searchwindowsserver.techtarget.com Open in urlscan Pro
206.19.49.153 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Submission: On October 31 via manual (October 31st 2018, 2:02:33 pm UTC) from US

Summary HTTP 143 Redirects Links 54 Behaviour Indicators

Summary

This website contacted 51 IPs in 6 countries across 32 domains to perform 143 HTTP transactions. The main IP is 206.19.49.153, located in United States and belongs to ATT-CERFNET-BLOCK - AT&T Enhanced Network Services, US. The main domain is searchwindowsserver.techtarget.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on November 1st 2017. Valid for: 2 years.

This is the only time searchwindowsserver.techtarget.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	206.19.49.153 206.19.49.153	17225 (ATT-CERFN...) (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services)
1	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
16	163.171.132.119 163.171.132.119	54994 (QUANTILNE...) (QUANTILNETWORKS - QUANTIL NETWORKS INC)
1	2.19.34.83 2.19.34.83	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	52.205.83.39 52.205.83.39	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:816::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
2	163.171.128.148 163.171.128.148	54994 (QUANTILNE...) (QUANTILNETWORKS - QUANTIL NETWORKS INC)
11	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:815::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	54.243.123.39 54.243.123.39	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
6	2a00:1450:400... 2a00:1450:4001:816::200e	() ()
2	147.75.33.193 147.75.33.193	54825 (PACKET) (PACKET - Packet Host)
1	206.19.49.139 206.19.49.139	17225 (ATT-CERFN...) (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services)
1	52.222.161.56 52.222.161.56	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.222.163.163 52.222.163.163	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2a00:1450:400... 2a00:1450:4001:816::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a00:1450:400... 2a00:1450:4001:819::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
15	216.58.210.2 216.58.210.2	15169 (GOOGLE) (GOOGLE - Google LLC)
1	206.19.49.191 206.19.49.191	17225 (ATT-CERFN...) (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services)
1 1	206.19.49.186 206.19.49.186	() ()
4	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	172.217.22.98 172.217.22.98	15169 (GOOGLE) (GOOGLE - Google LLC)
3 4	185.33.223.210 185.33.223.210	() ()
1	147.75.33.209 147.75.33.209	54825 (PACKET) (PACKET - Packet Host)
12	2a00:1450:400... 2a00:1450:4001:816::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:816::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:821::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	52.216.169.107 52.216.169.107	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	23.54.114.218 23.54.114.218	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	34.192.19.184 34.192.19.184	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
2	198.47.127.32 198.47.127.32	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
2	159.180.84.2 159.180.84.2	33047 (INSTART) (INSTART - Instart Logic)
2	23.59.68.247 23.59.68.247	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2	52.29.77.169 52.29.77.169	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2.16.123.59 2.16.123.59	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	216.58.210.6 216.58.210.6	15169 (GOOGLE) (GOOGLE - Google LLC)
2	52.59.88.132 52.59.88.132	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	34.227.55.140 34.227.55.140	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	151.101.2.110 151.101.2.110	54113 (FASTLY) (FASTLY - Fastly)
1	2.16.106.58 2.16.106.58	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	162.247.242.21 162.247.242.21	23467 (NEWRELIC-...) (NEWRELIC-AS-1 - New Relic)
1	50.16.230.124 50.16.230.124	() ()
1	52.29.209.253 52.29.209.253	() ()
2	18.184.231.24 18.184.231.24	() ()
2	35.158.87.226 35.158.87.226	() ()
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	() ()
1	2a02:26f0:f1:... 2a02:26f0:f1:29c::25ea	() ()
4 6	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	() ()
2 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9101	() ()
6	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	() ()
143	51

1 206.19.49.153 (United States)

ASN17225 (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services, US)
PTR: searchsites.techtarget.com

searchwindowsserver.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 163.171.132.119 (European Union)

ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US)

cdn.ttgtmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.34.83 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-34-83.deploy.static.akamaitechnologies.com

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.205.83.39 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-205-83-39.compute-1.amazonaws.com

a.dpmsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 163.171.128.148 (European Union)

ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US)

cdn.ttgtmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:817::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.243.123.39 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-243-123-39.compute-1.amazonaws.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:816::200e (Ireland)

ASN- ()

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.75.33.193 (Switzerland)

ASN54825 (PACKET - Packet Host, Inc., US)
PTR: pkt-ams-k1-14

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.19.49.139 (United States)

ASN17225 (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services, US)
PTR: media.techtarget.com

media.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.161.56 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-161-56.fra54.r.cloudfront.net

s.dpmsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.163.163 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-163-163.fra54.r.cloudfront.net

dnn506yrbagrg.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:816::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9b (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:819::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 216.58.210.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.19.49.191 (United States)

ASN17225 (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services, US)

users.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.19.49.186 (United States) 1 redirects

ASN- ()

go.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:815::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.98 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s18-in-f98.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.223.210 (European Union) 3 redirects

ASN- ()

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.33.209 (Switzerland)

ASN54825 (PACKET - Packet Host, Inc., US)
PTR: pkt-ams-k1-13

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:816::2001 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::2004 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.169.107 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1-w.amazonaws.com

sp-js-releases.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.54.114.218 (Cambridge, United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-54-114-218.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.192.19.184 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-192-19-184.compute-1.amazonaws.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.115 (United Kingdom)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.47.127.32 (Redwood City, United States)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

sshowads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 159.180.84.2 (United States)

ASN33047 (INSTART - Instart Logic, Inc, US)

cdn.digitru.st	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.59.68.247 (Cambridge, United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-59-68-247.deploy.static.akamaitechnologies.com

aktrack.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.29.77.169 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-29-77-169.eu-central-1.compute.amazonaws.com

consent.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.123.59 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-123-59.deploy.static.akamaitechnologies.com

cdn3.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.210.6 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s07-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.59.88.132 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-59-88-132.eu-central-1.compute.amazonaws.com

consent.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.227.55.140 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-227-55-140.compute-1.amazonaws.com

errors.client.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.106.58 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-106-58.deploy.static.akamaitechnologies.com

a248.e.akamai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.242.21 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-9.nr-data.net

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.16.230.124 (Ashburn, United States)

ASN- ()
PTR: ec2-50-16-230-124.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.29.209.253 (Frankfurt, Germany)

ASN- ()
PTR: ec2-52-29-209-253.eu-central-1.compute.amazonaws.com

www.summerhamster.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.184.231.24 (Cambridge, United States)

ASN- ()
PTR: ec2-18-184-231-24.eu-central-1.compute.amazonaws.com

sourcepoint.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.158.87.226 (Frankfurt, Germany)

ASN- ()
PTR: ec2-35-158-87-226.eu-central-1.compute.amazonaws.com

sourcepoint.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN- ()

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:f1:29c::25ea (European Union)

ASN- ()

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a05:f500:10:101::b93f:9105 (Ireland) 4 redirects

ASN- ()

dc.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9101 (Ireland) 2 redirects

ASN- ()

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN- ()

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	doubleclick.net 1 redirects stats.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net ad.doubleclick.net	272 KB
23	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	404 KB
18	ttgtmedia.com cdn.ttgtmedia.com	612 KB
12	pubmatic.com ads.pubmatic.com image6.pubmatic.com sshowads.pubmatic.com aktrack.pubmatic.com	35 KB
8	linkedin.com 6 redirects dc.ads.linkedin.com www.linkedin.com px.ads.linkedin.com	4 KB
8	techtarget.com 1 redirects searchwindowsserver.techtarget.com media.techtarget.com users.techtarget.com go.techtarget.com consent.techtarget.com	47 KB
6	facebook.com www.facebook.com	539 B
6	google-analytics.com www.google-analytics.com	18 KB
5	google.de adservice.google.de www.google.de	739 B
5	dpmsrv.com a.dpmsrv.com s.dpmsrv.com	52 KB
4	consensu.org sourcepoint.mgr.consensu.org	4 KB
4	adnxs.com 3 redirects ib.adnxs.com	4 KB
4	optimizely.com cdn.optimizely.com cdn3.optimizely.com errors.client.optimizely.com	129 KB
3	facebook.net connect.facebook.net	51 KB
3	google.com adservice.google.com www.google.com	426 B
3	googletagservices.com www.googletagservices.com	27 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	83 KB
2	digitru.st cdn.digitru.st	21 KB
1	licdn.com snap.licdn.com	4 KB
1	summerhamster.com www.summerhamster.com	233 B
1	chartbeat.net ping.chartbeat.net	213 B
1	nr-data.net bam.nr-data.net	261 B
1	akamai.net a248.e.akamai.net	14 KB
1	newrelic.com js-agent.newrelic.com	9 KB
1	rlcdn.com idsync.rlcdn.com	34 B
1	amazonaws.com sp-js-releases.s3.amazonaws.com	42 KB
1	googleadservices.com www.googleadservices.com	9 KB
1	cloudfront.net dnn506yrbagrg.cloudfront.net	563 B
1	ipify.org api.ipify.org	274 B
1	youtube.com www.youtube.com
1	googletagmanager.com www.googletagmanager.com	36 KB
1	googleapis.com ajax.googleapis.com	32 KB
143	32

	Domain	Requested by
18	cdn.ttgtmedia.com	searchwindowsserver.techtarget.com ajax.googleapis.com www.google-analytics.com media.techtarget.com cdn.ttgtmedia.com
15	securepubads.g.doubleclick.net	www.googletagservices.com searchwindowsserver.techtarget.com securepubads.g.doubleclick.net
12	tpc.googlesyndication.com	securepubads.g.doubleclick.net searchwindowsserver.techtarget.com
11	pagead2.googlesyndication.com	searchwindowsserver.techtarget.com pagead2.googlesyndication.com securepubads.g.doubleclick.net
6	www.facebook.com	connect.facebook.net
6	ads.pubmatic.com	securepubads.g.doubleclick.net ads.pubmatic.com
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com searchwindowsserver.techtarget.com
4	px.ads.linkedin.com	2 redirects
4	sourcepoint.mgr.consensu.org	searchwindowsserver.techtarget.com
4	consent.techtarget.com	searchwindowsserver.techtarget.com cdn.ttgtmedia.com
4	ib.adnxs.com	3 redirects
4	googleads.g.doubleclick.net	pagead2.googlesyndication.com www.googleadservices.com
4	a.dpmsrv.com	ajax.googleapis.com searchwindowsserver.techtarget.com s.dpmsrv.com
3	connect.facebook.net	searchwindowsserver.techtarget.com connect.facebook.net
3	adservice.google.de	pagead2.googlesyndication.com www.googletagservices.com
3	www.googletagservices.com	cdn.ttgtmedia.com sshowads.pubmatic.com
2	www.linkedin.com	2 redirects
2	dc.ads.linkedin.com	2 redirects
2	errors.client.optimizely.com	searchwindowsserver.techtarget.com
2	aktrack.pubmatic.com	searchwindowsserver.techtarget.com
2	cdn.digitru.st	ads.pubmatic.com
2	sshowads.pubmatic.com	ads.pubmatic.com
2	image6.pubmatic.com	ads.pubmatic.com
2	www.google.de	searchwindowsserver.techtarget.com
2	www.google.com	searchwindowsserver.techtarget.com
2	stats.g.doubleclick.net	searchwindowsserver.techtarget.com
1	snap.licdn.com	searchwindowsserver.techtarget.com
1	www.summerhamster.com
1	ping.chartbeat.net
1	bam.nr-data.net	js-agent.newrelic.com
1	a248.e.akamai.net	searchwindowsserver.techtarget.com
1	js-agent.newrelic.com	searchwindowsserver.techtarget.com
1	ad.doubleclick.net	searchwindowsserver.techtarget.com
1	cdn3.optimizely.com	cdn.ttgtmedia.com
1	idsync.rlcdn.com	searchwindowsserver.techtarget.com
1	cm.g.doubleclick.net	1 redirects
1	sp-js-releases.s3.amazonaws.com	media.techtarget.com
1	vars.hotjar.com	static.hotjar.com
1	www.googleadservices.com	www.googletagmanager.com
1	go.techtarget.com	1 redirects
1	users.techtarget.com	ajax.googleapis.com
1	script.hotjar.com	static.hotjar.com
1	adservice.google.com	pagead2.googlesyndication.com
1	dnn506yrbagrg.cloudfront.net	searchwindowsserver.techtarget.com
1	s.dpmsrv.com	searchwindowsserver.techtarget.com
1	media.techtarget.com	www.googletagmanager.com
1	static.hotjar.com	searchwindowsserver.techtarget.com
1	api.ipify.org	searchwindowsserver.techtarget.com
1	www.youtube.com	searchwindowsserver.techtarget.com
1	www.googletagmanager.com	searchwindowsserver.techtarget.com
1	cdn.optimizely.com	searchwindowsserver.techtarget.com
1	ajax.googleapis.com	searchwindowsserver.techtarget.com
1	searchwindowsserver.techtarget.com
143	53

This site contains links to these domains. Also see Links.

Domain
www.techtarget.com
users.techtarget.com
whatis.techtarget.com
plus.google.com
www.facebook.com
twitter.com
www.linkedin.com
api.addthis.com
searchdatabackup.techtarget.com
searchdatacenter.techtarget.com
docs.microsoft.com
www.bitpipe.com
www.brianmadden.com
www.google.com
searchservervirtualization.techtarget.com
searchcloudcomputing.techtarget.com
searchsqlserver.techtarget.com
searchenterprisedesktop.techtarget.com
searchvirtualdesktop.techtarget.com
reprints.ygsgroup.com

Subject Issuer	Validity	Valid
*.techtarget.com COMODO RSA Domain Validation Secure Server CA	`2017-11-01` - `2019-11-16`	2 years	crt.sh
*.googleapis.com Google Internet Authority G3	`2018-10-16` - `2019-01-08`	3 months	crt.sh
ssl.cdngc.net DigiCert SHA2 High Assurance Server CA	`2018-09-14` - `2020-04-21`	2 years	crt.sh
cdn.optimizely.com DigiCert ECC Secure Server CA	`2018-01-23` - `2019-01-23`	a year	crt.sh
*.dpmsrv.com Amazon	`2018-06-12` - `2019-07-12`	a year	crt.sh
*.google-analytics.com Google Internet Authority G3	`2018-10-16` - `2019-01-08`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2018-10-09` - `2019-01-01`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2018-10-09` - `2019-01-01`	3 months	crt.sh
*.ipify.org COMODO RSA Domain Validation Secure Server CA	`2018-01-24` - `2021-01-23`	3 years	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2018-10-11` - `2019-01-09`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2018-10-08` - `2019-10-09`	a year	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2018-10-11` - `2019-01-09`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2018-10-11` - `2019-01-09`	3 months	crt.sh
tpc.googlesyndication.com Google Internet Authority G3	`2018-10-16` - `2019-01-08`	3 months	crt.sh
www.google.com Google Internet Authority G3	`2018-10-16` - `2019-01-08`	3 months	crt.sh
www.google.de Google Internet Authority G3	`2018-10-09` - `2019-01-01`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2017-09-22` - `2019-01-03`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2018-02-09` - `2019-02-09`	a year	crt.sh
*.rlcdn.com Go Daddy Secure Certificate Authority - G2	`2017-05-08` - `2019-06-21`	2 years	crt.sh
cdn.digitru.st DigiCert SHA2 Secure Server CA	`2018-05-17` - `2019-05-22`	a year	crt.sh
consent.techtarget.com Let's Encrypt Authority X3	`2018-09-06` - `2018-12-05`	3 months	crt.sh
*.optimizely.com DigiCert ECC Secure Server CA	`2018-01-23` - `2019-01-23`	a year	crt.sh
*.doubleclick.net Google Internet Authority G3	`2018-10-16` - `2019-01-08`	3 months	crt.sh
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA	`2018-09-24` - `2020-09-28`	2 years	crt.sh
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2018-10-03` - `2019-04-14`	6 months	crt.sh
a248.e.akamai.net DigiCert ECC Secure Server CA	`2018-01-23` - `2019-01-19`	a year	crt.sh
*.nr-data.net GeoTrust RSA CA 2018	`2018-01-11` - `2020-03-17`	2 years	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2018-01-02` - `2019-01-02`	a year	crt.sh
www.summerhamster.com Let's Encrypt Authority X3	`2018-10-30` - `2019-01-28`	3 months	crt.sh
*.sourcepoint.mgr.consensu.org Let's Encrypt Authority X3	`2018-08-30` - `2018-11-28`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2017-12-15` - `2019-03-22`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2016-02-16` - `2019-04-17`	3 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2018-01-25` - `2019-01-25`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2017-06-06` - `2019-06-11`	2 years	crt.sh

This page contains 20 frames:

Primary Page: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Frame ID: C12C95F6573DBCA98CAE8DABDB325CDA
Requests: 90 HTTP requests in this frame

Frame: https://www.youtube.com/embed/tNciLllFhds
Frame ID: B73006E9BBBBC24477F01DE01FC184A3
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Frame ID: D928A4C7EBCBD362BEB4F6F93C85A7CD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Frame ID: 009F558F30CE3B05685C02A09DFCE990
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6050985421795229&output=html&h=90&slotname=8728364240&adk=1245650348&adf=95884912&w=1200&fwrn=4&fwrnh=100&lmt=1540994538&rafmt=1&guci=1.2.0.0.2.2.0&format=1200x90&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&flash=0&fwr=0&resp_fmts=3&wgl=1&adsid=NT&dt=1540994538718&bpp=31&bdt=1437&fdt=207&idt=205&shv=r20181024&cbv=r20180604&saldr=aa&abxe=1&correlator=8787806382796&frm=20&pv=2&ga_vid=1079789860.1540994539&ga_sid=1540994539&ga_hid=1455586231&ga_fc=0&iag=0&icsg=146028898464&dssz=48&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=193&ady=6709&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853%2C21070025%2C111541704&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=7&osw_key=766350602&ifi=1&fsb=1&xpc=jLbGUG4yFJ&p=https%3A//searchwindowsserver.techtarget.com&dtd=233
Frame ID: 3ABD143104A75DB199C95756C5F5BB0F
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/rcj-da10bd4908deb9e19dfde013ec3fe4ff.html
Frame ID: FD34FA05F2200928570627E502E7E906
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 66CBE5D890059D4C1C064E11A1F11A14
Requests: 15 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: F2A26588C50D039805B5EFD64965B6CF
Requests: 15 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-30/html/container.html
Frame ID: 4AF5E1CE594BDCD26B4C8B05925F55BF
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 098D852A7549B4BAF001CB1E62BE8DAB
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 484B98BEAAAFC1EE22F7110AE282990B
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 2DC824EF6E11ECA9B827E8FD16D332EB
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: D5B20E607781183AECE2BAE08FB53DD6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/client/ext/m_window_focus_non_hydra.js
Frame ID: 20B71B6DEC1A1D8D14CA898E1B0B3AF4
Requests: 5 HTTP requests in this frame

Frame: https://aktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=82040&siteId=82714&adId=241752&adType=3&adServerId=1067&kefact=1.500000&kaxefact=1.500000&kadNetFrequecy=0&kadwidth=728&kadheight=90&kadsizeid=0&kltstamp=1540994539&indirectAdId=563330&adServerOptimizerId=1&ranreq=0.07307123699783702&kpbmtpfact=0.000000&dcId=3&tldId=0&passback=11&svr=ADS22404&ekefact=67XZW7V0CQCDfMDJLnQc2qGzVvpbqdia5TNiblOhPFr51t3o&ekaxefact=67XZW8N0CQAw0PKqLiEKCmMihNpMR6YZ0z3wr1o9qsTzfc3N&ekpbmtpfact=67XZW9B0CQCO1Vdr8NiTe3l9CRfuv9T3UJ817Zs22MNq887O&crID=0&campaignId=0&isRTB=0&imprId=2B6AC454-30EC-49F5-88E1-5572F18A9811&oid=2B6AC454-30EC-49F5-88E1-5572F18A9811&cntryId=58&domain=searchwindowsserver.techtarget.com&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&sec=1
Frame ID: D95165DF895A54648BD7E8AEFE3C7656
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/client/ext/m_window_focus_non_hydra.js
Frame ID: 3D8FD96F304A66E86CB72EAC927E39A5
Requests: 5 HTTP requests in this frame

Frame: https://aktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=82040&siteId=82714&adId=241679&adType=3&adServerId=1067&kefact=1.500000&kaxefact=1.500000&kadNetFrequecy=0&kadwidth=300&kadheight=250&kadsizeid=0&kltstamp=1540994539&indirectAdId=563328&adServerOptimizerId=1&ranreq=0.2666012377009628&kpbmtpfact=0.000000&dcId=3&tldId=0&passback=11&svr=ADS22046&ekefact=67XZWxn8CQDovvhxQ4olklMXWd1yEZ1P4ADI1LRvsuNlSf-h&ekaxefact=67XZWzv8CQCXLYCI7hdIxTs5mzGGQ5CS6ab-LBSMH3lFmq3S&ekpbmtpfact=67XZW1j8CQBJoecPdslxrKe_j1o8QYa7irwHarxtHh2izolR&crID=0&campaignId=0&isRTB=0&imprId=00F77956-F068-4063-8FFA-18A162E1DFD0&oid=00F77956-F068-4063-8FFA-18A162E1DFD0&cntryId=58&domain=searchwindowsserver.techtarget.com&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&sec=1
Frame ID: 600157631C3FE96545F1C8FA41701772
Requests: 1 HTTP requests in this frame

Frame: https://cdn3.optimizely.com/js/geo2.js?cb=1540994541617
Frame ID: 8F8ADD83F2087C046C3E9FE9E88C7DD6
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 3586863FE74AEBE65CA0ECB3CF38661C
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 1D433E8353A3648FAE4D48D05738AC26
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Chartbeat (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^_sf_(?:endpt|async_config)$/i

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^CE2$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i
env /^google_ad_/i
env /^__google_ad_/i
env /^Goog_AdSense_/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^googletag$/i
env /^google_tag_manager$/i

Hammer.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Hammer$/i

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^moment$/i

New Relic (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^NREUM/i

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /optimizely\.com.*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

143
Requests

100 %
HTTPS

33 %
IPv6

32
Domains

53
Subdomains

51
IPs

6
Countries

1904 kB
Transfer

5923 kB
Size

53
Cookies

54 Outgoing links

These are links going to different origins than the main page.

