URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Submission: On August 31 via api from US — Scanned from DE

Summary

This website contacted 45 IPs in 5 countries across 35 domains to perform 150 HTTP transactions. The main IP is 104.198.136.223, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is redcanary.com. The Cisco Umbrella rank of the primary domain is 439602.
TLS certificate: Issued by R3 on July 24th 2023. Valid for: 3 months.
This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
23 104.198.136.223 396982 (GOOGLE-CL...)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.17.73.206 13335 (CLOUDFLAR...)
5 152.195.15.58 15133 (EDGECAST)
6 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
8 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.92.240.48 16509 (AMAZON-02)
2 23.192.243.198 16625 (AKAMAI-AS)
20 23.53.42.251 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 2600:1901:1:c... 15169 (GOOGLE)
1 146.75.116.157 54113 (FASTLY)
2 2a02:26f0:780... 20940 (AKAMAI-ASN1)
1 2a04:4e42:400... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 37.252.171.52 29990 (ASN-APPNEX)
1 2600:9000:225... 16509 (AMAZON-02)
18 2a04:4e42:8d:... 54113 (FASTLY)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 151.101.65.140 54113 (FASTLY)
1 104.244.42.69 13414 (TWITTER)
1 104.244.42.131 13414 (TWITTER)
1 2a04:4e42:8d:... 54113 (FASTLY)
3 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
2 2600:1901:0:5... 15169 (GOOGLE)
2 2a03:2880:f17... 32934 (FACEBOOK)
1 192.28.147.68 15224 (OMNITURE)
2 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 2600:9000:20e... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
8 2600:1901:1:81:: 15169 (GOOGLE)
1 54.77.97.62 16509 (AMAZON-02)
1 34.202.52.191 14618 (AMAZON-AES)
2 35.158.23.65 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
1 35.186.247.156 15169 (GOOGLE)
2 52.216.136.162 16509 (AMAZON-02)
150 45
Apex Domain
Subdomains
Transfer
24 redcanary.com
redcanary.com — Cisco Umbrella Rank: 439602
resource.redcanary.com — Cisco Umbrella Rank: 731005
2 MB
22 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5691
c.6sc.co — Cisco Umbrella Rank: 8562
ipv6.6sc.co — Cisco Umbrella Rank: 5947
b.6sc.co — Cisco Umbrella Rank: 3992
25 KB
18 spotifycdn.com
embed-cdn.spotifycdn.com — Cisco Umbrella Rank: 13792
543 KB
12 spotify.com
open.spotify.com — Cisco Umbrella Rank: 3592
apresolve.spotify.com — Cisco Umbrella Rank: 898
gew4-spclient.spotify.com — Cisco Umbrella Rank: 9281
6 KB
9 qualified.com
js.qualified.com — Cisco Umbrella Rank: 20853
app.qualified.com — Cisco Umbrella Rank: 21652
assets.qualified.com — Cisco Umbrella Rank: 22975
832 KB
7 crazyegg.com
script.crazyegg.com — Cisco Umbrella Rank: 2237
tracking.crazyegg.com — Cisco Umbrella Rank: 4119
75 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 365
www.linkedin.com — Cisco Umbrella Rank: 625
px4.ads.linkedin.com — Cisco Umbrella Rank: 6371
5 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
69 KB
4 scdn.co
i.scdn.co — Cisco Umbrella Rank: 1328
encore.scdn.co — Cisco Umbrella Rank: 6604
288 KB
4 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 6623
26 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6457
625 B
3 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3238
www.google.com — Cisco Umbrella Rank: 2
814 B
3 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 450
2 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 374
13 KB
3 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 40
stats.g.doubleclick.net — Cisco Umbrella Rank: 87
2 KB
3 amazonaws.com
s3-us-west-2.amazonaws.com
qualified-production.s3.us-east-1.amazonaws.com — Cisco Umbrella Rank: 29787
67 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9384
581 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 109
255 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 169
87 KB
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 760
6 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3330
7 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
34 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 47
189 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 368
fonts.googleapis.com — Cisco Umbrella Rank: 41
32 KB
1 sentry.io
sentry.io — Cisco Umbrella Rank: 177
324 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 881
366 B
1 bizibly.com
cdn.bizibly.com — Cisco Umbrella Rank: 12180
327 B
1 mktoresp.com
