L9TT/s75377262578676?AQB=1&ndh=1&pf=1&t=21%2F9%2F2019%2023%3A44%3A25%201%20-120&mid=47309636826065405680748968533838421536&aamlh=6&ce=UTF-8&pageName=home%3Apcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware&g=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&cc=USD&ch=home&server=threatvector.cylance.com&events=event17&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=D%3Dv1&v1=threatvector.cylance.com&h1=home%7Cpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware&c2=2019-10-21%2018%3A22%3A52&v3=monday&c4=2%3A44%20PM%7CMonday&v4=2%3A44%20PM%7CMonday&v6=home%3Apcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware&v7=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&c8=D%3Dv8&v8=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&c9=D%3Dv9&v9=en_us&c10=D%3Dv10&c11=New&v11=First%20Visit&v12=New&c16=1&c17=17&v17=17&v35=Cylance%20Research%20and%20Intelligence%20Team&v36=research-and-intelligence&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=2297E09A576BB9677F000101%40AdobeOrg&AQE=1 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.128.130.224 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-108-128-130-224.eu-west-1.compute.amazonaws.com Software jag / Resource Hash a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT x-content-type-options nosniff x-c master-1047.I1d1c81.M0-302 p3p CP="This is not a P3P policy" status 200 content-length 43 x-xss-protection 1; mode=block pragma no-cache last-modified Tue, 22 Oct 2019 21:44:25 GMT server jag xserver anedge-64d5676c7b-zrgk7 etag 3375187733828173824-4617010994723335161 vary * content-type image/gif;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Sun, 20 Oct 2019 21:44:25 GMT
GET H2	200	ipv cdn.bizible.com/m/	43 B 322 B	6ms 6ms	Image image/gif	93.184.220.178 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=452401776cf043f1fa136a3dd347b858&_biz_s=27d8bc&_biz_l=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&_biz_t=1571694265633&_biz_i=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&_biz_n=0&a=cylance.com&rnd=907821&cdn_o=a&_biz_z=1571694265634 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/41AB) / ASP.NET Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT x-aspnetmvc-version 5.2 last-modified Thu, 17 Oct 2019 09:39:43 GMT server ECS (fcn/41AB) x-aspnet-version 4.0.30319 x-powered-by ASP.NET x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	/ www.google.com/pagead/1p-user-list/858415995/	42 B 110 B	21ms 21ms	Image image/gif	2a00:1450:4001:81d::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/858415995/?random=1571694265614&cv=9&fst=1571691600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&tiba=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&async=1&fmt=3&is_vtc=1&random=3198679538&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/858415995/	42 B 110 B	20ms 20ms	Image image/gif	2a00:1450:4001:819::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/858415995/?random=1571694265614&cv=9&fst=1571691600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&tiba=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&async=1&fmt=3&is_vtc=1&random=3198679538&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ip.json Show response api.company-target.com/api/v2/	423 B 931 B	81ms 50ms	XHR application/json	13.224.196.5 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&page_title=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&key=7535516323dadf7e3d35f603eaad6491&src=tag Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.5 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-5.fra2.r.cloudfront.net Software nginx / Resource Hash 5b4f7ddf2cbd5ef8611f5fd90529a7c0b42bedb4c6f5a8f08d1c328b55043372 Request headers Sec-Fetch-Mode cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip x-amz-cf-pop FRA2-C1 x-cache Miss from cloudfront status 200 access-control-max-age 1728000 request-id e524a910-e633-490d-9c22-2b8e09a39981 x-amz-cf-id uegpSyIeo4eUYWCqhZ-7NkJrwi59juacDyVCRgyv7nLwktIR31np8A== pragma no-cache access-control-allow-origin https://threatvector.cylance.com server nginx vary Accept-Encoding, Origin access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 via 1.1 7a18a0a1d9929dae345690b88b08dd5e.cloudfront.net (CloudFront) access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type identification-source STANDARD expires Sun, 20 Oct 2019 21:44:25 GMT
GET H/1.1	200 OK	validateCookie segments.company-target.com/ Redirect Chain https://match.prod.bidr.io/cookie-sync/demandbase https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 https://segments.company-target.com/log?vendor=choca&user_id=AAVkJk67XE0AAD_-9FLRQQ https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAVkJk67XE0AAD_-9FLRQQ&verifyHash=7899abf3803c29fac33c7dbc5f81bff6b397acac	26 B 409 B	178ms 178ms	Image image/gif	143.204.101.119 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAVkJk67XE0AAD_-9FLRQQ&verifyHash=7899abf3803c29fac33c7dbc5f81bff6b397acac Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.119 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-119.fra50.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 21 Oct 2019 21:44:26 GMT Via 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA50-C1 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id c8e8afae1888e98b X-Amz-Cf-Id 6d_8nKwnWMN8RGetK0ScLCeu8ZR_Y2ubuMfBLLoZQUfoF9dN62UT9A== Redirect headers Date Mon, 21 Oct 2019 21:44:25 GMT Via 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA50-C1 Vary Origin X-Cache Miss from cloudfront Location /validateCookie?vendor=choca&user_id=AAVkJk67XE0AAD_-9FLRQQ&verifyHash=7899abf3803c29fac33c7dbc5f81bff6b397acac Connection keep-alive trace-id ab12b8bd16070290 Content-Length 0 X-Amz-Cf-Id szwYTN1V4G6plMPDqGnHJTP5bBQm8zRZlvh6ayfRsCbbiIF01tkdCg==