URL: https://www.techtarget.com/cookie-policy/?utm_source=cmp&utm_medium=banner&utm_campaign=consent&utm_term=cookie
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/privacy-policy-may25/?utm_source=cmp&utm_medium=banner&utm_campaign=consent&utm_term=privacy
Title: Privacy Policy.

Search URL Search Domain Scan URL

URL: https://users.techtarget.com/registration/searchWindowsServer/LoginRegister.page?fromURL=https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Title: Sign-up now. Start my free, unlimited access.

Search URL Search Domain Scan URL

URL: https://users.techtarget.com/registration/searchWindowsServer/Register.page
Title: Register

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/network
Title: Techtarget Network

Search URL Search Domain Scan URL

URL: https://whatis.techtarget.com/resources/Buyers-Guides
Title: Buyer's Guides

Search URL Search Domain Scan URL

URL: https://plus.google.com/103061642320024220310

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SearchWindowsServer/205609122872819

Search URL Search Domain Scan URL

URL: https://twitter.com/searchwinserver

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/2987672?trk=tyah

Search URL Search Domain Scan URL

URL: https://api.addthis.com/oexchange/0.8/forward/email/offer?pubid=uxtechtarget&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&title=Tips+to+track+down+and+neutralize+PowerShell+malware&email_template=TechTargetSearchSites&ct=1

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/contributor/Edward-van-Biljon
Title: Edward van Biljon

Search URL Search Domain Scan URL

URL: https://www.facebook.com/collaborationpro/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/edwardvbs
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/edward-van-biljon-75946840/
Title:

Search URL Search Domain Scan URL

URL: https://users.techtarget.com/registration/searchwindowsserver/LoginRegister
Title: Sign in for existing members

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/privacy-partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://users.techtarget.com/registration/searchWindowsServer/DisplayConsentText.page?languageCd=en&enText=true
Title: Declaration of Consent.

Search URL Search Domain Scan URL

URL: https://searchdatabackup.techtarget.com/feature/How-ransomware-variants-are-neutralizing-data-backups
Title: up in a hidden folder

Search URL Search Domain Scan URL

URL: https://searchdatacenter.techtarget.com/answer/Is-DDoS-attack-mitigation-possible-at-a-multi-tenant-colo
Title: null routing the IP

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/office365/securitycompliance/office-365-malware-and-ransomware-protection
Title: discovered the malware

Search URL Search Domain Scan URL

URL: https://www.bitpipe.com/detail/RES/1378117121_514.html
Title: Windows 2012 Server Network Security

Search URL Search Domain Scan URL

URL: https://www.bitpipe.com/detail/RES/1524578269_480.html
Title: How To Migrate Windows and Linux Servers to Azure

Search URL Search Domain Scan URL

URL: https://www.bitpipe.com/detail/RES/1518457926_954.html
Title: The Ultimate Guide to Windows Server on Azure

Search URL Search Domain Scan URL

URL: https://www.bitpipe.com/detail/RES/1524578269_744.html
Title: How To Migrate Windows & Linux Servers to AWS

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/search/query?q=Windows+Server+management&type=resources
Title: View More

Search URL Search Domain Scan URL

URL: https://www.brianmadden.com/feature/PowerShelling-Terminal-Services-and-Citrix-Revisited-from-BriForum-2008
Title: PowerShelling Terminal Services and Citrix Revisited,...

Search URL Search Domain Scan URL

URL: https://www.brianmadden.com/feature/PowerShelling-Terminal-Services-and-Citrix-from-BriForum-Europe-2007
Title: PowerShelling Terminal Services and Citrix, from ...

Search URL Search Domain Scan URL

URL: https://www.google.com/adsense/support/bin/request.py?contact=abg_afc
Title: -ADS BY GOOGLE

Search URL Search Domain Scan URL

URL: https://searchservervirtualization.techtarget.com/
Title: SearchServerVirtualization

Search URL Search Domain Scan URL

URL: https://searchservervirtualization.techtarget.com/tip/Understand-the-ins-and-outs-of-private-cloud-architecture
Title: Understand the ins and outs of private cloud architecture

Search URL Search Domain Scan URL

URL: https://searchservervirtualization.techtarget.com/tip/Use-Microsoft-SCVMM-to-clone-a-VM
Title: Use Microsoft SCVMM to clone a VM

Search URL Search Domain Scan URL

URL: https://searchservervirtualization.techtarget.com/feature/3-virtualization-infrastructure-design-rules-to-shape-your-deployment
Title: 3 virtualization infrastructure design rules to shape your deployment

Search URL Search Domain Scan URL

URL: https://searchcloudcomputing.techtarget.com/
Title: SearchCloudComputing

Search URL Search Domain Scan URL

URL: https://searchcloudcomputing.techtarget.com/news/252451559/IBM-Red-Hat-customers-should-watch-acquisition-closely
Title: IBM, Red Hat customers should watch acquisition closely

Search URL Search Domain Scan URL

URL: https://searchcloudcomputing.techtarget.com/news/252451557/IBM-Red-Hat-juggernaut-targets-hybrid-clouds
Title: IBM-Red Hat juggernaut targets hybrid clouds

Search URL Search Domain Scan URL

URL: https://searchcloudcomputing.techtarget.com/opinion/AWS-Microsoft-and-Google-push-on-with-hybrid-cloud-strategies
Title: AWS, Microsoft and Google push on with hybrid cloud strategies

Search URL Search Domain Scan URL

URL: https://searchsqlserver.techtarget.com/
Title: SearchSQLServer

Search URL Search Domain Scan URL

URL: https://searchsqlserver.techtarget.com/news/252449322/SQL-Server-2019-preview-brings-Hadoop-Spark-and-AI-into-DBMS
Title: SQL Server 2019 preview brings Hadoop, Spark and AI into DBMS

Search URL Search Domain Scan URL

URL: https://searchsqlserver.techtarget.com/tip/4-strategies-to-beat-the-SQL-Server-2008-support-cutoff
Title: 4 strategies to beat the SQL Server 2008 support cutoff

Search URL Search Domain Scan URL

URL: https://searchsqlserver.techtarget.com/feature/How-Azure-SQL-DW-Gen2-boosts-cloud-data-warehouses-performance
Title: How Azure SQL DW Gen2 boosts cloud data warehouse's performance

Search URL Search Domain Scan URL

URL: https://searchenterprisedesktop.techtarget.com/
Title: SearchEnterpriseDesktop

Search URL Search Domain Scan URL

URL: https://searchenterprisedesktop.techtarget.com/photostory/252451638/Top-Microsoft-Office-alternatives-for-enterprise-use/1/Considering-viable-alternatives-to-Microsoft-Office
Title: Top Microsoft Office alternatives for enterprise use

Search URL Search Domain Scan URL

URL: https://searchenterprisedesktop.techtarget.com/essentialguide/The-complete-guide-to-Windows-10-security-tools
Title: The complete guide to Windows 10 security tools

Search URL Search Domain Scan URL

URL: https://searchenterprisedesktop.techtarget.com/feature/Buy-the-right-help-desk-tools-to-track-and-resolve-incidents
Title: Buy the right help desk tools to track and resolve incidents

Search URL Search Domain Scan URL

URL: https://searchvirtualdesktop.techtarget.com/
Title: SearchVirtualDesktop

Search URL Search Domain Scan URL

URL: https://searchvirtualdesktop.techtarget.com/opinion/How-Linux-thin-clients-have-improved
Title: How Linux thin clients have improved

Search URL Search Domain Scan URL

URL: https://searchvirtualdesktop.techtarget.com/essentialguide/How-to-set-up-VDI-Tips-and-considerations
Title: How to set up VDI: Tips and considerations

Search URL Search Domain Scan URL

URL: https://searchvirtualdesktop.techtarget.com/tip/How-AI-for-IT-operations-improves-VDI-management
Title: How AI for IT operations improves VDI management

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/solutions
Title: Media Kit

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/
Title: Corporate Site

Search URL Search Domain Scan URL

URL: http://reprints.ygsgroup.com/m/techtarget
Title: Reprints

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://go.techtarget.com/clicktrack-r/activity/activity.gif?activityTypeId=16&t=298560&t2=311192&a=2018-10-31%2010:02:16&g=252450465&c=normal&r=339227 HTTP 302
https://cdn.ttgtmedia.com/images/spacer.gif

Request Chain 47

https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&sw%3D252450465https%253A%252F%252Fsearchwindowsserver.techtarget.com%252Ftutorial%252FTips-to-track-down-and-neutralize-PowerShell-malware%26q%3DxImp%26v%3D1.x%26cl%3D68%26pixelIndex%3D0%26r%3D528991%26tzOffset%3D0%26url%3Dhttps%253A%252F%252Fsearchwindowsserver.techtarget.com%252Ftutorial%252FTips-to-track-down-and-neutralize-PowerShell-malware&_=1540994539014 HTTP 302
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26sw%253D252450465https%25253A%25252F%25252Fsearchwindowsserver.techtarget.com%25252Ftutorial%25252FTips-to-track-down-and-neutralize-PowerShell-malware%2526q%253DxImp%2526v%253D1.x%2526cl%253D68%2526pixelIndex%253D0%2526r%253D528991%2526tzOffset%253D0%2526url%253Dhttps%25253A%25252F%25252Fsearchwindowsserver.techtarget.com%25252Ftutorial%25252FTips-to-track-down-and-neutralize-PowerShell-malware%26_%3D1540994539014 HTTP 302
https://a.dpmsrv.com/dpmpxl/index.php?id=1277909405928765554&sw=252450465https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&q=xImp&v=1.x&cl=68&pixelIndex=0&r=528991&tzOffset=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&_=1540994539014

Request Chain 68

https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=1277909405928765554&pixelIndex=0&_=1540994539015 HTTP 302
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1277909405928765554&pixelIndex=0&_=1540994539015&google_gid=CAESEFuYnFmjnM7mOUVNsScbFeY&google_cver=1

Request Chain 133

https://ib.adnxs.com/seg?member=827&add=2378844,7838491,7838492,7838563,7844583,7844585,7844587,8380284,2609968,2737652,2365326,2433138,1010663,658778,658786,652076,5648811,565952,10856540,11527225,1624006,14793258,12013010 HTTP 302
https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26add%3D2378844%2C7838491%2C7838492%2C7838563%2C7844583%2C7844585%2C7844587%2C8380284%2C2609968%2C2737652%2C2365326%2C2433138%2C1010663%2C658778%2C658786%2C652076%2C5648811%2C565952%2C10856540%2C11527225%2C1624006%2C14793258%2C12013010

Request Chain 134

https://dc.ads.linkedin.com/collect/?pid=228428&fmt=gif HTTP 302
https://dc.ads.linkedin.com/collect/?pid=228428&fmt=gif&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D228428%26fmt%3Dgif%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?pid=228428&fmt=gif&cookiesTest=true&liSync=true

Request Chain 141

https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ref=&fmt=js&s=1 HTTP 302
https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ref=&fmt=js&s=1&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1540994547403%26pid%3D38436%26url%3Dhttps%253A%252F%252Fsearchwindowsserver.techtarget.com%252Ftutorial%252FTips-to-track-down-and-neutralize-PowerShell-malware%26pageUrl%3Dhttps%253A%252F%252Fsearchwindowsserver.techtarget.com%252Ftutorial%252FTips-to-track-down-and-neutralize-PowerShell-malware%26ref%3D%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ref=&fmt=js&s=1&cookiesTest=true&liSync=true

143 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set Tips-to-track-down-and-neutralize-PowerShell-malware Show response
searchwindowsserver.techtarget.com/tutorial/ 97 KB
38 KB 1038ms
499ms Document
text/html 206.19.49.153
AT&T Enhanced Net...

General

Check archive.org

Show headers Download Go to

Full URL

https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

206.19.49.153 , United States, ASN17225 (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services, US),

Reverse DNS

searchsites.techtarget.com

Software

Resource Hash

be7aecc1bf840fc84e51b3d2035231b0040b8c3450007bde261d529afdc6b54b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: searchwindowsserver.techtarget.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:16 GMT
X-Frame-Options: SAMEORIGIN
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Content-Language: en
Set-Cookie: JSESSIONID=C4C4F6D874A6CE7A19BC25BE21DB33A0; Path=/; HttpOnly cc=1; Path=/ f5_cspm=1234; TS017b6b21=012c66465912bfb9af33f8c468964c4fb2fd696d92a6a025cc8361f8b141ee46ef82a6ee4ea29623bf2f7ddda5b8ed6fe85b5b08629530d639aab255a0c4883b4e59b09d4064238af85e130fb735abe56836d3aa489467226fb723093ca32702a5c604961f; Path=/
P3P: CP="CAO DSP COR NID CURa ADMa TAIa IVAo IVDo CONo TELo OTPo OUR IND PHY ONL UNI NAV DEM"
Keep-Alive: timeout=5
Connection: Keep-Alive
Vary: Accept-Encoding
Content-Encoding: gzip
Transfer-Encoding: chunked

GET
S 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.10.2/ 91 KB
32 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:816::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Tue, 02 Oct 2018 06:22:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2533192
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 32954
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Oct 2019 06:22:25 GMT

GET
H/1.1 200
OK main.css
cdn.ttgtmedia.com/rms/ux/responsive/css/ 812 KB
163 KB 108ms
9ms Stylesheet
text/css 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: c00e21fa95cb8b66be4dd327c79b4a62e4a6cc9936664bbd4f1850128e481391

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 26 Oct 2018 20:05:52 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Oct 2018 20:07:59 GMT
Server: PWS/8.3.1.0.8
Age: 410185
Transfer-Encoding: chunked
Content-Type: text/css
Via: 1.1 VMmgnyNY2jb36:6 (W), 1.1 ml64:3 (W), 1.1 PSdgflkfFRA2lp71:3 (W)
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2lp71
Connection: keep-alive
Accept-Ranges: bytes
Expires: Fri, 02 Nov 2018 20:05:52 GMT

GET
H/1.1 200
OK responsive.min.js Show response
cdn.ttgtmedia.com/rms/ux/responsive/js/ 111 KB
44 KB 110ms
10ms Script
text/javascript 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/js/responsive.min.js?v=7.20.1
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 9fce2c31891f9363f0ec2c81396391396112024542b327124d4516e9b800e3f2

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 26 Oct 2018 20:05:52 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Oct 2018 20:06:32 GMT
Server: PWS/8.3.1.0.8
Age: 410185
Transfer-Encoding: chunked
Content-Type: text/javascript
Via: 1.1 VMmgnyNY2jb36:6 (W), 1.1 VMygldLON2tx53:3 (W), 1.1 PSdgflkfFRA2so76:5 (W)
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2so76
Connection: keep-alive
Accept-Ranges: bytes
Expires: Fri, 02 Nov 2018 20:05:52 GMT

GET
S 200 148927072.js Show response
cdn.optimizely.com/js/ 493 KB
128 KB 48ms
6ms Script
text/javascript 2.19.34.83
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/148927072.js

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2.19.34.83 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-19-34-83.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

9f3667c25cb4152a914acebf2c912b17bd01ad96351e6026bb2a1ca8f5355943

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: s_KDdy30iPmiv3AVcIVwEgnW.k90BTOG
content-encoding: gzip
etag: "d6fb708057aa1aede309aab51a64495e"
x-amz-request-id: D73BBE312971EF5F
status: 200
x-amz-replication-status: COMPLETED
access-control-allow-methods: GET, HEAD
server-timing: cdn;desc="AkamaiDSD";dur=0,rtt;desc="5";dur=0,cdnip;desc="2.19.34.83";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
vary: Accept-Encoding
content-length: 130003
x-amz-id-2: FfGmJ+DwDeXOE0HxGP+tAbvvX0yBG4Z4pdfz/9y+uRy5beJ48vlC2rkxDX0Pqy+lvrp88Eh93pE=
last-modified: Wed, 31 Oct 2018 13:04:20 GMT
server: AmazonS3
date: Wed, 31 Oct 2018 14:02:17 GMT
access-control-max-age: 86400
strict-transport-security: max-age=86400
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 28341
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H/1.1 200
OK nav_logo.png
cdn.ttgtmedia.com/rms/ux/responsive/img/ 850 B
1 KB 107ms
7ms Image
image/png 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/img/nav_logo.png
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 089aca69c964aa0d24bd619f1182ff5a5f2dc40f5a5e19d738b1f00c8bee4177

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 25 Oct 2018 20:22:46 GMT
Via: 1.1 hexi49:6 (W), 1.1 ml64:4 (W), 1.1 PSdgflkfFRA2gb73:9 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:40 GMT
Server: PWS/8.3.1.0.8
Age: 495571
Content-Type: image/png
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2gb73
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 850
Expires: Thu, 01 Nov 2018 20:22:46 GMT

GET
H/1.1 200
OK biljon_edward.jpg
cdn.ttgtmedia.com/rms/onlineImages/ 26 KB
26 KB 106ms
7ms Image
image/jpeg 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/rms/onlineImages/biljon_edward.jpg
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 7137a9e07d3efe2fb7bb132a50e92dfb502699b252d08e9939c000c930bddd5b

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 25 Oct 2018 08:51:59 GMT
Via: 1.1 ml62:0 (W), 1.1 PSdgflkfFRA2po75:14 (W)
Last-Modified: Fri, 18 May 2018 17:45:59 GMT
Server: PWS/8.3.1.0.8
Age: 537018
Content-Type: image/jpeg
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2po75
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 26204
X-Via: 1.1 ny92:4 (W)
Expires: Thu, 01 Nov 2018 08:51:59 GMT

GET
H/1.1 200
OK ttCmpApi.min.js Show response
cdn.ttgtmedia.com/cmp/ 2 KB
2 KB 143ms
142ms Script
text/javascript 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/cmp/ttCmpApi.min.js?_=1540994537306
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 9465d5f89c411d83b7e7f73d1770a327062c9ee121a823d6183b1d3392352801

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:17 GMT
Content-Encoding: gzip
Last-Modified: Tue, 21 Aug 2018 16:31:36 GMT
Server: PWS/8.3.1.0.8
Content-Type: text/javascript
Via: 1.1 PSmgnyNY2er187:2 (W), 1.1 VMygldLON2ct41:6 (W), 1.1 PSdgflkfFRA2so76:15 (W)
Cache-Control: max-age=604800
X-Px: ms PSdgflkfFRA2so76,ms VMygldLON2ct41,ms PSmgnyNY2er187(origin)
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1338
Expires: Wed, 07 Nov 2018 14:02:17 GMT

GET
H/1.1 200
OK index.php Show response
a.dpmsrv.com/dpmpxl/ 21 B
647 B 478ms
108ms Script
text/javascript 52.205.83.39
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?q=xSegList&cl=68&_=1540994537307
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.83.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-205-83-39.compute-1.amazonaws.com
Software: /
Resource Hash: 35ef9ac2d40057982eda09d60724c474cd8c211a24e682d310b68cc47edd9f7d

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 47
Expires: 0

GET
S 200 gtm.js Show response
www.googletagmanager.com/ 127 KB
36 KB 17ms
17ms Script
application/javascript 2a00:1450:4001:816::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PWWZSH