003-yru-314.mktoresp.com
318 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 742
396 B
1 t.co
t.co — Cisco Umbrella Rank: 577
378 B
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1523
637 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 20509
234 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 16560
278 B
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1344
8 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 758
15 KB
150 35
Domain Requested by
23 redcanary.com redcanary.com
18 embed-cdn.spotifycdn.com open.spotify.com
embed-cdn.spotifycdn.com
15 b.6sc.co redcanary.com
8 gew4-spclient.spotify.com embed-cdn.spotifycdn.com
7 assets.qualified.com redcanary.com
app.qualified.com
6 script.crazyegg.com redcanary.com
script.crazyegg.com
4 www.google-analytics.com www.googletagmanager.com
cdn.bizible.com
4 cdn.bizible.com redcanary.com
cdn.bizible.com
3 px.ads.linkedin.com 3 redirects
3 c.6sc.co cdn.bizible.com
3 encore.scdn.co embed-cdn.spotifycdn.com
3 www.google.de redcanary.com
3 secure.adnxs.com 2 redirects cdn.bizible.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
redcanary.com
2 qualified-production.s3.us-east-1.amazonaws.com
2 epsilon.6sense.com cdn.bizible.com
2 ipv6.6sc.co cdn.bizible.com
2 www.facebook.com redcanary.com
2 apresolve.spotify.com embed-cdn.spotifycdn.com
2 www.google.com redcanary.com
2 stats.g.doubleclick.net www.googletagmanager.com
cdn.bizible.com
2 connect.facebook.net redcanary.com
connect.facebook.net
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 open.spotify.com redcanary.com
embed-cdn.spotifycdn.com
2 j.6sc.co redcanary.com
www.googletagmanager.com
2 munchkin.marketo.net redcanary.com
munchkin.marketo.net
2 cdnjs.cloudflare.com redcanary.com
2 www.googletagmanager.com redcanary.com
1 sentry.io assets.qualified.com
1 app.qualified.com js.qualified.com
1 tracking.crazyegg.com script.crazyegg.com
1 px4.ads.linkedin.com redcanary.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io cdn.bizible.com
1 cdn.bizibly.com redcanary.com
1 003-yru-314.mktoresp.com munchkin.marketo.net
1 i.scdn.co embed-cdn.spotifycdn.com
1 analytics.twitter.com redcanary.com
1 t.co redcanary.com
1 alb.reddit.com redcanary.com
1 region1.analytics.google.com www.googletagmanager.com
1 attr.ml-api.io redcanary.com
1 s.ml-attr.com 1 redirects
1 googleads.g.doubleclick.net www.googletagmanager.com
1 www.redditstatic.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 fonts.googleapis.com redcanary.com
1 s3-us-west-2.amazonaws.com redcanary.com
1 js.qualified.com redcanary.com
1 resource.redcanary.com redcanary.com
1 ajax.googleapis.com redcanary.com
150 51
Subject Issuer Validity Valid
redcanary.com
R3
2023-07-24 -
2023-10-22
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
resource.redcanary.com
Cloudflare Inc ECC CA-3
2023-04-02 -
2024-04-01
a year crt.sh
io.bizible.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-06-01 -
2024-07-01
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-03-09 -
2024-03-08
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.s3-us-west-2.amazonaws.com
Amazon RSA 2048 M01
2023-04-11 -
2023-12-28
9 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
6sc.co
R3
2023-08-19 -
2023-11-17
3 months crt.sh
*.spotify.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-07 -
2024-03-06
a year crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-21 -
2024-07-19
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-25 -
2024-02-21
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 05
2023-07-26 -
2024-01-22
6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-06-10 -
2023-09-08
3 months crt.sh
*.spotifycdn.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
www.google.de
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1
2022-11-14 -
2023-11-14
a year crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-01 -
2023-10-01
a year crt.sh
*.scdn.co
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
www.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
crazyegg.com
Amazon RSA 2048 M02
2023-06-23 -
2024-07-22
a year crt.sh
app.qualified.com
R3
2023-07-22 -
2023-10-20
3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
*.google.de
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
sentry.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-08 -
2024-09-07
a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01
2023-07-10 -
2024-06-21
a year crt.sh