GET H2	200	BizibleAcct.js Show response cdn.bizible.com/	378 B 523 B	123ms 123ms	Script text/javascript	93.184.220.178 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/BizibleAcct.js?_biz_u=452401776cf043f1fa136a3dd347b858&_biz_h=-1906410348&cdn_o=a&jsVer=4.19.06.26&a=cylance.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=cylance.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 479b9b3fc72d8625a4a54dfedc8e59d8d3157b23725c5a719bddef773132360f Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:25 GMT content-encoding gzip etag 06B69621 x-aspnetmvc-version 5.2 server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 x-powered-by ASP.NET vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control private, must-revalidate, max-age=21600 content-type text/javascript; charset=utf-8 content-length 326
GET H2	200	u cdn.bizible.com/m/	43 B 116 B	12ms 12ms	Image image/gif	93.184.220.178 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A524-DOM-989%26token%3A_mch-cylance.com-1571694265564-35399&_biz_u=452401776cf043f1fa136a3dd347b858&_biz_s=27d8bc&_biz_l=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&_biz_t=1571694265636&_biz_i=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&_biz_n=1&a=cylance.com&rnd=938246&cdn_o=a&_biz_z=1571694265736 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40DD) / ASP.NET Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT x-aspnetmvc-version 5.2 last-modified Fri, 18 Oct 2019 04:44:25 GMT server ECS (fcn/40DD) x-aspnet-version 4.0.30319 x-powered-by ASP.NET x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	u cdn.bizible.com/m/	43 B 80 B	12ms 12ms	Image image/gif	93.184.220.178 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=ecid&mapValue=2297E09A576BB9677F000101%40AdobeOrg_47309636826065405680748968533838421536&_biz_u=452401776cf043f1fa136a3dd347b858&_biz_s=27d8bc&_biz_l=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&_biz_t=1571694265637&_biz_i=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&_biz_n=2&a=cylance.com&rnd=671732&cdn_o=a&_biz_z=1571694265736 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40DD) / ASP.NET Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:25 GMT x-aspnetmvc-version 5.2 last-modified Fri, 18 Oct 2019 04:44:25 GMT server ECS (fcn/40DD) x-aspnet-version 4.0.30319 x-powered-by ASP.NET x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	RC6d15653dcdbd4cccb51d7164ce31913c-source.min.js Show response assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/	1 KB 907 B	7ms 6ms	Script application/x-javascript	2.18.232.23 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/COe49f90d73b104d95a5840fb29de3b4bb/PRf95f8581a88f45b9b9b9fb92baf50df7/BL2622518685ad46688ae9b6337ed669ac/RC6d15653dcdbd4cccb51d7164ce31913c-source.min.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 8f9713075b7edd29146b9f8472de0a9dea8c7f3dc2f41ff172f3e558536227c7 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:26 GMT content-encoding gzip last-modified Thu, 13 Jun 2019 21:17:23 GMT server AkamaiNetStorage etag "030fd508521493a75099bd78f60225e1:1560460644" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 667 expires Mon, 21 Oct 2019 22:44:26 GMT
GET H2	200	conversion.js Show response www.googleadservices.com/pagead/	24 KB 9 KB	15ms 15ms	Script text/javascript	172.217.22.66 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN9a198e584a4641e5a638d027ddddb3cf.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.66 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s17-in-f66.1e100.net Software cafe / Resource Hash 78a79d5cefe3a91bfccc9d0e3522b756e142d8c2aeba35146f2bc399b71cf4ad Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 21:44:26 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9385 x-xss-protection 0 server cafe etag 14299522277420216331 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Mon, 21 Oct 2019 21:44:26 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/858415995/	2 KB 1 KB	25ms 25ms	Script text/javascript	2a00:1450:4001:81e::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858415995/?random=1571694266122&cv=9&fst=1571694266122&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&tiba=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&rfmt=3&fmt=4 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash bd8cc84001a21f3c2e9fae42bf0c46282dce50853c2ab42ac76e44b1814c1d9f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:26 