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

a44ef0c5f9249f261c5d298745943f5768f7d7635eab8babcbbfac24401fffc5

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:17 GMT
content-encoding: gzip
server: Google Tag Manager (scaffolding)
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 36780
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:17 GMT

GET
H/1.1 200
OK border_diagonal.png
cdn.ttgtmedia.com/rms/ux/responsive/img/ 108 B
510 B 9ms
7ms Image
image/png 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/img/border_diagonal.png
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 68f4a6009b77ef6b5cc867f57d0095ff7db697d95821fc747e5dae6cecdf79b9

Request headers

Referer: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 25 Oct 2018 20:22:37 GMT
Via: 1.1 VMmgnyNY2jb36:2 (W), 1.1 ml64:8 (W), 1.1 PSdgflkfFRA2po75:0 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:38 GMT
Server: PWS/8.3.1.0.8
Age: 495580
Content-Type: image/png
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2po75
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 108
Expires: Thu, 01 Nov 2018 20:22:37 GMT

GET
H/1.1 200
OK TechTarget-Icon.woff
cdn.ttgtmedia.com/rms/ux/responsive/fonts/ 31 KB
32 KB 68ms
8ms Font
application/x-woff 163.171.128.148
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/fonts/TechTarget-Icon.woff
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.128.148 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 9b0bf729b0c508d525b9e2252aa21a983b2345cd48968970c186be7b571944ab

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
Origin: https://searchwindowsserver.techtarget.com

Response headers

Date: Thu, 25 Oct 2018 20:22:40 GMT
Via: 1.1 VMmgnyNY2jb36:2 (W), 1.1 ml61:8 (W), 1.1 PSdgflkfFRA1vg90:16 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:18 GMT
Server: PWS/8.3.1.0.8
Age: 495577
Content-Type: application/x-woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA1vg90
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32200
Expires: Thu, 01 Nov 2018 20:22:40 GMT

GET
H/1.1 200
OK default_avatar.gif
cdn.ttgtmedia.com/ITKE/images/ 885 B
1 KB 11ms
10ms Image
image/gif 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/ITKE/images/default_avatar.gif
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 0ddab4a499baf8917710dd9018d2fbb3acfd1a53812f015de78002b2f625edcc

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 29 Oct 2018 06:59:27 GMT
Via: 1.1 VMmgnyNY2gh45:6 (W), 1.1 ml64:7 (W), 1.1 PSdgflkfFRA2mu72:15 (W)
Last-Modified: Wed, 07 Aug 2013 18:54:06 GMT
Server: PWS/8.3.1.0.8
Age: 198170
Content-Type: image/gif
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2mu72
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 885
Expires: Mon, 05 Nov 2018 06:59:27 GMT

GET
S 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 74 KB
27 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

9f2f0533b970a29e320c0d46b4d2b50ec58d2fba41397b92a57a19a08e3b79a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 28015
x-xss-protection: 1; mode=block
server: cafe
etag: 13925230685652762048
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 31 Oct 2018 14:02:17 GMT

GET
H/1.1 200
OK responsive-ui.min.js Show response
cdn.ttgtmedia.com/rms/ux/responsive/js/ 588 KB
188 KB 10ms
9ms Script
text/javascript 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/js/responsive-ui.min.js?v=7.20.1
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 6d5f2cdea6c144f4f86a4ada20334424387c593ffef8a5f41e47c66b62ea6869

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 26 Oct 2018 20:05:52 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Oct 2018 20:06:30 GMT
Server: PWS/8.3.1.0.8
Age: 410185
Transfer-Encoding: chunked
Content-Type: text/javascript
Via: 1.1 VMmgnyNY2jb36:6 (W), 1.1 ml62:4 (W), 1.1 PSdgflkfFRA2gb73:1 (W)
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2gb73
Connection: keep-alive
Accept-Ranges: bytes
Expires: Fri, 02 Nov 2018 20:05:52 GMT

GET
H/1.1 200
OK ScalaSansWeb-Bold.woff
cdn.ttgtmedia.com/rms/ux/responsive/fonts/ 38 KB
38 KB 8ms
7ms Font
application/x-woff 163.171.128.148
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/fonts/ScalaSansWeb-Bold.woff
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.128.148 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: a423ff62dd7f4d567b09e7cded40d10ce90e0f9fd61363f67f81d5f0c68b2326

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
Origin: https://searchwindowsserver.techtarget.com

Response headers

Date: Thu, 25 Oct 2018 20:22:40 GMT
Via: 1.1 VMmgnyNY2jb36:6 (W), 1.1 ml61:1 (W), 1.1 PSdgflkfFRA1gi91:15 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:19 GMT
Server: PWS/8.3.1.0.8
Age: 495577
Content-Type: application/x-woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA1gi91
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 38452
Expires: Thu, 01 Nov 2018 20:22:40 GMT

GET
H2 200 tNciLllFhds
www.youtube.com/embed/ Frame B730 0
0 174ms
174ms Document
text/html 2a00:1450:4001:815::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/tNciLllFhds

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/tNciLllFhds
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

status: 200
strict-transport-security: max-age=31536000
cache-control: no-cache
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
content-encoding: gzip
x-xss-protection: 1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube
x-content-type-options: nosniff
expires: Tue, 27 Apr 1971 19:44:06 EST
content-type: text/html; charset=utf-8
date: Wed, 31 Oct 2018 14:02:18 GMT
server: YouTube Frontend Proxy
set-cookie: VISITOR_INFO1_LIVE=n8yX1FYQkG0; path=/; domain=.youtube.com; expires=Mon, 29-Apr-2019 14:02:17 GMT; httponly YSC=0rcI_ML_fmY; path=/; domain=.youtube.com; httponly VISITOR_INFO1_LIVE=n8yX1FYQkG0; path=/; domain=.youtube.com; expires=Mon, 29-Apr-2019 14:02:17 GMT; httponly PREF=f1=50000000; path=/; domain=.youtube.com; expires=Tue, 02-Jul-2019 01:55:18 GMT GPS=1; path=/; domain=.youtube.com; expires=Wed, 31-Oct-2018 14:32:17 GMT
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"

GET
H/1.1 200
OK / Show response
api.ipify.org/ 23 B
274 B 417ms
105ms XHR
application/json 54.243.123.39
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.123.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-243-123-39.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 0d70317736ee638a11fe9ee8ab969204dfdd81f352b0de49c46fd40a52a50b9b

Request headers

Accept: */*
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:18 GMT
Via: 1.1 vegur
Server: Cowboy
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://searchwindowsserver.techtarget.com
Connection: keep-alive
Content-Length: 23

GET
S 200 analytics.js Show response
www.google-analytics.com/ 42 KB
17 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:816::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWWZSH

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN (),

Reverse DNS

Software

Golfe2 /

Resource Hash

8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Oct 2018 19:41:26 GMT
server: Golfe2
age: 5996
date: Wed, 31 Oct 2018 12:22:22 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 17301
expires: Wed, 31 Oct 2018 14:22:22 GMT

GET
H/1.1 200
OK advertisement.js Show response
cdn.ttgtmedia.com/rms/ux/javascript/ 32 B
447 B 9ms
7ms Script
text/javascript 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/rms/ux/javascript/advertisement.js
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 6b79a0e2ee012ec44afb4ae22c62245df15412aff1012948287d6ef71e4dbfd5

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 29 Oct 2018 06:45:44 GMT
Via: 1.1 VMygldLON2tx53:2 (W), 1.1 PSdgflkfFRA2po75:8 (W)
Last-Modified: Mon, 26 Mar 2018 18:35:52 GMT
Server: PWS/8.3.1.0.8
Age: 198994
Content-Type: text/javascript
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2po75
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32
X-Via: 1.1 ny93:6 (W)
Expires: Mon, 05 Nov 2018 06:45:44 GMT

GET
S 200 hotjar-62091.js Show response
static.hotjar.com/c/ 5 KB
2 KB 97ms
58ms Script
application/javascript 147.75.33.193
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-62091.js?sv=5

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.33.193 , Switzerland, ASN54825 (PACKET - Packet Host, Inc., US),

Reverse DNS

pkt-ams-k1-14

Software

Resource Hash

6c7f9acf1c334d5aad71fdd6b5dde4e036fa99ffb1aa9623bfef7111d7d9f45e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/e8755a35d8cdfeaf9c569a74c6caeb38
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=60
section-io-origin-time-seconds: 0.020
section-io-origin-status: 304
accept-ranges: bytes
section-io-id: 96eebea3b48382766b22e545eac00a36
content-length: 1859

GET
H/1.1 200
OK Cookie set sp-config.min.js Show response
media.techtarget.com/cmp/sourcepoint/ 2 KB
1 KB 651ms
120ms Script
text/javascript 206.19.49.139
AT&T Enhanced Net...

General

Check archive.org

Show headers Download Go to

Full URL: https://media.techtarget.com/cmp/sourcepoint/sp-config.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWWZSH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.19.49.139 , United States, ASN17225 (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services, US),
Reverse DNS: media.techtarget.com
Software: /
Resource Hash: 4bc047a9a0e8f0705b3f1a52688f80ec9ec170c6554e32dbe2e5a38c823624f1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: media.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Cookie: lastVisited=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware; tt_prereg=t1%40298560%24t2%40311192%24_2018-10-31%2010%3A02%3A16%26g%3D252450465
Connection: keep-alive
Cache-Control: no-cache
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Content-Encoding: gzip
Last-Modified: Fri, 07 Sep 2018 18:07:49 GMT
Vary: Accept-Encoding
Content-Type: text/javascript
Set-Cookie: BIGipServermedia-pool=2214709258.20480.0000; path=/; Httponly; Secure TS018246fb=012c66465943cd80cb2dc09ba2fa9d0a9d4ed049a56ba5ccd7c92666dd4991c6a0f002826feb942f3134a748ea7983a7dc491fc84068fb18ac70b3cd2b4a3cc6a1d39b2a22; Path=/
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 887

GET
H/1.1 200
OK dpm_b4c96d80854dd27e76d8cc9e21960eebda52e962.min.js Show response
s.dpmsrv.com/ 224 KB
48 KB 49ms
8ms Script
application/x-javascript 52.222.161.56
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.dpmsrv.com/dpm_b4c96d80854dd27e76d8cc9e21960eebda52e962.min.js
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.161.56 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-222-161-56.fra54.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 34530467c0e18370289206da24eaabe741e7439eb0e4142c0c3b88b1597fa1ea

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 26 Oct 2018 21:30:41 GMT
Content-Encoding: gzip
Last-Modified: Fri, 26 Oct 2018 21:30:25 GMT
Server: AmazonS3
Age: 59489
ETag: "3ed6b55d152adff453ec4d5c3a423882"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 1eb4c4d1a01293f27e472fcc60f7102d.cloudfront.net (CloudFront)
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49162
X-Amz-Cf-Id: _Q25V2pptXrkP1sSIFJQERU1FOjCZGS0XI2WgkkVR1AMuy4dPy9udA==

GET
H/1.1 200
OK 7034.js Show response
dnn506yrbagrg.cloudfront.net/pages/scripts/0012/ 81 B
563 B 68ms
9ms Script
application/x-javascript 52.222.163.163
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dnn506yrbagrg.cloudfront.net/pages/scripts/0012/7034.js?428054
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.163.163 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-222-163-163.fra54.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 69d029e725cb27d33c3f2d9ada4c835d9625a8acf19153e865877bda03724c92

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 26 Oct 2018 00:30:47 GMT
Via: 1.1 e4a44efc4b3241dc23019df63a1f645c.cloudfront.net (CloudFront)
Last-Modified: Fri, 26 Oct 2018 00:19:08 GMT
Server: AmazonS3
Age: 19818
ETag: "94f2ea4ac9d7e78133ba6c7b2e38176c"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Cache-Control: max-age=28800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 81
X-Amz-Cf-Id: qPaVBVjKPRjXuIrePXVZDYCgkC3RWxwek9wDVOwK-72kKYKKJpx_Mg==

GET
S 200 gpt.js Show response
www.googletagservices.com/tag/js/ 24 KB
9 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:816::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: cdn.ttgtmedia.com
URL: https://cdn.ttgtmedia.com/rms/ux/responsive/js/responsive.min.js?v=7.20.1

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

78025a79f047843cc81cc0ef7d374c70b9c277e13dc3bd231d77e48716fb79e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "9 / 777 of 1000 / last-modified: 1540941399"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 8940
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:18 GMT

GET
S 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
930 B 7ms
6ms Script
text/javascript 2a00:1450:4001:816::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN (),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 13:22:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 2374
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 856
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:22:44 GMT

GET
H/1.1 200
OK footer_logo.png
cdn.ttgtmedia.com/rms/ux/responsive/img/ 2 KB
2 KB 10ms
10ms Image
image/png 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/img/footer_logo.png
Requested by: Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 9805cd8364c8039be102b2a24b2095eeed846301e212b5b40b3fa2e659d80eba

Request headers

Referer: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 25 Oct 2018 20:23:18 GMT
Via: 1.1 VMmgnyNY2jb36:5 (W), 1.1 ml64:2 (W), 1.1 PSdgflkfFRA2mu72:12 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:43 GMT
Server: PWS/8.3.1.0.8
Age: 495540
Content-Type: image/png
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2mu72
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2141
Expires: Thu, 01 Nov 2018 20:23:18 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
109 B 6ms
6ms Image
image/gif 2a00:1450:4001:816::200e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j71&aip=1&a=1455586231&t=pageview&_s=1&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ul=en-us&de=UTF-8&dt=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGBAgEAj~&jid=1247325169&gjid=789115574&cid=1079789860.1540994539&uid=0&tid=UA-18475716-9&_gid=166076948.1540994539&gtm=2wgam0PWWZSH&cg1=TUTORIAL%20content&cg2=Topics-298397&cg3=20181011&cg4=Server%20Monitoring%20and%20Management-1175354&cg5=%2Fpage%2Fetpk_Topics-298397%2Fptpk_Windows%20Server%20management-298560%2Ftrue%2FTUTORIAL%2Fcontent%2Fcid_252450465%2Fdate_20181011%2Fmem_55%2Fclst_WinSer08-2240022262%2Frtpk_Server%20Monitoring%20and%20Management-1175354%2Fidx_0%2Furl_https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&cd1=Topics-298397&cd2=Windows%20Server%20management-298560&cd3=TUTORIAL%20content&cd4=252450465&cd5=20181011&cd6=55&cd7=WinSer08&cd8=Server%20Monitoring%20and%20Management-1175354&cd9=NOT_MEMBER&cd10=148.251.45.0&cd11=false&cd12=0&cd13=&z=397295710

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN (),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Oct 2018 19:31:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2140254
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
stats.g.doubleclick.net/r/ 35 B
110 B 16ms
15ms Image
image/gif 2a00:1450:400c:c0c::9b
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j71&tid=UA-18475716-9&cid=1079789860.1540994539&jid=1247325169&uid=0&gjid=789115574&_gid=166076948.1540994539&_u=YGBAgEAj~&z=823053144

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:400c:c0c::9b , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 31 Oct 2018 14:02:18 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
171 B 18ms
17ms Script
application/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=searchwindowsserver.techtarget.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 104
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 17ms
17ms Script
application/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=searchwindowsserver.techtarget.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 104
x-xss-protection: 1; mode=block

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ 201 KB
75 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

181124d1788d7083ab1de6fbeb87f524e1a3c9658ccdf54c4f49ab523df2253c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 76196
x-xss-protection: 1; mode=block
server: cafe
etag: 4706987710021974220
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Oct 2018 14:02:18 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame D928 201 KB
75 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

181124d1788d7083ab1de6fbeb87f524e1a3c9658ccdf54c4f49ab523df2253c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 76196
x-xss-protection: 1; mode=block
server: cafe
etag: 4706987710021974220
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Oct 2018 14:02:18 GMT

GET
S 200 ca-pub-6050985421795229.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ 309 B
290 B 6ms
6ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-6050985421795229.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c7752f14cbf3f80287f4300704bf27186a052b2add79dfbb22d0903039a90743

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 06:43:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 30 Oct 2018 21:21:42 GMT
server: sffe
age: 26352
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 175
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 18:43:06 GMT

GET
S 200 modules-239439752d7ca7c58c060cde4a84a63c.js Show response
script.hotjar.com/ 399 KB
80 KB 49ms
13ms Script
application/javascript 147.75.33.193
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules-239439752d7ca7c58c060cde4a84a63c.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-62091.js?sv=5

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.33.193 , Switzerland, ASN54825 (PACKET - Packet Host, Inc., US),

Reverse DNS

pkt-ams-k1-14

Software

Resource Hash

e10e88b7d198adf9eea71630d08b7ef76b1cb59f2e72dfc70b059f3e013e3f26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript
last-modified: Wed, 31 Oct 2018 11:35:55 GMT
etag: W/"239439752d7ca7c58c060cde4a84a63c"
status: 200
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.053
accept-ranges: bytes
section-io-id: c370b3ba22128ca8421016cf615149c0
content-length: 81975

GET
S 200 pubads_impl_271.js Show response
securepubads.g.doubleclick.net/gpt/ 185 KB
63 KB 38ms
38ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

672405b1c5eb6fd81a06485f830bc572d3e2580fe084bc4d15608f9ff746d545

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Oct 2018 21:48:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 63997
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:18 GMT

GET
S 200 collect
www.google-analytics.com/r/ 35 B
111 B 14ms
14ms Image
image/gif 2a00:1450:4001:816::200e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j71&aip=1&a=1455586231&t=pageview&_s=1&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ul=en-us&de=UTF-8&dt=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAAEAj~&jid=1144144915&gjid=470714654&cid=1079789860.1540994539&uid=0&tid=UA-19047342-11&_gid=166076948.1540994539&_r=1&gtm=2wgam0PWWZSH&z=332800825

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN (),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
103 B 6ms
6ms Image
image/gif 2a00:1450:4001:816::200e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j71&aip=1&a=1455586231&t=pageview&_s=1&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ul=en-us&de=UTF-8&dt=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGHAgEAj~&jid=447965062&gjid=821100395&cid=1079789860.1540994539&uid=0&tid=UA-19047342-17&_gid=166076948.1540994539&gtm=2wgam0PWWZSH&cg1=TUTORIAL%20content&cg2=Topics-298397&cg3=20181011&cg4=Server%20Monitoring%20and%20Management-1175354&cg5=%2Fpage%2Fetpk_Topics-298397%2Fptpk_Windows%20Server%20management-298560%2Ftrue%2FTUTORIAL%2Fcontent%2Fcid_252450465%2Fdate_20181011%2Fmem_55%2Fclst_WinSer08-2240022262%2Frtpk_Server%20Monitoring%20and%20Management-1175354%2Fidx_0%2Furl_https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&cd1=Topics-298397&cd2=Windows%20Server%20management-298560&cd3=TUTORIAL%20content&cd4=252450465&cd5=20181011&cd6=55&cd7=WinSer08&cd8=Server%20Monitoring%20and%20Management-1175354&cd9=NOT_MEMBER&cd10=148.251.45.0&cd11=false&cd12=0&cd13=&z=1858393744

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN (),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Oct 2018 19:31:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2140254
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
stats.g.doubleclick.net/r/ 35 B
110 B 16ms
15ms Image
image/gif 2a00:1450:400c:c0c::9b
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j71&tid=UA-19047342-17&cid=1079789860.1540994539&jid=447965062&uid=0&gjid=821100395&_gid=166076948.1540994539&_u=aGHAgEAj~&z=32752954

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:400c:c0c::9b , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 31 Oct 2018 14:02:18 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cle_toolbar.gif
cdn.ttgtmedia.com/rms/ux/responsive/img/ 68 B
469 B 7ms
6ms Image
image/gif 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/img/cle_toolbar.gif
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 2160a63f0c7e46c31551cfba0862153756107739bdd3b3caa0bdfd5f09fb9dc3

Request headers

Referer: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 25 Oct 2018 20:22:54 GMT
Via: 1.1 VMmgnyNY2jb36:1 (W), 1.1 ml61:0 (W), 1.1 PSdgflkfFRA2so76:5 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:37 GMT
Server: PWS/8.3.1.0.8
Age: 495564
Content-Type: image/gif
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2so76
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68
Expires: Thu, 01 Nov 2018 20:22:54 GMT

GET
H/1.1 200
OK cle_buttons.gif
cdn.ttgtmedia.com/rms/ux/responsive/img/ 3 KB
3 KB 7ms
7ms Image
image/gif 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/img/cle_buttons.gif
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 47400eaeeee9e42b6ff93b70ae1cd345aef952f56bdff6350760bea146432c9e

Request headers

Referer: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 25 Oct 2018 20:22:54 GMT
Via: 1.1 VMmgnyNY2jb36:1 (W), 1.1 VMygldLON2ct41:5 (W), 1.1 PSdgflkfFRA2po75:5 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:37 GMT
Server: PWS/8.3.1.0.8
Age: 495564
Content-Type: image/gif
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2po75
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3064
Expires: Thu, 01 Nov 2018 20:22:54 GMT

GET
H/1.1 200
OK cle_codebutton.gif
cdn.ttgtmedia.com/rms/ux/responsive/img/ 194 B
597 B 7ms
6ms Image
image/gif 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/rms/ux/responsive/img/cle_codebutton.gif
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 1fae3d21b09d0f4dc0726679d549722befc2a4e976d9020dce595264c94d30f7

Request headers

Referer: https://cdn.ttgtmedia.com/rms/ux/responsive/css/main.css?v=7.20.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 25 Oct 2018 20:22:54 GMT
Via: 1.1 VMmgnyNY2jb36:1 (W), 1.1 ml61:8 (W), 1.1 PSdgflkfFRA2po75:15 (W)
Last-Modified: Thu, 18 Oct 2018 20:06:34 GMT
Server: PWS/8.3.1.0.8
Age: 495564
Content-Type: image/gif
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2po75
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 194
Expires: Thu, 01 Nov 2018 20:22:54 GMT

GET
H/1.1 200
OK Cookie set GetUserFromCookies Show response
users.techtarget.com/registration/rest/RegistrationService/ 110 B
408 B 632ms
123ms Script
application/x-javascript 206.19.49.191
AT&T Enhanced Net...

General

Check archive.org

Show headers Download Go to

Full URL: https://users.techtarget.com/registration/rest/RegistrationService/GetUserFromCookies?callback=jQuery110204544896418714053_1540994537308&_=1540994537309
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 206.19.49.191 , United States, ASN17225 (ATT-CERFNET-BLOCK - AT&T Enhanced Network Services, US),
Reverse DNS
Software: /
Resource Hash: d0c72e35a64b5f6999eeb5611d44a9786f53fdfc98fe68b5b3d9a697f4bb31e8

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: users.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Cookie: _ga=GA1.2.1079789860.1540994539; _gid=GA1.2.166076948.1540994539; _dc_gtm_UA-18475716-9=1; _dc_gtm_UA-19047342-17=1
Connection: keep-alive
Cache-Control: no-cache
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Cache-Control: private
Set-Cookie: TS01da9a2e=012c66465951aee63747479510f604a701d837178bfd8e4957a4606f248c1404dc93494f042c864babaac4e330f851022cd648a6a3; Path=/
Transfer-Encoding: chunked
Content-Type: application/x-javascript

GET
H/1.1

200
OK

spacer.gif
cdn.ttgtmedia.com/images/
Redirect Chain

https://go.techtarget.com/clicktrack-r/activity/activity.gif?activityTypeId=16&t=298560&t2=311192&a=2018-10-31%2010:02:16&g=252450465&c=normal&r=339227
https://cdn.ttgtmedia.com/images/spacer.gif

43 B
442 B

11ms
6ms

Image
image/gif

163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.ttgtmedia.com/images/spacer.gif
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: cdn.ttgtmedia.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Connection: keep-alive
Cache-Control: no-cache
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 29 Oct 2018 06:44:41 GMT
Via: 1.1 ml62:2 (W), 1.1 PSdgflkfFRA2sg74:3 (W)
Last-Modified: Fri, 20 Jan 2012 13:30:40 GMT
Server: PWS/8.3.1.0.8
Age: 199058
Content-Type: image/gif
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2sg74
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
X-Via: 1.1 ny93:3 (W)
Expires: Mon, 05 Nov 2018 06:44:41 GMT

Redirect headers

Location: https://cdn.ttgtmedia.com/images/spacer.gif
Date: Wed, 31 Oct 2018 14:02:19 GMT
Set-Cookie: bk=67f472b8-650d-4a27-b5c5-212d0ba749a6; domain=.techtarget.com; path=/; expires=Tue, 29-Jan-2019 14:02:19 GMT co=%7B%22ipAddress%22%3A%22148.251.45.254%22%2C%22industry%22%3A%22UNKNOWN%22%2C%22countryId%22%3A%22UNKNOWN%22%2C%22empSize%22%3A%22UNKNOWN%22%2C%22empSizeId%22%3A%22UNKNOWN%22%2C%22name%22%3A%22UNKNOWN%22%2C%22id%22%3A%22UNKNOWN%22%2C%22state%22%3A%22UNKNOWN%22%2C%22countryName%22%3A%22UNKNOWN%22%7D; domain=.techtarget.com; path=/; expires=Tue, 29-Jan-2019 14:02:19 GMT TS01c54b6d=012c66465942304e46c24da83a7859661200378c58fc5a064832195af90310af196a952fde800556ff510e8aff30224c1dcfc2a5f2; Path=/ TS014200a8=012c66465960ee0765b2a5ab51bfc6d0a7df8b4905fc5a064832195af90310af196a952fde928ac9050a4125d87afa824716c2a3ba38ce3d3697b934eeca377a0ff530733e011988d06721a8bccc9825b711e10d37; path=/; domain=.techtarget.com
Content-Type: text/html; charset=utf-8
Content-Length: 81
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/ Frame 009F 0
0 6ms
6ms Document
text/html 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20181024/r20180604/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 25 Oct 2018 05:45:53 GMT
expires: Thu, 08 Nov 2018 05:45:53 GMT
content-type: text/html; charset=UTF-8
etag: 12810928231326100212
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 6940
x-xss-protection: 1; mode=block
cache-control: public, max-age=1209600
age: 548185
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 3ABD 0
0 362ms
361ms Document
text/html 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6050985421795229&output=html&h=90&slotname=8728364240&adk=1245650348&adf=95884912&w=1200&fwrn=4&fwrnh=100&lmt=1540994538&rafmt=1&guci=1.2.0.0.2.2.0&format=1200x90&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&flash=0&fwr=0&resp_fmts=3&wgl=1&adsid=NT&dt=1540994538718&bpp=31&bdt=1437&fdt=207&idt=205&shv=r20181024&cbv=r20180604&saldr=aa&abxe=1&correlator=8787806382796&frm=20&pv=2&ga_vid=1079789860.1540994539&ga_sid=1540994539&ga_hid=1455586231&ga_fc=0&iag=0&icsg=146028898464&dssz=48&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=193&ady=6709&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853%2C21070025%2C111541704&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=7&osw_key=766350602&ifi=1&fsb=1&xpc=jLbGUG4yFJ&p=https%3A//searchwindowsserver.techtarget.com&dtd=233

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6050985421795229&output=html&h=90&slotname=8728364240&adk=1245650348&adf=95884912&w=1200&fwrn=4&fwrnh=100&lmt=1540994538&rafmt=1&guci=1.2.0.0.2.2.0&format=1200x90&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&flash=0&fwr=0&resp_fmts=3&wgl=1&adsid=NT&dt=1540994538718&bpp=31&bdt=1437&fdt=207&idt=205&shv=r20181024&cbv=r20180604&saldr=aa&abxe=1&correlator=8787806382796&frm=20&pv=2&ga_vid=1079789860.1540994539&ga_sid=1540994539&ga_hid=1455586231&ga_fc=0&iag=0&icsg=146028898464&dssz=48&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=193&ady=6709&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853%2C21070025%2C111541704&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=7&osw_key=766350602&ifi=1&fsb=1&xpc=jLbGUG4yFJ&p=https%3A//searchwindowsserver.techtarget.com&dtd=233
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 31 Oct 2018 14:02:19 GMT
server: cafe
cache-control: private
content-length: 19376
x-xss-protection: 1; mode=block
set-cookie: test_cookie=CheckForPermission; expires=Wed, 31-Oct-2018 14:17:18 GMT; path=/; domain=.doubleclick.net
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
expires: Wed, 31 Oct 2018 14:02:19 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ 73 KB
27 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

cce5c991fc672328e8eb7e5f9026496acd4fa608d26d0df95c54b7f16a8e5cc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 25 Oct 2018 04:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 551601
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 27406
x-xss-protection: 1; mode=block
server: cafe
etag: 6345757217691752979
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Nov 2018 04:48:57 GMT

GET
S 200 conversion.js Show response
www.googleadservices.com/pagead/ 22 KB
9 KB 20ms
20ms Script
text/javascript 172.217.22.98
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWWZSH

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

81604ddab14d0a30fd094b6a02f8ae65b582a874bf099399f0686f0a762cfd43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 8637
x-xss-protection: 1; mode=block
server: cafe
etag: 12895511687043389941
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 31 Oct 2018 14:02:19 GMT

GET
H/1.1

200
OK

index.php Show response
a.dpmsrv.com/dpmpxl/
Redirect Chain

https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&sw%3D252450465https%253A%252F%252Fsearchwindowsserver.techtarget.com%252Ftutorial%252FTips-to-track-down-and-neutralize-Pow...
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26sw%253D252450465https%25253A%25252F%25252Fsearchwindowsserver.techtarget.com%25252Ftutorial%2...
https://a.dpmsrv.com/dpmpxl/index.php?id=1277909405928765554&sw=252450465https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&q=xImp&v=...

256 B
957 B

110ms
109ms

Script
text/javascript

52.205.83.39
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?id=1277909405928765554&sw=252450465https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&q=xImp&v=1.x&cl=68&pixelIndex=0&r=528991&tzOffset=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&_=1540994539014
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.83.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-205-83-39.compute-1.amazonaws.com
Software: /
Resource Hash: 18d9d5b72b55a90176b54d75ca2cfe8bcb5833cf2de5c73107600ee60b7d6e6c

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 224
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 31 Oct 2018 14:02:21 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 307.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.140:80
AN-X-Request-Uuid: a1289524-f03e-4ef2-8258-3f7ecd90d84f
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://a.dpmsrv.com/dpmpxl/index.php?id=1277909405928765554&sw=252450465https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&q=xImp&v=1.x&cl=68&pixelIndex=0&r=528991&tzOffset=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&_=1540994539014
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rcj-da10bd4908deb9e19dfde013ec3fe4ff.html
vars.hotjar.com/ Frame FD34 0
0 79ms
16ms Document
text/html 147.75.33.209
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/rcj-da10bd4908deb9e19dfde013ec3fe4ff.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-62091.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.33.209 , Switzerland, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS: pkt-ams-k1-13
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /rcj-da10bd4908deb9e19dfde013ec3fe4ff.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

status: 200
date: Wed, 31 Oct 2018 14:02:18 GMT
content-type: text/html
content-length: 857
cache-control: max-age=31536000
last-modified: Wed, 24 Oct 2018 20:00:52 GMT
section-io-origin-status: 200
section-io-origin-time-seconds: 0.053
etag: W/"da10bd4908deb9e19dfde013ec3fe4ff"
content-encoding: gzip
accept-ranges: bytes
section-io-id: 204def56da21f1a4192fa82bd79ab24d

GET
S 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1070110249/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070110249/?random=1540994539053&cv=9&fst=1540994539053&num=1&label=RRsgCOW4tgMQqayi_gM&guid=ON&resp=GooglemKTybQhCsO&eid=659255991&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&tiba=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

9b663abb873cd420102a0e903deda94c8dcdef433bc653d1f3ab20ae98b3c168

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 1047
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 3 KB
2 KB 68ms
67ms XHR
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4435268146233971&correlator=2735401759818372&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21061743%2C21062716%2C21061763%2C21062388&vrg=271&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A32776&sc=1&sfv=1-0-30&iu=%2F3618%2Fswcpt%2FTUTORIAL&sz=728x90&cookie_enabled=1&bc=7&abxe=1&lmt=1540994539&dt=1540994539145&dlt=1540994537281&idt=1827&frm=20&biw=1585&bih=1200&oid=3&adx=429&ady=160&adk=3370543125&uci=1&gut=v2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&dssz=55&icsg=431558314568192&mso=32&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x110&msz=728x110&ga_vid=1079789860.1540994539&ga_sid=1540994539&ga_hid=1455586231&fws=0

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

0f0d60b9687dcc2280d1776e862f8504b1325d64552bc24ef3bb54acb5a116be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 2075
x-xss-protection: 1; mode=block
google-lineitem-id: 125980537
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138222743292
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://searchwindowsserver.techtarget.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 pubads_impl_rendering_271.js Show response
securepubads.g.doubleclick.net/gpt/ 59 KB
23 KB 41ms
40ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_271.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

7d8de09d093c892c317f4f678dcb56124f7d07d6d02ee7277ec43088935cdcc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Oct 2018 21:48:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 22946
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:19 GMT

GET
S 200 container.html
tpc.googlesyndication.com/safeframe/1-0-30/html/ 0
0 7ms
6ms Other
text/html 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-30/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Purpose: prefetch
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires: Sat, 12 Oct 2019 19:46:32 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Fri, 12 Oct 2018 04:28:13 GMT
content-type: text/html

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 3 KB
2 KB 77ms
77ms XHR
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4435268146233971&correlator=2735401759818372&output=json_html&callback=googletag.impl.pubads.callbackProxy2&impl=fif&adsid=NT&eid=21061743%2C21062716%2C21061763%2C21062388&vrg=271&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A32776&sc=1&sfv=1-0-30&iu=%2F3618%2Fswcpt%2FTUTORIAL&sz=300x250&scp=pos%3Dtop&cookie_enabled=1&bc=7&abxe=1&lmt=1540994539&dt=1540994539167&dlt=1540994537281&idt=1827&frm=20&biw=1585&bih=1200&oid=3&adx=1053&ady=418&adk=1772476611&uci=2&gut=v2&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&dssz=56&icsg=2683358128253440&mso=32&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1079789860.1540994539&ga_sid=1540994539&ga_hid=1455586231&fws=0

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

85afbe94f7129f728ae31b28904b782d042c9d80d56e71c85ffba0972e1179bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 2075
x-xss-protection: 1; mode=block
google-lineitem-id: 125980537
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138222777751
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://searchwindowsserver.techtarget.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
2 KB 81ms
81ms XHR
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4435268146233971&correlator=2735401759818372&output=json_html&callback=googletag.impl.pubads.callbackProxy3&impl=fif&adsid=NT&eid=21061743%2C21062716%2C21061763%2C21062388&vrg=271&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A32776&sc=1&sfv=1-0-30&iu=%2F3618%2Fswcpt%2FTUTORIAL&sz=300x600%7C300x251&scp=pos%3Dbottom&cookie_enabled=1&bc=7&abxe=1&lmt=1540994539&dt=1540994539177&dlt=1540994537281&idt=1827&frm=20&biw=1585&bih=1200&oid=3&adx=713&ady=2125&adk=3243098495&uci=3&gut=v2&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&dssz=56&icsg=2683358128253440&mso=32&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=320x600&msz=300x600&ga_vid=1079789860.1540994539&ga_sid=1540994539&ga_hid=1455586231&fws=0

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

f1d67d48291fa44708beb964121a529af0c8f09a2166011d418eb77e6e679f58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 2085
x-xss-protection: 1; mode=block
google-lineitem-id: 169022977
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 50871655297
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://searchwindowsserver.techtarget.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1072226410/ 2 KB
1 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072226410/?random=1540994539180&cv=9&fst=1540994539053&num=2&label=x3P_CIql1gMQ6sCj_wM&guid=ON&resp=GooglemKTybQhCsO&eid=659255991&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&tiba=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

76f089cc691e39d8cbd7d46dc4da99d4497f3a3baeeca91b846905fc9dccc360

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 1048
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 /
www.google.com/pagead/1p-user-list/1070110249/ 42 B
146 B 25ms
21ms Image
image/gif 2a00:1450:4001:816::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1070110249/?random=1540994539053&cv=9&fst=1540994400000&num=1&label=RRsgCOW4tgMQqayi_gM&guid=ON&eid=659255991&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&tiba=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&fmt=3&crd=CITQGw&cdct=2&is_vtc=1&random=4013118623&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 /
www.google.de/pagead/1p-user-list/1070110249/ 42 B
109 B 26ms
22ms Image
image/gif 2a00:1450:4001:821::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1070110249/?random=1540994539053&cv=9&fst=1540994400000&num=1&label=RRsgCOW4tgMQqayi_gM&guid=ON&eid=659255991&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&tiba=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&fmt=3&crd=CITQGw&cdct=2&is_vtc=1&random=4013118623&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK auto_opt_in-v2.0.1083.js Show response
sp-js-releases.s3.amazonaws.com/0/2.0.1083/ 41 KB
42 KB 472ms
110ms Script
application/javascript 52.216.169.107
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-js-releases.s3.amazonaws.com/0/2.0.1083/auto_opt_in-v2.0.1083.js
Requested by: Host: media.techtarget.com
URL: https://media.techtarget.com/cmp/sourcepoint/sp-config.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.169.107 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 675e55c6e17480e86b0edfb65a5b62a68e3fb9ab955103b841887c52312f25d3

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:20 GMT
Last-Modified: Wed, 05 Sep 2018 06:20:18 GMT
Server: AmazonS3
x-amz-request-id: 6490AF81B4341B7A
ETag: "008d8488be915ad04ffefe0ef2b56450"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 42369
x-amz-id-2: 6pkMMqAH9iPR1YYkQZ2pVOeEZ5s6LK7HXJ4+o6qLoOd6uH/M+hn68z0/JEKQdvwhrquJaUqNWqg=

GET
H/1.1 200
OK showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame 66CB 40 KB
16 KB 94ms
12ms Script
text/html 23.54.114.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_271.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.114.218 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-54-114-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: cefea029ab424868d0c3ba1400e3f1ad3106300a27aeed3e2d780132bcac5575

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Oct 2018 07:18:58 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "13006c6-9ebc-577c68d245522"
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: public, max-age=32943
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/html; charset=UTF-8
Content-Length: 15268
Expires: Wed, 31 Oct 2018 23:11:22 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 66CB 73 KB
27 KB 13ms
6ms Script
text/javascript 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 24 Oct 2018 17:13:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 27234
x-xss-protection: 1; mode=block
server: cafe
etag: 10801174140179827322
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Nov 2018 17:13:30 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame 66CB 0
56 B 27ms
19ms Image
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskL2kMSMlpwNO2WV6tGkSSFA3FsH_rWA0Ep-PjnzjVrYue4190ppRNxmhdVFs5WwiHOqQDe7NgVk_l_LgIyC8uxaTHV4L7pVFMT5fgK4jeNr3-mUSeBZS_GpB5hSVJ_4_dCL2qlW6y-kYNkx20Rv3SED6eVyFVB8a2nZIuIwReCk-O7HFRsSUt9yXjOSVEc2yBBha7aGJG9K47_kSP83AFYOGq1qTuGeUFcy1_wEN1TbdYsa1wX_Wmf1TbcF5zM8rdgP3X04iTWU0kSnQ&sai=AMfl-YRTQgv7dbjr7EIAFmvo9zOrjUM-9G6HCSJiDHSCUhXtZ9g94_C9td2neItsfU_D-L70ilBmnlDEGObuliu-bp4OUA8m6ET-eM2gMymbtWM6CyFDWXzdIpgh77F1&sig=Cg0ArKJSzIzjfBxcnW3VEAE&urlfix=1&adurl=

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:19 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 0
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame F2A2 40 KB
16 KB 83ms
14ms Script
text/html 23.54.114.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_271.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.114.218 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-54-114-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: cefea029ab424868d0c3ba1400e3f1ad3106300a27aeed3e2d780132bcac5575

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Oct 2018 07:18:58 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "13006c6-9ebc-577c68d245522"
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: public, max-age=32943
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/html; charset=UTF-8
Content-Length: 15268
Expires: Wed, 31 Oct 2018 23:11:22 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame F2A2 73 KB
27 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 24 Oct 2018 17:13:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 27234
x-xss-protection: 1; mode=block
server: cafe
etag: 10801174140179827322
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Nov 2018 17:13:30 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame F2A2 0
72 B 20ms
19ms Image
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunGi52wPKFosI7OPrSOJjxqQ7_IicGiD7FO3HtTd9SgwDuMddVdtU1VqgXNt767NVItkkRBCbtjeEufnqwXNXfJE630w8HfsV3UhwNcCZL6kTWvDx66pJNzn_LyTbQ5E-1t8LYzbKAH-RtLJTtnbLp1riJsYRLMVoURrOGFYSxxrGS7_3mQWPIhZSyiHORYZNLvjse67S92lczLMYnc7LyRLEhPXncnRO8zFGkqW-nM4MBnw0WyDWcU6SbeOa1RxGFY38qBo04UBc7xYk&sai=AMfl-YR32sG75lfgWccfs_sYm44xIkAQb-KKeOQC3ldU1XLTkuGzOcDGiLzk_ANfi83l_-nLmINND6gWjWtQyMNUsarra3gBaHEHizHWqWc1QdK577sFJGYlPtReVeqt&sig=Cg0ArKJSzPsiUaomgtgNEAE&urlfix=1&adurl=