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1005 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	33 KB 11 KB	33ms 8ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 880a2e81641380a4609a464aa6c813ba5a47f953ea354c1f08eb4f0706409ccd Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id CdVV7j36_NrWhaa2SL8tgFNc7xBcb0ts Content-Encoding gzip ETag "1ab416151418a84e04dca50b27b312ee" x-amz-request-id 08D1DCF34EAC8E13 x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 10541 x-amz-id-2 G+JPo5NDEcKiqcoT4lO6aZsxZ0nOfRZGSyskSS3y8WygGJ+d6VLhM11OiRu6QQfLoJR2ArSHTPc= Last-Modified Mon, 21 Oct 2019 16:57:14 GMT Server AmazonS3 Date Mon, 21 Oct 2019 21:44:26 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H2	200	/ www.google.com/pagead/1p-user-list/858415995/	42 B 110 B	23ms 23ms	Image image/gif	2a00:1450:4001:81d::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/858415995/?random=1571694266122&cv=9&fst=1571691600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&tiba=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&fmt=3&is_vtc=1&random=3444883781&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:26 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/858415995/	42 B 110 B	19ms 19ms	Image image/gif	2a00:1450:4001:819::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/858415995/?random=1571694266122&cv=9&fst=1571691600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fthreatvector.cylance.com%2Fen_us%2Fhome%2Fpcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html&tiba=PcShare%20Backdoor%20Attacks%20Targeting%20Windows%20Users%20with%20FakeNarrator%20Malware&fmt=3&is_vtc=1&random=3444883781&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 21 Oct 2019 21:44:26 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/exp/ Redirect Chain https://s.adroll.com/j/exp/OU3SUNRJWBHPTCY5X23OHE/index.js https://s.adroll.com/j/exp/index.js	28 B 680 B	6ms 5ms	Script application/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/exp/index.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52 Request headers Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id pMndXb._rKnNP7AlILjElJlar3tWew_9 ETag "5816cced8568d223aa09d889f300692b" x-amz-request-id A1DD5E192C5056C6 x-amz-server-side-encryption AES256 Connection keep-alive Content-Length 28 x-amz-id-2 RjgsKWKjHFgd+vjTJ3hj/WZEY0Hix+0WkhftMMoTW35f0rFgogv1yf7/11/79wf75PE4cCftyiY= Last-Modified Mon, 21 Oct 2019 17:10:12 GMT Server AmazonS3 Date Mon, 21 Oct 2019 21:44:26 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * Redirect headers Date Mon, 21 Oct 2019 21:44:26 GMT Server AkamaiGHost Location https://s.adroll.com/j/exp/index.js Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Connection keep-alive Access-Control-Allow-Headers * Content-Length 0
GET H2	200	OU3SUNRJWBHPTCY5X23OHE Show response d.adroll.com/consent/check/	72 B 163 B	96ms 32ms	Script application/javascript	54.72.18.228 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/OU3SUNRJWBHPTCY5X23OHE?_s=32332b51158ba0f1c8c7e4401176611e&_b=2 Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.72.18.228 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-72-18-228.eu-west-1.compute.amazonaws.com Software nginx/1.16.1 / Resource Hash 45a3f8f525d3ce92b29f490c308248370dcbc679685b484b9a02fedb5ce8243c Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 21 Oct 2019 21:44:26 GMT server nginx/1.16.1 content-length 72 content-type application/javascript
GET H/1.1	200 OK	consent.js Show response s.adroll.com/j/	177 KB 25 KB	19ms 8ms	Script application/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/consent.js Requested by Host: threatvector.cylance.com URL: https://threatvector.cylance.com/etc.clientlibs/clientlibs/granite/jquery/granite.ed0d934d509c9dab702088c125c92b4f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash a9deb521436ad37051d51543f2445bb999ddb6f459da1c6165e155aa99e0c4f0 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id mUP7jw_OqQybVflhPbyIiIDmhEvIvOlK Content-Encoding gzip ETag "e2416a8dda91db724f94f8cf899ec942" x-amz-request-id 271B5C1684C2E517 x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 25154 x-amz-id-2 bSbj3I+cDjCTdjGZCaQFdJ782xsgHhEwfa32wY58mLwyUUv2Wo2wYtrpVPr+oM7SMvtdpaHYbxI= Last-Modified Mon, 30 Sep 2019 18:10:17 GMT Server AmazonS3 Date Mon, 21 Oct 2019 21:44:26 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=300, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H2	200	hod d.adroll.com/consent/	42 B 180 B	32ms 32ms	Image image/gif	54.72.18.228 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/consent/hod?_e=view_banner&_s=32332b51158ba0f1c8c7e4401176611e&_b=2&_a=OU3SUNRJWBHPTCY5X23OHE Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.72.18.228 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-72-18-228.eu-west-1.compute.amazonaws.com Software nginx/1.16.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Sec-Fetch-Mode no-cors Referer https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 21 Oct 2019 21:44:26 GMT cache-control no-transform,public,max-age=300,s-maxage=900 server nginx/1.16.1 content-length 42 vary Cookie content-type image/gif