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:19 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 0
x-xss-protection: 1; mode=block

GET
S 200 /
www.google.com/pagead/1p-user-list/1072226410/ 42 B
109 B 22ms
21ms Image
image/gif 2a00:1450:4001:816::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1072226410/?random=1540994539180&cv=9&fst=1540994400000&num=2&label=x3P_CIql1gMQ6sCj_wM&guid=ON&eid=659255991&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&tiba=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&fmt=3&crd=CITQGw&cdct=2&is_vtc=1&random=4230595231&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 /
www.google.de/pagead/1p-user-list/1072226410/ 42 B
109 B 22ms
21ms Image
image/gif 2a00:1450:4001:821::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1072226410/?random=1540994539180&cv=9&fst=1540994400000&num=2&label=x3P_CIql1gMQ6sCj_wM&guid=ON&eid=659255991&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&tiba=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&fmt=3&crd=CITQGw&cdct=2&is_vtc=1&random=4230595231&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-30/html/ Frame 4AF5 0
0 6ms
6ms Document
text/html 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-30/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_271.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-30/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 1737
date: Fri, 12 Oct 2018 19:46:32 GMT
expires: Sat, 12 Oct 2019 19:46:32 GMT
last-modified: Fri, 12 Oct 2018 04:28:13 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 1; mode=block
cache-control: public, immutable, max-age=31536000
age: 1620947
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"

GET
H/1.1

200
OK

index.php Show response
a.dpmsrv.com/dpmpxl/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=1277909405928765554&pixelIndex=0&_=1540994539015
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1277909405928765554&pixelIndex=0&_=1540994539015&google_gid=CAESEFuYnFmjnM7mOUVNsScbFeY&google_cver=1

0
575 B

133ms
131ms

Script
text/javascript

52.205.83.39
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1277909405928765554&pixelIndex=0&_=1540994539015&google_gid=CAESEFuYnFmjnM7mOUVNsScbFeY&google_cver=1
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.83.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-205-83-39.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 0
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:19 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1277909405928765554&pixelIndex=0&_=1540994539015&google_gid=CAESEFuYnFmjnM7mOUVNsScbFeY&google_cver=1
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 368
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 204 423396.gif
idsync.rlcdn.com/ 0
34 B 397ms
117ms Image
text/plain 34.192.19.184
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/423396.gif?partner_uid=1277909405928765554
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.19.184 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-19-184.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 204
date: Wed, 31 Oct 2018 14:02:19 GMT

GET
H/1.1 200
OK UCookieSetPug Show response
image6.pubmatic.com/AdServer/ Frame F2A2 24 B
329 B 20ms
13ms Script
text/html 185.64.189.115
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=2&cb=PubMatic._uidCB
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: 1b6dfbc0392b3e04e6f10a39a7c097635148b6bc998c13ffbda40d5b3df488c8

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Cache-Control: private
Expires: Sat, 10 Nov 2018 05:32:32 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 24
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK UCookieSetPug Show response
image6.pubmatic.com/AdServer/ Frame 66CB 24 B
329 B 28ms
13ms Script
text/html 185.64.189.115
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=2&cb=PubMatic._uidCB
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: 1b6dfbc0392b3e04e6f10a39a7c097635148b6bc998c13ffbda40d5b3df488c8

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Cache-Control: private
Expires: Sat, 10 Nov 2018 05:27:29 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 24
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Cookie set showad.js
ads.pubmatic.com/AdServer/js/ Frame 098D 0
0 66ms
12ms Document
text/html 23.54.114.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.114.218 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-54-114-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Accept-Encoding: gzip, deflate
Cookie: KTPCACOOKIE=YES
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

Last-Modified: Tue, 09 Oct 2018 07:18:58 GMT
ETag: "13006c6-9ebc-577c68d245522"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
Set-Cookie: KTPCACOOKIE=YES; domain=.pubmatic.com; path=/; max-age=7776000;
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15268
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=32943
Expires: Wed, 31 Oct 2018 23:11:22 GMT
Date: Wed, 31 Oct 2018 14:02:19 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK Cookie set showad.js
ads.pubmatic.com/AdServer/js/ Frame 484B 0
0 14ms
13ms Document
text/html 23.54.114.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.114.218 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-54-114-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Accept-Encoding: gzip, deflate
Cookie: KTPCACOOKIE=YES
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

Last-Modified: Tue, 09 Oct 2018 07:18:58 GMT
ETag: "13006c6-9ebc-577c68d245522"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
Set-Cookie: KTPCACOOKIE=YES; domain=.pubmatic.com; path=/; max-age=7776000;
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15268
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=32943
Expires: Wed, 31 Oct 2018 23:11:22 GMT
Date: Wed, 31 Oct 2018 14:02:19 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK AdServerServlet Show response
sshowads.pubmatic.com/AdServer/ Frame F2A2 2 KB
2 KB 92ms
14ms Script
text/html 198.47.127.32
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://sshowads.pubmatic.com/AdServer/AdServerServlet?pubId=82040&siteId=82714&adId=241679&kadwidth=300&kadheight=250&SAVersion=2&js=1&kdntuid=1&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&inIframe=1&operId=3&sec=1&kltstamp=2018-10-31%2014%3A2%3A19&timezone=0&screenResolution=1600x1200&ranreq=0.2666012377009628&pmUniAdId=0&adVisibility=1&adPosition=418x1052&gdpr=0&dspids=%7B%7D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, 3DES_EDE_CBC
Server: 198.47.127.32 Redwood City, United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 79abe39f0669ba27457cf0ab8100fed16c645c563b90c6dadd9fd8253c84fda9

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK Cookie set showad.js
ads.pubmatic.com/AdServer/js/ Frame 2DC8 0
0 40ms
17ms Document
text/html 23.54.114.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.114.218 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-54-114-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Accept-Encoding: gzip, deflate
Cookie: KTPCACOOKIE=YES; PUBMDCID=3; pp=82040; PMDTSHR=cat:; KCCH=YES
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

Last-Modified: Tue, 09 Oct 2018 07:18:58 GMT
ETag: "13006c6-9ebc-577c68d245522"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
Set-Cookie: KTPCACOOKIE=YES; domain=.pubmatic.com; path=/; max-age=7776000;
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15268
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=32943
Expires: Wed, 31 Oct 2018 23:11:22 GMT
Date: Wed, 31 Oct 2018 14:02:19 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK Cookie set showad.js
ads.pubmatic.com/AdServer/js/ Frame D5B2 0
0 35ms
17ms Document
text/html 23.54.114.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.54.114.218 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-54-114-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Accept-Encoding: gzip, deflate
Cookie: KTPCACOOKIE=YES; PUBMDCID=3; pp=82040; PMDTSHR=cat:; KCCH=YES; pi=82040:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

Last-Modified: Tue, 09 Oct 2018 07:18:58 GMT
ETag: "13006c6-9ebc-577c68d245522"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
Set-Cookie: KTPCACOOKIE=YES; domain=.pubmatic.com; path=/; max-age=7776000;
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15268
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=32943
Expires: Wed, 31 Oct 2018 23:11:22 GMT
Date: Wed, 31 Oct 2018 14:02:19 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK AdServerServlet Show response
sshowads.pubmatic.com/AdServer/ Frame 66CB 2 KB
2 KB 55ms
17ms Script
text/html 198.47.127.32
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://sshowads.pubmatic.com/AdServer/AdServerServlet?pubId=82040&siteId=82714&adId=241752&kadwidth=728&kadheight=90&SAVersion=2&js=1&kdntuid=1&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&inIframe=1&operId=3&sec=1&kltstamp=2018-10-31%2014%3A2%3A19&timezone=0&screenResolution=1600x1200&ranreq=0.07307123699783702&pmUniAdId=0&adVisibility=1&adPosition=160x428&gdpr=0&dspids=%7B%7D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, 3DES_EDE_CBC
Server: 198.47.127.32 Redwood City, United States, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 34119f7b57e54383309d8dc5837912ede4d0b5a5eb573ca8994166a9b89d61db

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:19 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8

GET
S 200 digitrust.min.js Show response
cdn.digitru.st/prod/1/ Frame F2A2 43 KB
10 KB 330ms
0ms Script
application/javascript 159.180.84.2
Instart Logic

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.digitru.st/prod/1/digitrust.min.js
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.180.84.2 , United States, ASN33047 (INSTART - Instart Logic, Inc, US),
Reverse DNS
Software: DTOrigin /
Resource Hash: fe9735dbc1d771d3428a41c9a1341e09fec7f47293537b444378e6321d325900

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 12:47:51 GMT
content-encoding: gzip
age: 4468
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
status: 200
x-instart-cache-id: 19:9051162670417986839::1540990070
content-length: 10101
last-modified: Wed, 24 Oct 2018 22:36:15 GMT
server: DTOrigin
etag: "48c156956c1eab8e93d6f69c2c905bbf"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-instart-request-id: 13117763624885945223:SEN01-CPVNPPRY14:1540994539:0
accept-ranges: bytes
expires: Thu, 01 Nov 2018 12:47:51 GMT

GET
S 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame F2A2 24 KB
9 KB 55ms
40ms Script
text/javascript 2a00:1450:4001:816::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: sshowads.pubmatic.com
URL: https://sshowads.pubmatic.com/AdServer/AdServerServlet?pubId=82040&siteId=82714&adId=241679&kadwidth=300&kadheight=250&SAVersion=2&js=1&kdntuid=1&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&inIframe=1&operId=3&sec=1&kltstamp=2018-10-31%2014%3A2%3A19&timezone=0&screenResolution=1600x1200&ranreq=0.2666012377009628&pmUniAdId=0&adVisibility=1&adPosition=418x1052&gdpr=0&dspids=%7B%7D

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

056b0acaf76ada2d9c2cfe5e653b53d910ad38be619de01025c92c7a188fe542

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "9 / 48 of 1000 / last-modified: 1540941399"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 8934
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:19 GMT

GET
S 200 digitrust.min.js Show response
cdn.digitru.st/prod/1/ Frame 66CB 43 KB
10 KB 324ms
0ms Script
application/javascript 159.180.84.2
Instart Logic

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.digitru.st/prod/1/digitrust.min.js
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.180.84.2 , United States, ASN33047 (INSTART - Instart Logic, Inc, US),
Reverse DNS
Software: DTOrigin /
Resource Hash: fe9735dbc1d771d3428a41c9a1341e09fec7f47293537b444378e6321d325900

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 12:47:51 GMT
content-encoding: gzip
age: 4468
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
status: 200
x-instart-cache-id: 19:9051162670417986839::1540990070
content-length: 10101
last-modified: Wed, 24 Oct 2018 22:36:15 GMT
server: DTOrigin
etag: "48c156956c1eab8e93d6f69c2c905bbf"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-instart-request-id: 15526243322361285126:SEN01-CPVNPPRY14:1540994539:0
accept-ranges: bytes
expires: Thu, 01 Nov 2018 12:47:51 GMT

GET
S 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 66CB 24 KB
9 KB 71ms
33ms Script
text/javascript 2a00:1450:4001:816::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: sshowads.pubmatic.com
URL: https://sshowads.pubmatic.com/AdServer/AdServerServlet?pubId=82040&siteId=82714&adId=241752&kadwidth=728&kadheight=90&SAVersion=2&js=1&kdntuid=1&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&inIframe=1&operId=3&sec=1&kltstamp=2018-10-31%2014%3A2%3A19&timezone=0&screenResolution=1600x1200&ranreq=0.07307123699783702&pmUniAdId=0&adVisibility=1&adPosition=160x428&gdpr=0&dspids=%7B%7D

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

78025a79f047843cc81cc0ef7d374c70b9c277e13dc3bd231d77e48716fb79e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "9 / 934 of 1000 / last-modified: 1540941399"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 8940
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:19 GMT

GET
S 200 pubads_impl_270.js Show response
securepubads.g.doubleclick.net/gpt/ Frame F2A2 184 KB
63 KB 124ms
52ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js?21062715

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

516b065177d1546683627fa32c8574fd59edc3eb3bf92cef5882d53e58d7a1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Oct 2018 15:56:38 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 64036
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:19 GMT

GET
S 200 integrator.sync.js Show response
adservice.google.de/adsid/ Frame F2A2 113 B
175 B 94ms
28ms Script
application/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=searchwindowsserver.techtarget.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 108
x-xss-protection: 1; mode=block

GET
S 200 pubads_impl_271.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 66CB 185 KB
63 KB 179ms
19ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

672405b1c5eb6fd81a06485f830bc572d3e2580fe084bc4d15608f9ff746d545

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Oct 2018 21:48:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 63997
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:20 GMT

GET
S 200 integrator.sync.js Show response
adservice.google.de/adsid/ Frame 66CB 113 B
175 B 105ms
0ms Script
application/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=searchwindowsserver.techtarget.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 108
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK sp-bootstrap.js Show response
cdn.ttgtmedia.com/cmp/sourcepoint/ 7 KB
3 KB 76ms
27ms Script
text/javascript 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/cmp/sourcepoint/sp-bootstrap.js
Requested by: Host: media.techtarget.com
URL: https://media.techtarget.com/cmp/sourcepoint/sp-config.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 3fbf514b2907f4a58bcd75de7e6e3940301fdf116ae41bb25b4f2030e84a40dc

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Tue, 30 Oct 2018 17:17:09 GMT
Content-Encoding: gzip
Last-Modified: Tue, 21 Aug 2018 16:31:36 GMT
Server: PWS/8.3.1.0.8
Age: 74710
Content-Type: text/javascript
Via: 1.1 ny92:4 (W), 1.1 VMygldLON2tx53:0 (W), 1.1 PSdgflkfFRA2mu72:7 (W)
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2mu72
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2926
Expires: Tue, 06 Nov 2018 17:17:09 GMT

GET
H/1.1 200
OK sp-msg.js Show response
cdn.ttgtmedia.com/cmp/sourcepoint/ 324 KB
105 KB 36ms
17ms Script
text/javascript 163.171.132.119
QUANTIL NETWORKS INC

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ttgtmedia.com/cmp/sourcepoint/sp-msg.js
Requested by: Host: cdn.ttgtmedia.com
URL: https://cdn.ttgtmedia.com/cmp/sourcepoint/sp-bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.171.132.119 , European Union, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 1f11526358061a090ffafb8b142a921d546bd9b575f0baf9cc64582bf73221d3

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Tue, 30 Oct 2018 14:12:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Oct 2018 13:17:49 GMT
Server: PWS/8.3.1.0.8
Age: 85773
Transfer-Encoding: chunked
Content-Type: text/javascript
Via: 1.1 PSmgnyNY2er187:3 (W), 1.1 VMygldLON2ct41:2 (W), 1.1 PSdgflkfFRA2mu72:14 (W)
Cache-Control: max-age=604800
X-Px: ht PSdgflkfFRA2mu72
Connection: keep-alive
Accept-Ranges: bytes
Expires: Tue, 06 Nov 2018 14:12:47 GMT

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 66CB 9 KB
4 KB 141ms
96ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=418921487831849&correlator=4178118097092306&output=json_html&callback=googletag.impl.pubads.setPassbackAdContents&impl=s&eid=21061645%2C21062716&vrg=271&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A32776&sc=1&sfv=1-0-30&iu=%2F3618%2FPassback-sWindowsServer&sz=728x90&eri=2&cookie=ID%3D5886593baac01418%3AT%3D1540994539%3AS%3DALNI_MYalzsPyMX1rMvHJ3b7lqaABoc3fA&cdm=searchwindowsserver.techtarget.com&bc=7&lmt=1540994540&dt=1540994540219&dlt=1540994539192&idt=994&ea=0&frm=23&biw=1585&bih=1200&isw=728&ish=90&oid=3&adk=1587046222&uci=4vr4kusxoui1&ifi=1&ifk=90647604&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&top=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&dssz=11&icsg=1370&mso=2048&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1079789860.1540994539&ga_sid=1540994540&ga_hid=1340930937&fws=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

cf01e8559cc5360b7492c55bcddb5b952c655ffe45b0da0b8a3a60aef9860b4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 4415
x-xss-protection: 1; mode=block
google-lineitem-id: 145130257
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 50874501697
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 pubads_impl_rendering_271.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 66CB 59 KB
22 KB 83ms
39ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_271.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

7d8de09d093c892c317f4f678dcb56124f7d07d6d02ee7277ec43088935cdcc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Oct 2018 21:48:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 22946
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:20 GMT

GET
S 200 container.html
tpc.googlesyndication.com/safeframe/1-0-30/html/ Frame 66CB 0
0 50ms
6ms Other
text/html 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-30/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Purpose: prefetch
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires: Sat, 12 Oct 2019 19:46:34 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Fri, 12 Oct 2018 04:28:13 GMT
content-type: text/html

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame F2A2 9 KB
4 KB 192ms
0ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2005614216603694&correlator=3704662250391335&output=json_html&callback=googletag.impl.pubads.setPassbackAdContents&impl=s&eid=21061505%2C21062715%2C21062151&vrg=270&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A32776&sc=1&sfv=1-0-30&iu=%2F3618%2FPassback-sWindowsServer&sz=300x250&eri=2&cookie=ID%3D5886593baac01418%3AT%3D1540994539%3AS%3DALNI_MYalzsPyMX1rMvHJ3b7lqaABoc3fA&cdm=searchwindowsserver.techtarget.com&bc=7&lmt=1540994540&dt=1540994540493&dlt=1540994539194&idt=1122&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adk=2108599671&uci=2dsx291qixzo&ifi=1&ifk=1644036043&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&top=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&dssz=11&icsg=1370&mso=2048&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1079789860.1540994539&ga_sid=1540994541&ga_hid=1864561384&fws=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js?21062715

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

fd3a553d226645744e6ceb325f4dd204dace9a04762b4e8e7d31f9e4e8bbce1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 4403
x-xss-protection: 1; mode=block
google-lineitem-id: 145130257
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138213140192
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 pubads_impl_rendering_270.js Show response
securepubads.g.doubleclick.net/gpt/ Frame F2A2 54 KB
20 KB 161ms
0ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js?21062715

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js?21062715

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

f7739b424d4acd048d584bf1bfa99a1ea5481989d1abb8948e9bf571729f2c72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Oct 2018 15:56:38 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 20717
x-xss-protection: 1; mode=block
expires: Wed, 31 Oct 2018 14:02:20 GMT

GET
S 200 container.html
tpc.googlesyndication.com/safeframe/1-0-30/html/ Frame F2A2 0
0 127ms
0ms Other
text/html 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-30/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js?21062715
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Purpose: prefetch
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires: Sat, 12 Oct 2019 19:46:34 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Fri, 12 Oct 2018 04:28:13 GMT
content-type: text/html

GET
S 200 m_window_focus_non_hydra.js Show response
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/client/ext/ Frame 20B7 3 KB
1 KB 124ms
0ms Script
text/javascript 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/client/ext/m_window_focus_non_hydra.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

2518069e8bb56d7d922d27e89e19b714fefbf4410c83964aa09d571f6aeb4a3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 24 Oct 2018 17:13:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 1255
x-xss-protection: 1; mode=block
server: cafe
etag: 5672849149211090809
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Nov 2018 17:13:30 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 20B7 73 KB
0 12ms
11ms Script
text/javascript 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 24 Oct 2018 17:13:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 27234
x-xss-protection: 1; mode=block
server: cafe
etag: 10801174140179827322
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Nov 2018 17:13:30 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ Frame 66CB 73 KB
27 KB 261ms
0ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

cce5c991fc672328e8eb7e5f9026496acd4fa608d26d0df95c54b7f16a8e5cc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 13:22:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2396
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 27406
x-xss-protection: 1; mode=block
server: cafe
etag: 6345757217691752979
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 31 Oct 2018 14:22:25 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame 20B7 0
56 B 274ms
0ms Image
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssQmWrXjjkdqJGTckdtXxORNQqpNDTjofUdDYt12qcdt6tBHsGNXSfdrlVrGHTN4rWmVpC2UuzRXizAcMZBWsVM5AELK-wmnirKpPpgXWJQkPwYxNOc2VICcXcn9VXftLfJ2eU7cdSAnB3SI5wB49Z_Di2ycc3U7XHPhuhwXhtG4kTQteDnH1iZCR0cis_uGjYlSd-oFSLtPrI-qRDoGusEcq-8YsHcEGy2yNpKNcCt1wI_B9RsIVlO6EN6uX0g8vyK0I_sXL8zp69uMxqM2SsHnM5Wjqj-&sai=AMfl-YQDzrz2rGYT9dkyYf73G858OFIe-4oxhvrAZ8H2yMxDG-RqKFFF3V_663B_KkN7guLMfK7I0pT4rzmx24UJ_8bdrQJ0wrQTCS55R1m26Mxv1JyEww7t8y_WTwY&sig=Cg0ArKJSzF_20RkUnc1mEAE&adurl=

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:21 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 0
x-xss-protection: 1; mode=block

GET
S 200 7894350288119844199
tpc.googlesyndication.com/simgad/ Frame 20B7 49 KB
49 KB 277ms
0ms Image
image/jpeg 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7894350288119844199

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d7f8fc4caf0aa5c004f875dc202f14ca096a7b55e26029719103152fcf636bcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Tue, 02 Oct 2018 09:58:38 GMT
x-content-type-options: nosniff
age: 2520223
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 49688
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Dec 2017 19:58:10 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Oct 2019 09:58:38 GMT

GET
H/1.1 200
OK AdDisplayTrackerServlet
aktrack.pubmatic.com/AdServer/ Frame D951 0
0 235ms
10ms Document
text/html 23.59.68.247
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://aktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=82040&siteId=82714&adId=241752&adType=3&adServerId=1067&kefact=1.500000&kaxefact=1.500000&kadNetFrequecy=0&kadwidth=728&kadheight=90&kadsizeid=0&kltstamp=1540994539&indirectAdId=563330&adServerOptimizerId=1&ranreq=0.07307123699783702&kpbmtpfact=0.000000&dcId=3&tldId=0&passback=11&svr=ADS22404&ekefact=67XZW7V0CQCDfMDJLnQc2qGzVvpbqdia5TNiblOhPFr51t3o&ekaxefact=67XZW8N0CQAw0PKqLiEKCmMihNpMR6YZ0z3wr1o9qsTzfc3N&ekpbmtpfact=67XZW9B0CQCO1Vdr8NiTe3l9CRfuv9T3UJ817Zs22MNq887O&crID=0&campaignId=0&isRTB=0&imprId=2B6AC454-30EC-49F5-88E1-5572F18A9811&oid=2B6AC454-30EC-49F5-88E1-5572F18A9811&cntryId=58&domain=searchwindowsserver.techtarget.com&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&sec=1
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.68.247 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-59-68-247.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: aktrack.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Accept-Encoding: gzip, deflate
Cookie: KTPCACOOKIE=YES; PUBMDCID=3; pp=82040; PMDTSHR=cat:; KADUSERCOOKIE=625B8D09-3993-4737-B8F8-84861A2A584F; DPSync2=1542153600%3A201_197%7C1541030400%3A174; pi=82040:3; SyncRTB2=1542153600%3A92_13_81_21_8_189_161_7_194_56_64_3_54_55_22_99_46%7C1541548800%3A15_2%7C1541808000%3A63; KRTBCOOKIE_57=22767-1277909405928765554&KRTB&22776-1277909405928765554; PugT=1540994540; KRTBCOOKIE_22=14911-pcv:1|uid:8460529825882055485&KRTB&16087-pcv:1|uid:8460529825882055485&KRTB&23049-pcv:1|uid:8460529825882055485; KRTBCOOKIE_80=16514-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&22987-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&22995-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&23025-CAESEGOP49pFohTQ1Nidc-ru_pY; KRTBCOOKIE_27=16735-uid:eb8b5bd9-a89d-4500-b539-2f64fbf5e99a&KRTB&23019-uid:eb8b5bd9-a89d-4500-b539-2f64fbf5e99a; KRTBCOOKIE_18=22947-1040683377456212674; KRTBCOOKIE_336=5844-2937702737330942640; SPugT=1540994540; KRTBCOOKIE_391=22924-4142075402480152577
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

Content-Type: text/html
Content-Length: 0
Date: Wed, 31 Oct 2018 14:02:21 GMT
Connection: keep-alive

GET
DATA 200
OK truncated
/ Frame 66CB 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d491d9297955a2e5f39ec784274316d8fafdac68ad8fccf5cb024cb776c4924b

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
S 200 m_window_focus_non_hydra.js Show response
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/client/ext/ Frame 3D8F 3 KB
1 KB 41ms
1ms Script
text/javascript 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/client/ext/m_window_focus_non_hydra.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js?21062715

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

2518069e8bb56d7d922d27e89e19b714fefbf4410c83964aa09d571f6aeb4a3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 24 Oct 2018 17:13:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593331
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 1255
x-xss-protection: 1; mode=block
server: cafe
etag: 5672849149211090809
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Nov 2018 17:13:30 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 3D8F 73 KB
0 12ms
11ms Script
text/javascript 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js?21062715

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 24 Oct 2018 17:13:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 27234
x-xss-protection: 1; mode=block
server: cafe
etag: 10801174140179827322
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 07 Nov 2018 17:13:30 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ Frame F2A2 73 KB
27 KB 43ms
0ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js?21062715

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

cce5c991fc672328e8eb7e5f9026496acd4fa608d26d0df95c54b7f16a8e5cc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 13:22:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2396
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 27406
x-xss-protection: 1; mode=block
server: cafe
etag: 6345757217691752979
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 31 Oct 2018 14:22:25 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3D8F 0
56 B 59ms
11ms Image
image/gif 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuxca_dQ_eRT8Krt6Uwx7Rhm-fy4zX_tWlkJI0iQKSj32KHtORZqygYXXskir0Gn_yZZHknXlvmQzyRFWrPULB9uE0rl66pVFe5fqeTJtP8Qgo3OEH1JSXIGrlnHblSHjLcU8A2MGtkGemSdGSGItoWiV-AJgnHRi-p_uwkGwOZ6UDcyhxmYF5EkXxgw54l4Mlu7VfDK9jqRdxvyR8QXSlSx2u7ntp1vdrFwdWYBdnTWOwfd2UihltCgVRpsbj-QAyksfyxyUN-ojnpUWudJLyVAugvYSqk&sai=AMfl-YQxScjVUw2TL2hp4NkvQl97v587arIaUcF4fVvmkphRz1Y5vhTkmoxJI8QOWogbFLttYYUYt1HmLFTDxbxMcsJyhN0X-WTfUv0HgGmqnKScQ0eHNo_2DsXbtjY&sig=Cg0ArKJSzBh5e388TkH4EAE&adurl=

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Oct 2018 14:02:21 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 0
x-xss-protection: 1; mode=block

GET
S 200 14674343324885471452
tpc.googlesyndication.com/simgad/ Frame 3D8F 41 KB
42 KB 41ms
6ms Image
image/jpeg 2a00:1450:4001:816::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14674343324885471452

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0aa41ce4b755429fc615f78d776fa5e10971ab2f2c9e2bf6e9b4c37adafa226d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Tue, 02 Oct 2018 10:21:30 GMT
x-content-type-options: nosniff
age: 2518851
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42366
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Dec 2017 20:09:02 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Oct 2019 10:21:30 GMT

GET
H/1.1 200
OK AdDisplayTrackerServlet
aktrack.pubmatic.com/AdServer/ Frame 6001 0
0 68ms
8ms Document
text/html 23.59.68.247
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://aktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=82040&siteId=82714&adId=241679&adType=3&adServerId=1067&kefact=1.500000&kaxefact=1.500000&kadNetFrequecy=0&kadwidth=300&kadheight=250&kadsizeid=0&kltstamp=1540994539&indirectAdId=563328&adServerOptimizerId=1&ranreq=0.2666012377009628&kpbmtpfact=0.000000&dcId=3&tldId=0&passback=11&svr=ADS22046&ekefact=67XZWxn8CQDovvhxQ4olklMXWd1yEZ1P4ADI1LRvsuNlSf-h&ekaxefact=67XZWzv8CQCXLYCI7hdIxTs5mzGGQ5CS6ab-LBSMH3lFmq3S&ekpbmtpfact=67XZW1j8CQBJoecPdslxrKe_j1o8QYa7irwHarxtHh2izolR&crID=0&campaignId=0&isRTB=0&imprId=00F77956-F068-4063-8FFA-18A162E1DFD0&oid=00F77956-F068-4063-8FFA-18A162E1DFD0&cntryId=58&domain=searchwindowsserver.techtarget.com&pageURL=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&sec=1
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.68.247 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-59-68-247.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: aktrack.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Accept-Encoding: gzip, deflate
Cookie: KTPCACOOKIE=YES; PUBMDCID=3; pp=82040; PMDTSHR=cat:; KADUSERCOOKIE=625B8D09-3993-4737-B8F8-84861A2A584F; DPSync2=1542153600%3A201_197%7C1541030400%3A174; pi=82040:3; SyncRTB2=1542153600%3A92_13_81_21_8_189_161_7_194_56_64_3_54_55_22_99_46%7C1541548800%3A15_2%7C1541808000%3A63; KRTBCOOKIE_57=22767-1277909405928765554&KRTB&22776-1277909405928765554; KRTBCOOKIE_22=14911-pcv:1|uid:8460529825882055485&KRTB&16087-pcv:1|uid:8460529825882055485&KRTB&23049-pcv:1|uid:8460529825882055485; KRTBCOOKIE_80=16514-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&22987-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&22995-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&23025-CAESEGOP49pFohTQ1Nidc-ru_pY; KRTBCOOKIE_27=16735-uid:eb8b5bd9-a89d-4500-b539-2f64fbf5e99a&KRTB&23019-uid:eb8b5bd9-a89d-4500-b539-2f64fbf5e99a; KRTBCOOKIE_18=22947-1040683377456212674; KRTBCOOKIE_336=5844-2937702737330942640; SPugT=1540994540; KRTBCOOKIE_391=22924-4142075402480152577; KRTBCOOKIE_734=15208-uid:b98b5f2a-93f5-4a60-97a1-90029f5478ad-tuct2d33b6c; PugT=1540994541; KRTBCOOKIE_377=22918-8f24ffaf-1350-43ef-aa54-94c0db5b4445&KRTB&23031-8f24ffaf-1350-43ef-aa54-94c0db5b4445
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

Content-Type: text/html
Content-Length: 0
Date: Wed, 31 Oct 2018 14:02:21 GMT
Connection: keep-alive

GET
DATA 200
OK truncated
/ Frame F2A2 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 85fc46636a4d923c6b4412cc917697dc5bf96528fc27d5550620f2936b4b7317

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1 200
OK get_loaders Show response
consent.techtarget.com/mms/ 2 B
415 B 51ms
8ms XHR
application/json 52.29.77.169
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.techtarget.com/mms/get_loaders?href=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&account_id=370
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.77.169 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-29-77-169.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Pragma: no-cache
Origin: https://searchwindowsserver.techtarget.com
Accept-Encoding: gzip, deflate
Host: consent.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Cookie: _ga=GA1.2.1079789860.1540994539; _gid=GA1.2.166076948.1540994539; _dc_gtm_UA-18475716-9=1; _dc_gtm_UA-19047342-17=1; ad_ut=24311724436; __gads=ID=5886593baac01418:T=1540994539:S=ALNI_MYalzsPyMX1rMvHJ3b7lqaABoc3fA; bk=67f472b8-650d-4a27-b5c5-212d0ba749a6; co=%7B%22ipAddress%22%3A%22148.251.45.254%22%2C%22industry%22%3A%22UNKNOWN%22%2C%22countryId%22%3A%22UNKNOWN%22%2C%22empSize%22%3A%22UNKNOWN%22%2C%22empSizeId%22%3A%22UNKNOWN%22%2C%22name%22%3A%22UNKNOWN%22%2C%22id%22%3A%22UNKNOWN%22%2C%22state%22%3A%22UNKNOWN%22%2C%22countryName%22%3A%22UNKNOWN%22%7D; TS014200a8=012c66465960ee0765b2a5ab51bfc6d0a7df8b4905fc5a064832195af90310af196a952fde928ac9050a4125d87afa824716c2a3ba38ce3d3697b934eeca377a0ff530733e011988d06721a8bccc9825b711e10d37
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

Date: Wed, 31 Oct 2018 14:02:21 GMT
Content-Encoding: gzip
X-Sp-Mms-Node: mms-azt.node.fra.consul
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: application/json
Access-Control-Allow-Origin: https://searchwindowsserver.techtarget.com
Cache-Control: max-age=10800
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H/1.1 200
OK geo2.js Show response
cdn3.optimizely.com/js/ Frame 8F8A 294 B
701 B 61ms
12ms Script
application/javascript 2.16.123.59
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.optimizely.com/js/geo2.js?cb=1540994541617
Requested by: Host: cdn.ttgtmedia.com
URL: https://cdn.ttgtmedia.com/cmp/sourcepoint/sp-msg.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.123.59 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-123-59.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 40d3161773774e4310edeeed63150f24fd9a64eaa3882649fc26f4f722b818f0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id: Y1BKPK.c9lIaZx2uYj8JMWZye_vJfrh9
Server: AmazonS3
x-amz-request-id: CC5DBD6557DAB34D
ETag: "adadfc5d7afd13e353d9d52cec1c7827"
Content-Type: application/javascript
Cache-Control: max-age=13091
Date: Wed, 31 Oct 2018 14:02:21 GMT
Connection: keep-alive
Content-Length: 294
x-amz-id-2: AMV+W0+EDsk+pMmkFzPFB6z1GdJ79gBl9x6hnVaukj6UglW8K1Kc8s7aR31IAvQYxdYZYdwVsLk=

GET
S 200 ;ord=1540994541618
ad.doubleclick.net/ddm/ad/vntrasjmfl/qoqqq/gycxamsgym/ 43 B
121 B 22ms
21ms Image
image/gif 216.58.210.6
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/ad/vntrasjmfl/qoqqq/gycxamsgym/;ord=1540994541618?

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK get_site_data Show response
consent.techtarget.com/ 19 B
387 B 57ms
7ms XHR
text/plain 52.59.88.132
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.techtarget.com/get_site_data?account_id=370&href=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.88.132 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-59-88-132.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e29f48ad8b3dad1bb030bfe7158b7f8785d5bf34a8ea973723846c0eec94d7f1

Request headers

Pragma: no-cache
Origin: https://searchwindowsserver.techtarget.com
Accept-Encoding: gzip, deflate
Host: consent.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

Date: Wed, 31 Oct 2018 14:02:21 GMT
Content-Encoding: gzip
X-Sp-Mms-Node: mms-b2a.node.fra.consul
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Access-Control-Allow-Credentials: true
Connection: keep-alive

OPTIONS
H/1.1 200
OK log Show response
errors.client.optimizely.com/ 13 B
426 B 441ms
102ms XHR
text/plain 34.227.55.140
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.227.55.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-227-55-140.compute-1.amazonaws.com
Software: /
Resource Hash: 16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12

Request headers

Access-Control-Request-Method: POST
Origin: https://searchwindowsserver.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Wed, 31 Oct 2018 14:02:22 GMT
Allow: POST,OPTIONS
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://searchwindowsserver.techtarget.com
Access-Control-Max-Age: 1800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Content-Length: 13

GET
S 200 nr-1099.min.js Show response
js-agent.newrelic.com/ 23 KB
9 KB 6ms
6ms Script
application/javascript 151.101.2.110
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1099.min.js
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 685e511070d7d36ad071ea39c387547c95bf064727890a3e9abf1d0283184794

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:21 GMT
content-encoding: gzip
x-amz-request-id: 0F91A44CB8BB51BA
x-cache: HIT
status: 200
content-length: 9139
x-amz-id-2: 1kVBDajyPe9yNfvcIt7CQoQq0Tgjcvk5nnkBUcfzhmZSMr1SxtHUg5CkTFq+7J8h180I4bkn1Zg=
x-served-by: cache-fra19122-FRA
last-modified: Tue, 02 Oct 2018 02:58:53 GMT
server: AmazonS3
x-timer: S1540994542.880776,VS0,VE0
etag: "eed931ffe2a555a310715cf8678d32f5"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 19175

GET
H/1.1 200
OK chartbeat.js Show response
a248.e.akamai.net/chartbeat.download.akamai.com/102508/js/ 35 KB
14 KB 68ms
6ms Script
application/x-javascript 2.16.106.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://a248.e.akamai.net/chartbeat.download.akamai.com/102508/js/chartbeat.js
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.106.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-106-58.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c46f8698db452aca7eccf43baf4f36c6c3a61b6fe2918029c62e76a357e55365

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:21 GMT
Content-Encoding: gzip
Last-Modified: Thu, 04 Oct 2018 02:34:26 GMT
Server: Apache
ETag: "6331f6204f3f22afa008480b710c3f7a:1538620467"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14020

GET
S 200 collect
www.google-analytics.com/ 35 B
109 B 11ms
10ms Image
image/gif 2a00:1450:4001:816::200e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j71&aip=1&a=1455586231&t=event&ni=1&_s=1&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ul=en-us&de=UTF-8&dt=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=AdBlock&ea=false&_u=aGHAAEAj~&jid=&gjid=&cid=1079789860.1540994539&tid=UA-19047342-11&_gid=166076948.1540994539&gtm=2wgam0PWWZSH&z=105208285

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN (),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Oct 2018 19:31:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2140257
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 1068cf12f6 Show response
bam.nr-data.net/1/ 57 B
261 B 107ms
106ms Script
text/javascript 162.247.242.21
New Relic

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/1068cf12f6?a=313780&v=1099.d27c17c&to=ZQMAYxdYXUBSAkFbClxJN0UMFhkcRxRBXRdbBw4YTw%3D%3D&rst=5726&ref=https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware&ap=231&be=1350&fe=5634&dc=2668&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1540994536240,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:52,%22c%22:52,%22s%22:172,%22ce%22:539,%22rq%22:539,%22rp%22:1039,%22rpe%22:1284,%22dl%22:1041,%22di%22:2621,%22ds%22:2621,%22de%22:2670,%22dc%22:5611,%22l%22:5611,%22le%22:5639%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1099.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.21 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS: bam-9.nr-data.net
Software: /
Resource Hash: f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 57
Content-Type: text/javascript;charset=ISO-8859-1

GET
H/1.1 200
OK ping
ping.chartbeat.net/ 43 B
213 B 421ms
103ms Image
image/gif 50.16.230.124

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=techtargetnetwork.com&p=%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&u=CAXkeADnxC7KCYrRXe&d=searchwindowsserver.techtarget.com&g=41935&g0=swcpt%2C%20swcpt%20-%20Windows%20Server%20management&g1=Edward%20van%20Biljon%2C%20TUTORIAL%2C%20swcpt%20-%20TUTORIAL&n=1&f=00001&c=0&x=0&m=0&y=7848&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=5611&t=Cv_to86TWo3D4CtHyBcF7IzDp1lWn&V=109&i=Tips%20to%20track%20down%20and%20neutralize%20PowerShell%20malware&tz=0&sn=1&sv=iSgGCCeGdbpBuli5QBuw8liXjSpi&sd=1&im=061b2ff3&_
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.230.124 Ashburn, United States, ASN (),
Reverse DNS: ec2-50-16-230-124.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK Cookie set achVUpJVnVEQlE8UEZRQjxHUHpTeGxhPkBATFJLUTxGQXhucmthPj9NeEM-SVBCYU9CQ0JPT0JPeGFQQlBQRkxLPE9CQ0JPT0JPeGFQQlBQRkxLPEpCUFA-REI8QExSS1F4a2FHU3htaWtpbGt0b2FAQUB4VEZLQUxUaTxQTTxpSlBEaTxGS1FCT0s-SWlAQUBsYU... Show response
consent.techtarget.com/ 14 KB
5 KB 12ms
12ms Script
application/javascript 52.29.77.169
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.techtarget.com/achVUpJVnVEQlE8UEZRQjxHUHpTeGxhPkBATFJLUTxGQXhucmthPj9NeEM-SVBCYU9CQ0JPT0JPeGFQQlBQRkxLPE9CQ0JPT0JPeGFQQlBQRkxLPEpCUFA-REI8QExSS1F4a2FHU3htaWtpbGt0b2FAQUB4VEZLQUxUaTxQTTxpSlBEaTxGS1FCT0s-SWlAQUBsYUVPQkN4RVFRTVBgbnxgbSNgbSNQQj5PQEVURktBTFRQUEJPU0JPaVFCQEVRPk9EQlFpQExKYG0jUVJRTE9GPklgbSMxRk1QaFFMaFFPPkBIaEFMVEtoPktBaEtCUlFPPklGV0JoLUxUQk8wRUJJSWhKPklUPk9C
Requested by: Host: cdn.ttgtmedia.com
URL: https://cdn.ttgtmedia.com/cmp/sourcepoint/sp-msg.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.77.169 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-29-77-169.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a08e9a206e670f431a3159bf1ea70fcdc376ec3339dcff0fafc9917b269c5f27

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: consent.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Cookie: _ga=GA1.2.1079789860.1540994539; _gid=GA1.2.166076948.1540994539; _dc_gtm_UA-18475716-9=1; _dc_gtm_UA-19047342-17=1; ad_ut=24311724436; __gads=ID=5886593baac01418:T=1540994539:S=ALNI_MYalzsPyMX1rMvHJ3b7lqaABoc3fA; bk=67f472b8-650d-4a27-b5c5-212d0ba749a6; co=%7B%22ipAddress%22%3A%22148.251.45.254%22%2C%22industry%22%3A%22UNKNOWN%22%2C%22countryId%22%3A%22UNKNOWN%22%2C%22empSize%22%3A%22UNKNOWN%22%2C%22empSizeId%22%3A%22UNKNOWN%22%2C%22name%22%3A%22UNKNOWN%22%2C%22id%22%3A%22UNKNOWN%22%2C%22state%22%3A%22UNKNOWN%22%2C%22countryName%22%3A%22UNKNOWN%22%7D; TS014200a8=012c66465960ee0765b2a5ab51bfc6d0a7df8b4905fc5a064832195af90310af196a952fde928ac9050a4125d87afa824716c2a3ba38ce3d3697b934eeca377a0ff530733e011988d06721a8bccc9825b711e10d37
Connection: keep-alive
Cache-Control: no-cache
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 Oct 2018 14:02:22 GMT
Content-Encoding: gzip
X-Sp-Mms-Node: mms-akt.node.fra.consul
Connection: keep-alive
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
X-Sp-Mms-Env: 1
Set-Cookie: _sp_v1_uid=1:919:e850066a-c9cf-4542-9683-aafa6ec3fcf8;Path=/;Expires=Fri, 30-Nov-2018 14:02:22 GMT _sp_v1_data=2:19379:1540994542:0:1:0:1:0:0:93a55e57-f731-4194-805e-c83227fed97a:27264;Path=/;Expires=Fri, 30-Nov-2018 14:02:22 GMT _sp_v1_ss=1:H4sIAAAAAAAAAItWqo5RKimOUbKKRmbkgRgGtbE6MUqpIGZeaU4OkF0CVlBdi1tCKRYAmuD4I1IAAAA%3D;Path=/;Expires=Fri, 30-Nov-2018 14:02:22 GMT _sp_v1_opt=1:;Path=/;Expires=Fri, 30-Nov-2018 14:02:22 GMT _sp_v1_stage=1;Path=/;Expires=Thu, 01-Jan-1970 00:00:00 GMT _sp_v1_csv=2.0.1094;Path=/;Expires=Fri, 30-Nov-2018 14:02:22 GMT _sp_v1_lt=1:msg|true:;Path=/;Expires=Fri, 30-Nov-2018 14:02:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK bcn
www.summerhamster.com/ 43 B
233 B 57ms
6ms Image
image/gif 52.29.209.253

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.summerhamster.com/bcn?fe=1540994542207&y=2.0.1094&elg=590185852&flg=370&x=vhdufkzlqgrzvvhuyhu.whfkwdujhw.frp%2Fwxwruldo%2FWlsv-wr-wudfn-grzq-dqg-qhxwudolch-SrzhuVkhoo-pdozduh&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Clq%3A%3Adm%2Clqi%2Cqh%2Cvf%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Ffgq3.rswlplchob.frp%2Fmv%2Fjhr2.mv%3Ffe%3D1540994541617%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fyqwudvmpio%2Ftrttt%2Fjbfadpvjbp%2F%3Brug%3D1540994541618%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.209.253 Frankfurt, Germany, ASN (),
Reverse DNS: ec2-52-29-209-253.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 31 Oct 2018 14:02:22 GMT
Connection: keep-alive
Content-Length: 43
Access-Control-Allow-Methods: *
Content-Type: image/gif

GET
H/1.1 200
OK get_site_data Show response
consent.techtarget.com/ 19 B
387 B 8ms
7ms XHR
text/plain 52.59.88.132
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.techtarget.com/get_site_data?account_id=370&href=https%3A%2F%2Fsearchwindowsserver.techtarget.com
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.88.132 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-59-88-132.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e29f48ad8b3dad1bb030bfe7158b7f8785d5bf34a8ea973723846c0eec94d7f1

Request headers

Pragma: no-cache
Origin: https://searchwindowsserver.techtarget.com
Accept-Encoding: gzip, deflate
Host: consent.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

Date: Wed, 31 Oct 2018 14:02:22 GMT
Content-Encoding: gzip
X-Sp-Mms-Node: mms-ats.node.fra.consul
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
S 200 1098 Show response
sourcepoint.mgr.consensu.org/consent/v2/ 0
255 B 46ms
8ms XHR
text/plain 18.184.231.24

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepoint.mgr.consensu.org/consent/v2/1098
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.231.24 Cambridge, United States, ASN (),
Reverse DNS: ec2-18-184-231-24.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

date: Wed, 31 Oct 2018 14:02:22 GMT
status: 200
access-control-allow-methods: GET, PUT, POST, DELETE
access-control-allow-origin: https://searchwindowsserver.techtarget.com
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length: 0

POST
H/1.1 204
No Content log Show response
errors.client.optimizely.com/ 0
260 B 103ms
102ms XHR
text/plain 34.227.55.140
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.227.55.140 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-227-55-140.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://searchwindowsserver.techtarget.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Connection: keep-alive
Date: Wed, 31 Oct 2018 14:02:22 GMT
Content-Type: text/plain

POST
S 200 consent-all Show response
sourcepoint.mgr.consensu.org/consent/v2/1098/ 3 KB
3 KB 20ms
19ms XHR
application/json 18.184.231.24

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepoint.mgr.consensu.org/consent/v2/1098/consent-all?withSiteActions=true
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.231.24 Cambridge, United States, ASN (),
Reverse DNS: ec2-18-184-231-24.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 901eee36020072aac31ff03164fb4281236b7039f0d83b0029f0cf27df9e4a63

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 31 Oct 2018 14:02:22 GMT
status: 200
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://searchwindowsserver.techtarget.com
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length: 3063

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 20B7 42 B
113 B 41ms
40ms Image
image/gif 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssQHKEvmveijBOmNzexooXtZuGIdLL2HgHuhJn9NY7-AmGPIZ1gtEVf0QNiaSvIuKgGqfnjp3IXNuCXrOBoXrK1suxsSZ2LYiiOwlg&sig=Cg0ArKJSzLPpGMXxjoJXEAE&adk=1587046222&tt=740&bs=1585%2C1200&mtos=1073,1073,1073,1073,1073&tos=1073,0,0,0,0&p=256,429,346,1157&mcvt=1073&rs=3&ht=0&tfs=43&tls=1116&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1540994540823&rpt=628&ps=1585%2C7848&ss=1600%2C1200&pt=376&deb=1-1-1-5-10-34-7-8&tvt=1084&is=728%2C90&iframe_loc=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&r=v&id=osdim&uc=7&tgt=DIV&cl=1&cec=5&clc=1&cac=0&cd=728x90&v=r20181024

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 3D8F 42 B
113 B 49ms
49ms Image
image/gif 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsts2SkVdsGCYdoCyAKFqALvjBseRoqbkJHjw8GKdwy3xMbmigfikAJUCbP9YyyB-ApPTdzLFq8KsQjSsSX_0u1gAP-azElWxKjC71c&sig=Cg0ArKJSzMyasUUpuabWEAE&adk=2108599671&tt=744&bs=1585%2C1200&mtos=1031,1031,1031,1031,1031&tos=1031,0,0,0,0&p=514,1053,764,1353&mcvt=1031&rs=3&ht=0&tfs=33&tls=1064&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1540994541145&rpt=364&ps=1585%2C7848&ss=1600%2C1200&pt=320&deb=1-1-1-6-10-31-8-8&tvt=1035&is=300%2C250&iframe_loc=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&r=v&id=osdim&uc=7&tgt=DIV&cl=1&cec=5&clc=1&cac=0&cd=300x250&v=r20181024

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 66CB 42 B
113 B 30ms
29ms Image
image/gif 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvkkl7I62H-qi7Y489zX6P-UIoPdbzlCKTrSz9XMVshhJKiENsVh0cgFMVqCgZDOA1Zblv7Y4ZSeCwwY1-r2WZTHBZO0QByBQCCCL0&sig=Cg0ArKJSzO9SFdAdiYElEAE&adk=3370543125&tt=728&bs=1585%2C1200&mtos=1085,1085,1085,1085,1085&tos=1085,0,0,0,0&p=256,429,346,1157&mcvt=1085&rs=3&ht=0&tfs=2582&tls=3667&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1540994539235&rpt=2413&ps=1585%2C7758&ss=1600%2C1200&pt=2939&deb=1-1-4-54-23-14-55-18&tvt=3656&r=v&id=osdim&uc=9&tgt=BODY&cl=1&cec=12&clc=0&cac=0&cd=728x90&v=r20181024

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame F2A2 42 B
113 B 40ms
39ms Image
image/gif 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuwH9x0njXcq9pIZ6ziQD1vkS3vEA9cJVQzncZBz7F7LtFCdjqO-17s1IYVNTeXB0dtBihZV-PWpI7ucGpAM1KhoLP_S1FZkTYA-EM&sig=Cg0ArKJSzNy5F6u8NI1BEAE&adk=1772476611&tt=728&bs=1585%2C1200&mtos=1038,1038,1038,1038,1038&tos=1038,0,0,0,0&p=514,1053,764,1353&mcvt=1038&rs=3&ht=0&tfs=2629&tls=3667&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1540994539251&rpt=2444&ps=1585%2C7758&ss=1600%2C1200&pt=2939&deb=1-1-4-54-23-14-55-18&tvt=3656&r=v&id=osdim&uc=9&tgt=BODY&cl=1&cec=12&clc=0&cac=0&cd=300x250&v=r20181024

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:817::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Oct 2018 14:02:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 gdpr-status Show response
sourcepoint.mgr.consensu.org/consent/v2/ 42 B
331 B 58ms
3ms XHR
application/json 35.158.87.226

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepoint.mgr.consensu.org/consent/v2/gdpr-status?siteId=1098
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.87.226 Frankfurt, Germany, ASN (),
Reverse DNS: ec2-35-158-87-226.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 38152aa9ff8f1d5b6361c05def97b427a7cef0176655e3d8b105ae504b15f9fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

date: Wed, 31 Oct 2018 14:02:23 GMT
status: 200
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://searchwindowsserver.techtarget.com
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length: 42

GET
S 200 gdpr-status Show response
sourcepoint.mgr.consensu.org/consent/v2/ 42 B
331 B 55ms
2ms XHR
application/json 35.158.87.226

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepoint.mgr.consensu.org/consent/v2/gdpr-status?siteId=1098
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.87.226 Frankfurt, Germany, ASN (),
Reverse DNS: ec2-35-158-87-226.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 38152aa9ff8f1d5b6361c05def97b427a7cef0176655e3d8b105ae504b15f9fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Origin: https://searchwindowsserver.techtarget.com

Response headers

date: Wed, 31 Oct 2018 14:02:23 GMT
status: 200
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://searchwindowsserver.techtarget.com
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length: 42

GET
H/1.1 200
OK index.php Show response
a.dpmsrv.com/dpmpxl/ 5 B
1 KB 109ms
109ms Script
text/javascript 52.205.83.39
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?sw=252450465https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&q=xSeg&v=1.x&ep%5Bids%5D=2378844%2C7838491%2C7838492%2C7838563%2C7844583%2C7844585%2C7844587%2C8380284%2C2609968%2C2737652%2C2365326%2C2433138%2C1010663%2C658778%2C658786%2C652076%2C5648811%2C565952%2C10856540%2C11527225%2C1624006%2C14793258%2C12013010&cl=68&pixelIndex=0&r=770835&tzOffset=0&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&id=1277909405928765554&_=1540994539016
Requested by: Host: s.dpmsrv.com
URL: https://s.dpmsrv.com/dpm_b4c96d80854dd27e76d8cc9e21960eebda52e962.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.83.39 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-205-83-39.compute-1.amazonaws.com
Software: /
Resource Hash: fbc45fe018830de401f0cf801177a57d0039bc72d922b8ff2c82af7af05dd32b

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 31
Expires: 0

GET
S 200 fbevents.js Show response
connect.facebook.net/en_US/ 45 KB
14 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN (),

Reverse DNS

Software

Resource Hash

8896bd9aad2399ee52a9878c7ada2e49df2f66ba91afd102244018c25ffd88e2

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* wss://.facebook.com: https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 14136
x-xss-protection: 0
pragma: public
x-fb-debug: r65KuXZasT3ARBok3ENq9r14rsmLxLUsk6y4wcHDVSCf+FpSLD4xP23DLuoWuQR7ElfvMy0kleaNKlx9i+36wg==
x-frame-options: DENY
date: Wed, 31 Oct 2018 14:02:27 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
4 KB 56ms
10ms Script
application/x-javascript 2a02:26f0:f1:29c::25ea

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: searchwindowsserver.techtarget.com
URL: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:f1:29c::25ea , European Union, ASN (),
Reverse DNS
Software: /
Resource Hash: 0e61af2bfebca120ae344dc48386bbd2b6d24486524cf98ed55327b084bf1702

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 31 Oct 2018 14:02:27 GMT
Content-Encoding: gzip
Last-Modified: Mon, 06 Aug 2018 22:17:52 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=60369
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4105

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?member=827&add=2378844,7838491,7838492,7838563,7844583,7844585,7844587,8380284,2609968,2737652,2365326,2433138,1010663,658778,658786,652076,5648811,565952,10856540,11527225...
https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26add%3D2378844%2C7838491%2C7838492%2C7838563%2C7844583%2C7844585%2C7844587%2C8380284%2C2609968%2C2737652%2C2365326%2C2433138%2C1010663%2C658778%2C...

43 B
991 B

12ms
12ms

Image
image/gif

185.33.223.210

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26add%3D2378844%2C7838491%2C7838492%2C7838563%2C7844583%2C7844585%2C7844587%2C8380284%2C2609968%2C2737652%2C2365326%2C2433138%2C1010663%2C658778%2C658786%2C652076%2C5648811%2C565952%2C10856540%2C11527225%2C1624006%2C14793258%2C12013010

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.210 , European Union, ASN (),

Reverse DNS

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 Oct 2018 14:02:29 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 307.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.187:80
AN-X-Request-Uuid: f8273691-2cfa-4d05-aa7c-7e88c17815db
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 31 Oct 2018 14:02:29 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 307.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.107:80
AN-X-Request-Uuid: 43f1e671-d11c-47fb-a8b5-b105989533fd
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26add%3D2378844%2C7838491%2C7838492%2C7838563%2C7844583%2C7844585%2C7844587%2C8380284%2C2609968%2C2737652%2C2365326%2C2433138%2C1010663%2C658778%2C658786%2C652076%2C5648811%2C565952%2C10856540%2C11527225%2C1624006%2C14793258%2C12013010
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
S

200

/
px.ads.linkedin.com/collect/
Redirect Chain

https://dc.ads.linkedin.com/collect/?pid=228428&fmt=gif
https://dc.ads.linkedin.com/collect/?pid=228428&fmt=gif&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Fpid%3D228428%26fmt%3Dgif%26cookiesTest%3Dtrue%26liSync%3Dtrue
https://px.ads.linkedin.com/collect/?pid=228428&fmt=gif&cookiesTest=true&liSync=true

43 B
119 B

115ms
115ms

Image
image/gif

2a05:f500:10:101::b93f:9105

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect/?pid=228428&fmt=gif&cookiesTest=true&liSync=true
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN (),
Reverse DNS
Software: Play /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:27 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: image/gif
content-length: 58
x-li-uuid: IFCDb2C2YhXgmoMb0SoAAA==

Redirect headers

date: Wed, 31 Oct 2018 14:02:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
vary: Accept-Encoding
content-length: 20
x-li-uuid: iftMaGC2YhVga9AkbisAAA==
server: Play
pragma: no-cache
x-li-pop: prod-efr5
x-frame-options: sameorigin
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect/?pid=228428&fmt=gif&cookiesTest=true&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
S 200 477332472703193 Show response
connect.facebook.net/signals/config/ 104 KB
19 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/477332472703193?v=2.8.30&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN (),

Reverse DNS

Software

Resource Hash

60e9af84ffe578bdcc97bcbb00cf381c7af9d3e933db1ba4441ea07dcc10b227

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 19056
x-xss-protection: 0
pragma: private
x-fb-debug: pW3T3QjiLIF8hTrgLEmEKUprARRbzOXxNqqF2qWLjVadZORRzybvGt8aO/cebQnr/ZqAdIn/+ZKsnjuq/KMCmw==
x-frame-options: DENY
date: Wed, 31 Oct 2018 14:02:27 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 200 1714262845527569 Show response
connect.facebook.net/signals/config/ 104 KB
19 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1714262845527569?v=2.8.30&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN (),

Reverse DNS

Software

Resource Hash

7c574fed0744f017c20e07326f2bad9326b99e48d718d7c8ebaffaad7cb45dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 19057
x-xss-protection: 0
pragma: private
x-fb-debug: VvoCfHxJ2E8Gx+8VV86mUDmKQNyC6sILEbMwfPJFQ2FlKYxeDxTJ7Fpecdc2tuVGzPr3EgTC9FaFV0ZsDbvQFg==
x-frame-options: DENY
date: Wed, 31 Oct 2018 14:02:27 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
245 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=477332472703193&ev=PageView&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&rl=&if=false&ts=1540994547374&sw=1600&sh=1200&v=2.8.30&r=stable&ec=0&o=30&fbp=fb.1.1540994547373.657505330&it=1540994547354&coo=false
Protocol: SPDY
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN (),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Wed, 31 Oct 2018 14:02:27 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
98 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=1714262845527569&ev=PageView&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&rl=&if=false&ts=1540994547391&sw=1600&sh=1200&v=2.8.30&r=stable&ec=0&o=30&fbp=fb.1.1540994547373.657505330&it=1540994547354&coo=false
Protocol: SPDY
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN (),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Wed, 31 Oct 2018 14:02:27 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
98 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=477332472703193&ev=TechTarget-CouchbaseTargetAudience&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&rl=&if=false&ts=1540994547392&cd[custom_param]=TechTarget-CouchbaseTargetAudience&sw=1600&sh=1200&v=2.8.30&r=stable&ec=1&o=30&fbp=fb.1.1540994547373.657505330&it=1540994547354&coo=false
Protocol: SPDY
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN (),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Wed, 31 Oct 2018 14:02:27 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
98 B 7ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=1714262845527569&ev=TechTarget-CouchbaseTargetAudience&dl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&rl=&if=false&ts=1540994547392&cd[custom_param]=TechTarget-CouchbaseTargetAudience&sw=1600&sh=1200&v=2.8.30&r=stable&ec=1&o=30&fbp=fb.1.1540994547373.657505330&it=1540994547354&coo=false
Protocol: SPDY
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN (),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Wed, 31 Oct 2018 14:02:27 GMT

GET
S

200

/ Show response
px.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=http...
https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=http...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1540994547403%26pid%3D38436%26url%3Dhttps%253A%252F%252Fsearchwindowsserver.techtarget.com%252Ft...
https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=http...

0
96 B

115ms
114ms

Script
application/javascript

2a05:f500:10:101::b93f:9105

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ref=&fmt=js&s=1&cookiesTest=true&liSync=true
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN (),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 31 Oct 2018 14:02:27 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 20
x-li-uuid: lzJFb2C2YhUAKzH60CoAAA==

Redirect headers

date: Wed, 31 Oct 2018 14:02:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
vary: Accept-Encoding
content-length: 20
x-li-uuid: 54ByaGC2YhWAS52bbysAAA==
server: Play
pragma: no-cache
x-li-pop: prod-efr5
x-frame-options: sameorigin
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect/?time=1540994547403&pid=38436&url=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&pageUrl=https%3A%2F%2Fsearchwindowsserver.techtarget.com%2Ftutorial%2FTips-to-track-down-and-neutralize-PowerShell-malware&ref=&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 /
www.facebook.com/tr/ Frame 3586 0
0 7ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de

General

Check archive.org

Show headers Download Go to

Full URL: https://www.facebook.com/tr/
Requested by: Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN (),
Reverse DNS
Software: proxygen-bolt /
Resource Hash

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2157
pragma: no-cache
cache-control: no-cache
origin: https://searchwindowsserver.techtarget.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
accept-encoding: gzip, deflate
cookie: fr=0hAmp1qrlU8BLrbtU..Bb2bXz...1.0.Bb2bXz.
Origin: https://searchwindowsserver.techtarget.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

status: 200
content-type: text/plain
content-length: 0
server: proxygen-bolt
date: Wed, 31 Oct 2018 14:02:27 GMT

POST
H2 200 /
www.facebook.com/tr/ Frame 1D43 0
0 8ms
6ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de

General

Check archive.org

Show headers Download Go to

Full URL: https://www.facebook.com/tr/
Requested by: Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN (),
Reverse DNS
Software: proxygen-bolt /
Resource Hash

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2158
pragma: no-cache
cache-control: no-cache
origin: https://searchwindowsserver.techtarget.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware
accept-encoding: gzip, deflate
cookie: fr=0hAmp1qrlU8BLrbtU..Bb2bXz...1.0.Bb2bXz.
Origin: https://searchwindowsserver.techtarget.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://searchwindowsserver.techtarget.com/tutorial/Tips-to-track-down-and-neutralize-PowerShell-malware

Response headers

status: 200
content-type: text/plain
content-length: 0
server: proxygen-bolt
date: Wed, 31 Oct 2018 14:02:27 GMT

Verdicts & Comments Add Verdict or Comment

236 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

53 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.netmng.com/	1970-01-19 00:26:45	Name: dsp_id Value: mwu3zwvlzte2n
.pubmatic.com/	1970-01-18 20:46:26	Name: KRTBCOOKIE_466 Value: 16530-4e093bd2-83b3-4dc6-aa02-9e03d0622b5e&KRTB&16532-4e093bd2-83b3-4dc6-aa02-9e03d0622b5e
.pubmatic.com/	1970-01-18 22:12:50	Name: KRTBCOOKIE_218 Value: 4056-W9m17QAAAIdWOh-X&KRTB&22922-W9m17QAAAIdWOh-X&KRTB&22978-W9m17QAAAIdWOh-X
.pubmatic.com/	1970-01-18 20:46:26	Name: PugT Value: 1540994541
.pubmatic.com/	1970-01-18 22:12:50	Name: SyncRTB2 Value: 1542153600%3A92_13_81_21_8_189_161_7_194_56_64_3_54_55_22_99_46%7C1541548800%3A15_2%7C1541808000%3A63
.pubmatic.com/	1970-01-18 20:46:26	Name: KRTBCOOKIE_734 Value: 15208-uid:b98b5f2a-93f5-4a60-97a1-90029f5478ad-tuct2d33b6c
.searchwindowsserver.techtarget.com/	1970-01-18 20:04:40	Name: _gid Value: GA1.3.166076948.1540994539
.pubmatic.com/	1970-01-18 22:12:50	Name: KRTBCOOKIE_594 Value: 17105-OPTOUT
.pubmatic.com/	1970-01-18 20:46:26	Name: KRTBCOOKIE_336 Value: 5844-2937702737330942640
.pubmatic.com/	1970-01-19 00:22:26	Name: KRTBCOOKIE_188 Value: 3189-no-consent&KRTB&22716-no-consent
.pubmatic.com/	1970-01-18 22:12:50	Name: KRTBCOOKIE_18 Value: 22947-1040683377456212674
.pubmatic.com/	1970-01-18 20:46:26	Name: KRTBCOOKIE_27 Value: 16735-uid:eb8b5bd9-a89d-4500-b539-2f64fbf5e99a&KRTB&23019-uid:eb8b5bd9-a89d-4500-b539-2f64fbf5e99a
.doubleclick.net/	1970-01-19 13:34:26	Name: IDE Value: AHWqTUlySwJ9qHN4dQQHbeznasDOX0NQW1kJ6FoAff-27DTyJfi-KdTkUqb1sL9L
.pubmatic.com/	1970-01-18 20:46:26	Name: KRTBCOOKIE_22 Value: 14911-pcv:1\|uid:8460529825882055485&KRTB&16087-pcv:1\|uid:8460529825882055485&KRTB&23049-pcv:1\|uid:8460529825882055485
.techtarget.com/	1970-01-18 20:03:14	Name: _dc_gtm_UA-18475716-9 Value: 1
.techtarget.com/	1970-01-20 15:51:14	Name: ad_ut Value: 24311724436
.pubmatic.com/	1970-01-18 20:04:40	Name: pi Value: 82040:3
.pubmatic.com/	1970-01-18 20:46:26	Name: SPugT Value: 1540994542
.pubmatic.com/	1970-01-18 22:12:50	Name: pp Value: 82040
.pubmatic.com/	1970-01-18 22:12:50	Name: PUBMDCID Value: 3
.pubmatic.com/	1970-01-18 22:12:50	Name: KRTBCOOKIE_153 Value: 19420-DMcUd1uQFSoUlxIqDZ1dLAiWRH0UxkN7CpYeotRA&KRTB&22979-DMcUd1uQFSoUlxIqDZ1dLAiWRH0UxkN7CpYeotRA
.pubmatic.com/	1970-01-18 20:05:02	Name: KRTBCOOKIE_1089 Value: 22986-fcd5412c-2667-4b34-8b62-1cfa69fc9ac8&KRTB&23096-fcd5412c-2667-4b34-8b62-1cfa69fc9ac8
.googlesyndication.com/	1970-01-19 13:34:26	Name: __gads Value: ID=2755debe5b82fdb5:T=1540994540:S=ALNI_MaXrpfJOMheWuCBci-Tyv2nSnSWJA
.techtarget.com/	1970-01-19 13:34:26	Name: __gads Value: ID=5886593baac01418:T=1540994539:S=ALNI_MYalzsPyMX1rMvHJ3b7lqaABoc3fA
.pubmatic.com/	1970-01-18 20:46:26	Name: KRTBCOOKIE_391 Value: 22924-4142075402480152577
.pubmatic.com/	1970-01-18 22:12:50	Name: DPSync2 Value: 1542153600%3A201_197%7C1541030400%3A174
.techtarget.com/	1970-01-18 22:12:50	Name: bk Value: 67f472b8-650d-4a27-b5c5-212d0ba749a6
.adform.net/	1970-01-18 21:29:38	Name: uid Value: 4142075402480152577
.youtube.com/	1970-01-19 00:22:26	Name: VISITOR_INFO1_LIVE Value: YcW0ld62wvI
.pubmatic.com/	1970-01-18 20:04:40	Name: PMDTSHR Value: cat:
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: vzXhcycshzY
searchwindowsserver.techtarget.com/	1970-01-18 20:03:16	Name: _cb_svref Value: null
searchwindowsserver.techtarget.com/	1970-01-19 05:32:02	Name: _cb Value: CAXkeADnxC7KCYrRXe
.simpli.fi/	1970-01-19 04:50:16	Name: uid Value: d1HTcFvZte2Kl3Bv9P/yAg==
.searchwindowsserver.techtarget.com/	1970-01-19 13:34:26	Name: _ga Value: GA1.3.1079789860.1540994539
searchwindowsserver.techtarget.com/	1970-01-19 05:32:02	Name: _cb_ls Value: 1
.pubmatic.com/	1970-01-18 22:12:50	Name: KRTBCOOKIE_377 Value: 22918-8f24ffaf-1350-43ef-aa54-94c0db5b4445&KRTB&23031-8f24ffaf-1350-43ef-aa54-94c0db5b4445
.pubmatic.com/	1970-01-18 22:12:50	Name: KRTBCOOKIE_80 Value: 16514-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&22987-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&22995-CAESEGOP49pFohTQ1Nidc-ru_pY&KRTB&23025-CAESEGOP49pFohTQ1Nidc-ru_pY
.techtarget.com/	1970-01-18 22:12:50	Name: co Value: %7B%22ipAddress%22%3A%22148.251.45.254%22%2C%22industry%22%3A%22UNKNOWN%22%2C%22countryId%22%3A%22UNKNOWN%22%2C%22empSize%22%3A%22UNKNOWN%22%2C%22empSizeId%22%3A%22UNKNOWN%22%2C%22name%22%3A%22UNKNOWN%22%2C%22id%22%3A%22UNKNOWN%22%2C%22state%22%3A%22UNKNOWN%22%2C%22countryName%22%3A%22UNKNOWN%22%7D
searchwindowsserver.techtarget.com/	1969-12-31 23:59:59	Name: dpm_time_site Value: 2.219
.techtarget.com/	1970-01-18 20:03:14	Name: _dc_gtm_UA-19047342-17 Value: 1
.pubmatic.com/	1970-01-18 22:12:50	Name: KTPCACOOKIE Value: YES
.youtube.com/	1970-01-19 01:53:52	Name: PREF Value: f1=50000000
.techtarget.com/	1969-12-31 23:59:59	Name: TS014200a8 Value: 012c66465960ee0765b2a5ab51bfc6d0a7df8b4905fc5a064832195af90310af196a952fde928ac9050a4125d87afa824716c2a3ba38ce3d3697b934eeca377a0ff530733e011988d06721a8bccc9825b711e10d37
.pubmatic.com/	1970-01-18 20:46:26	Name: KRTBCOOKIE_1074 Value: 22956-e_a08b21c9-367b-4aae-919a-2f38ed9ae113
searchwindowsserver.techtarget.com/	1969-12-31 23:59:59	Name: dpm_url_count Value: 1
.pubmatic.com/	1970-01-18 22:12:50	Name: KADUSERCOOKIE Value: 625B8D09-3993-4737-B8F8-84861A2A584F
.pubmatic.com/	1970-01-18 22:12:50	Name: KRTBCOOKIE_57 Value: 22767-1277909405928765554&KRTB&22776-1277909405928765554
searchwindowsserver.techtarget.com/	1970-01-19 05:32:02	Name: _chartbeat2 Value: .1540994541976.1540994541976.1.iSgGCCeGdbpBuli5QBuw8liXjSpi.1
.searchwindowsserver.techtarget.com/	1970-01-18 20:03:14	Name: _gat_UA-19047342-11 Value: 1
.techtarget.com/	1970-01-18 20:04:40	Name: _gid Value: GA1.2.166076948.1540994539
.techtarget.com/	1970-01-19 13:34:26	Name: _ga Value: GA1.2.1079789860.1540994539
searchwindowsserver.techtarget.com/tutorial	1969-12-31 23:59:59	Name: hasLiveRampMatch Value: true

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn.ttgtmedia.com/rms/ux/responsive/js/responsive.min.js?v=7.20.1(Line 3) Message: UX ERROR-CHECK STARTING
console-api	log	URL: https://cdn.ttgtmedia.com/rms/ux/responsive/js/responsive.min.js?v=7.20.1(Line 93) Message: UX ERROR-CHECK COMPLETE
console-api	error	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_271.js(Line 1) Message: Exception in queued GPT command

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.dpmsrv.com
a248.e.akamai.net
ad.doubleclick.net
ads.pubmatic.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
aktrack.pubmatic.com
api.ipify.org
bam.nr-data.net
cdn.digitru.st
cdn.optimizely.com
cdn.ttgtmedia.com
cdn3.optimizely.com
cm.g.doubleclick.net
connect.facebook.net
consent.techtarget.com
dc.ads.linkedin.com
dnn506yrbagrg.cloudfront.net
errors.client.optimizely.com
go.techtarget.com
googleads.g.doubleclick.net
ib.adnxs.com
idsync.rlcdn.com
image6.pubmatic.com
js-agent.newrelic.com
media.techtarget.com
pagead2.googlesyndication.com
ping.chartbeat.net
px.ads.linkedin.com
s.dpmsrv.com
script.hotjar.com
searchwindowsserver.techtarget.com
securepubads.g.doubleclick.net
snap.licdn.com
sourcepoint.mgr.consensu.org
sp-js-releases.s3.amazonaws.com
sshowads.pubmatic.com
static.hotjar.com
stats.g.doubleclick.net
tpc.googlesyndication.com
users.techtarget.com
vars.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
www.summerhamster.com
www.youtube.com
147.75.33.193
147.75.33.209
151.101.2.110
159.180.84.2
162.247.242.21
163.171.128.148
163.171.132.119
172.217.22.98
18.184.231.24
185.33.223.210
185.64.189.115
198.47.127.32
2.16.106.58
2.16.123.59
2.19.34.83
206.19.49.139
206.19.49.153
206.19.49.186
206.19.49.191
216.58.210.2
216.58.210.6
23.54.114.218
23.59.68.247
2a00:1450:4001:815::2002
2a00:1450:4001:815::200e
2a00:1450:4001:816::2001
2a00:1450:4001:816::2002
2a00:1450:4001:816::2004
2a00:1450:4001:816::2008
2a00:1450:4001:816::200a
2a00:1450:4001:816::200e
2a00:1450:4001:817::2002
2a00:1450:4001:819::2002
2a00:1450:4001:821::2003
2a00:1450:400c:c0c::9b
2a02:26f0:f1:29c::25ea
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a05:f500:10:101::b93f:9101
2a05:f500:10:101::b93f:9105
34.192.19.184
34.227.55.140
35.158.87.226
50.16.230.124
52.205.83.39
52.216.169.107
52.222.161.56
52.222.163.163
52.29.209.253
52.29.77.169
52.59.88.132
54.243.123.39
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
056b0acaf76ada2d9c2cfe5e653b53d910ad38be619de01025c92c7a188fe542
089aca69c964aa0d24bd619f1182ff5a5f2dc40f5a5e19d738b1f00c8bee4177
0aa41ce4b755429fc615f78d776fa5e10971ab2f2c9e2bf6e9b4c37adafa226d
0d70317736ee638a11fe9ee8ab969204dfdd81f352b0de49c46fd40a52a50b9b
0ddab4a499baf8917710dd9018d2fbb3acfd1a53812f015de78002b2f625edcc
0e61af2bfebca120ae344dc48386bbd2b6d24486524cf98ed55327b084bf1702
0f0d60b9687dcc2280d1776e862f8504b1325d64552bc24ef3bb54acb5a116be
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
181124d1788d7083ab1de6fbeb87f524e1a3c9658ccdf54c4f49ab523df2253c
18d9d5b72b55a90176b54d75ca2cfe8bcb5833cf2de5c73107600ee60b7d6e6c
1b6dfbc0392b3e04e6f10a39a7c097635148b6bc998c13ffbda40d5b3df488c8
1f11526358061a090ffafb8b142a921d546bd9b575f0baf9cc64582bf73221d3
1fae3d21b09d0f4dc0726679d549722befc2a4e976d9020dce595264c94d30f7
2160a63f0c7e46c31551cfba0862153756107739bdd3b3caa0bdfd5f09fb9dc3
2518069e8bb56d7d922d27e89e19b714fefbf4410c83964aa09d571f6aeb4a3c
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
34119f7b57e54383309d8dc5837912ede4d0b5a5eb573ca8994166a9b89d61db
34530467c0e18370289206da24eaabe741e7439eb0e4142c0c3b88b1597fa1ea
35ef9ac2d40057982eda09d60724c474cd8c211a24e682d310b68cc47edd9f7d
38152aa9ff8f1d5b6361c05def97b427a7cef0176655e3d8b105ae504b15f9fe
3fbf514b2907f4a58bcd75de7e6e3940301fdf116ae41bb25b4f2030e84a40dc
40d3161773774e4310edeeed63150f24fd9a64eaa3882649fc26f4f722b818f0
47400eaeeee9e42b6ff93b70ae1cd345aef952f56bdff6350760bea146432c9e
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bc047a9a0e8f0705b3f1a52688f80ec9ec170c6554e32dbe2e5a38c823624f1
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
516b065177d1546683627fa32c8574fd59edc3eb3bf92cef5882d53e58d7a1f2
60e9af84ffe578bdcc97bcbb00cf381c7af9d3e933db1ba4441ea07dcc10b227
672405b1c5eb6fd81a06485f830bc572d3e2580fe084bc4d15608f9ff746d545
675e55c6e17480e86b0edfb65a5b62a68e3fb9ab955103b841887c52312f25d3
685e511070d7d36ad071ea39c387547c95bf064727890a3e9abf1d0283184794
68f4a6009b77ef6b5cc867f57d0095ff7db697d95821fc747e5dae6cecdf79b9
69d029e725cb27d33c3f2d9ada4c835d9625a8acf19153e865877bda03724c92
6b79a0e2ee012ec44afb4ae22c62245df15412aff1012948287d6ef71e4dbfd5
6c7f9acf1c334d5aad71fdd6b5dde4e036fa99ffb1aa9623bfef7111d7d9f45e
6d5f2cdea6c144f4f86a4ada20334424387c593ffef8a5f41e47c66b62ea6869
7137a9e07d3efe2fb7bb132a50e92dfb502699b252d08e9939c000c930bddd5b
76f089cc691e39d8cbd7d46dc4da99d4497f3a3baeeca91b846905fc9dccc360
78025a79f047843cc81cc0ef7d374c70b9c277e13dc3bd231d77e48716fb79e4
79abe39f0669ba27457cf0ab8100fed16c645c563b90c6dadd9fd8253c84fda9
7c574fed0744f017c20e07326f2bad9326b99e48d718d7c8ebaffaad7cb45dd7
7d8de09d093c892c317f4f678dcb56124f7d07d6d02ee7277ec43088935cdcc2
81604ddab14d0a30fd094b6a02f8ae65b582a874bf099399f0686f0a762cfd43
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85afbe94f7129f728ae31b28904b782d042c9d80d56e71c85ffba0972e1179bf
85fc46636a4d923c6b4412cc917697dc5bf96528fc27d5550620f2936b4b7317
8896bd9aad2399ee52a9878c7ada2e49df2f66ba91afd102244018c25ffd88e2
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde
901eee36020072aac31ff03164fb4281236b7039f0d83b0029f0cf27df9e4a63
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9465d5f89c411d83b7e7f73d1770a327062c9ee121a823d6183b1d3392352801
9805cd8364c8039be102b2a24b2095eeed846301e212b5b40b3fa2e659d80eba
9b0bf729b0c508d525b9e2252aa21a983b2345cd48968970c186be7b571944ab
9b663abb873cd420102a0e903deda94c8dcdef433bc653d1f3ab20ae98b3c168
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9f2f0533b970a29e320c0d46b4d2b50ec58d2fba41397b92a57a19a08e3b79a1
9f3667c25cb4152a914acebf2c912b17bd01ad96351e6026bb2a1ca8f5355943
9fce2c31891f9363f0ec2c81396391396112024542b327124d4516e9b800e3f2
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a08e9a206e670f431a3159bf1ea70fcdc376ec3339dcff0fafc9917b269c5f27
a423ff62dd7f4d567b09e7cded40d10ce90e0f9fd61363f67f81d5f0c68b2326
a44ef0c5f9249f261c5d298745943f5768f7d7635eab8babcbbfac24401fffc5
be7aecc1bf840fc84e51b3d2035231b0040b8c3450007bde261d529afdc6b54b
c00e21fa95cb8b66be4dd327c79b4a62e4a6cc9936664bbd4f1850128e481391
c46f8698db452aca7eccf43baf4f36c6c3a61b6fe2918029c62e76a357e55365
c7752f14cbf3f80287f4300704bf27186a052b2add79dfbb22d0903039a90743
cce5c991fc672328e8eb7e5f9026496acd4fa608d26d0df95c54b7f16a8e5cc4
cefea029ab424868d0c3ba1400e3f1ad3106300a27aeed3e2d780132bcac5575
cf01e8559cc5360b7492c55bcddb5b952c655ffe45b0da0b8a3a60aef9860b4d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0c72e35a64b5f6999eeb5611d44a9786f53fdfc98fe68b5b3d9a697f4bb31e8
d491d9297955a2e5f39ec784274316d8fafdac68ad8fccf5cb024cb776c4924b
d7f8fc4caf0aa5c004f875dc202f14ca096a7b55e26029719103152fcf636bcd
e10e88b7d198adf9eea71630d08b7ef76b1cb59f2e72dfc70b059f3e013e3f26
e29f48ad8b3dad1bb030bfe7158b7f8785d5bf34a8ea973723846c0eec94d7f1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1d67d48291fa44708beb964121a529af0c8f09a2166011d418eb77e6e679f58
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
f7739b424d4acd048d584bf1bfa99a1ea5481989d1abb8948e9bf571729f2c72
fbc45fe018830de401f0cf801177a57d0039bc72d922b8ff2c82af7af05dd32b
fd3a553d226645744e6ceb325f4dd204dace9a04762b4e8e7d31f9e4e8bbce1b
fe9735dbc1d771d3428a41c9a1341e09fec7f47293537b444378e6321d325900

searchwindowsserver.techtarget.com Open in urlscan Pro 206.19.49.153 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

143 Requests

100 %HTTPS

33 %IPv6

32 Domains

53 Subdomains

51 IPs

6 Countries

1904 kBTransfer

5923 kBSize

53 Cookies

54 Outgoing links

Redirected requests

143 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

searchwindowsserver.techtarget.com Open in urlscan Pro
206.19.49.153 Public Scan

Screenshot
Live screenshot

Full Image

143
Requests

100 %
HTTPS

33 %
IPv6

32
Domains

53
Subdomains

51
IPs

6
Countries

1904 kB
Transfer

5923 kB
Size

53
Cookies

143 HTTP transactions
2 data transactions