This page contains 5 frames:

Primary Page: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Frame ID: 086B5F7D58056C5C21BFC8E204937DA3
Requests: 104 HTTP requests in this frame

Frame: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Frame ID: 2D36DDCDCE47052615D52670B6722AD0
Requests: 31 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 251CC7FB76FE245FBF35791D188FC664
Requests: 1 HTTP requests in this frame

Frame: https://tracking.crazyegg.com/clock?t=1693507098577&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=e11e81b5c83128ebc3080c46d44c823040f54788&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Frame ID: 7F3BFB920DEFDA9D72ACEDFDC83EED31
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e3c73bf8-ce99-435b-80e2-a631e19bd567
Frame ID: ECB02A307B9D1C6B5E2182F0340E421A
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Windows Management Instrumentation - Red Canary Threat Report

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • /(?:([\d.])+/)?highlight(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

150
Requests

97 %
HTTPS

59 %
IPv6

35
Domains

51
Subdomains

45
IPs

5
Countries

3905 kB
Transfer

13958 kB
Size

46
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=redcanary.com&pId=8154658031317354889
Request Chain 88
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693507098457%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthreat-detection-report%252Ftechniques%252Fwindows-management-instrumentation%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLPkcheO3igoAAAAYpM45mc3jU4xFOqxM8eEQkDcjf2AKWa7lgMRR2jOrdGfWek0755k2iWaYiLWWwR6CgSqvck_jhFDQ

150 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
359 KB
64 KB
Document
General
Full URL
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
8ea04aff1e26b3002a0e8f9a752c39d12eba28cb176ef120639cbcda0e8181f1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=600, must-revalidate
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 31 Aug 2023 18:38:16 GMT
feature-policy
microphone 'none'; geolocation 'none'
link
<https://redcanary.com/?p=33541>; rel=shortlink
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding
x-cache
HIT: 19
x-cache-group
normal
x-cacheable
SHORT
x-content-type-options
nosniff
x-frame-options
deny
x-permitted-cross-domain-policies
master-only
x-powered-by
WP Engine
x-wpe-request-id
b798eb9014ae3f578e3daebc5f93d48f
x-xss-protection
1; mode=block
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.1/
88 KB
31 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Sun, 27 Aug 2023 09:30:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
378473
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31100
x-xss-protection
0
last-modified
Thu, 08 Sep 2022 18:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Aug 2024 09:30:23 GMT
forms2.min.js
resource.redcanary.com/js/forms2/js/
208 KB
70 KB
Script
General
Full URL
https://resource.redcanary.com/js/forms2/js/forms2.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
152
etag
"2ec03d3-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7ff763ba7f072c46-FRA
expires
Thu, 31 Aug 2023 22:38:16 GMT
bizible.js
cdn.bizible.com/scripts/
67 KB
25 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6BA7) /
Resource Hash
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
gzip
last-modified
Wed, 30 Aug 2023 15:35:31 GMT
server
ECS (amb/6BA7)
age
61773
etag
"b215169c57dbd91:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
25480
9416.js
script.crazyegg.com/pages/scripts/0096/
6 KB
2 KB
Script
General
Full URL
https://script.crazyegg.com/pages/scripts/0096/9416.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
gzip
cf-cache-status
HIT
age
604
cf-polished
origSize=6004
ce-version
11.5.121
cf-bgj
minify
last-modified
Thu, 31 Aug 2023 18:28:12 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
7ff763baee89bbaa-FRA
js
www.googletagmanager.com/gtag/
301 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
61138641513730f618f72fbadc63ea68084a8fc7dcc423982402d26bba8470e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
96158
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 31 Aug 2023 18:38:16 GMT
qualified.js
js.qualified.com/
329 KB
95 KB
Script
General
Full URL
https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
via
1.1 spaces-router (devel)
strict-transport-security
max-age=63072000; includeSubDomains
cf-cache-status
MISS
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
7b474271-cd32-ada0-caba-3061d012471b
pragma
no-cache
x-runtime
0.021612
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"d3cffae0a07184a7f41e99ed86654a87"
x-download-options
noopen
vary
Accept,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7ff763bb2b96699b-FRA
expires
Thu, 31 Aug 2023 22:38:17 GMT
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/
130 KB
33 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
24882858
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
33250
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-20801"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YuzmzDG6Xlz%2BjzSGlKXaQWWUO5xnrFAeEQfJ0XtEIN4aFyU2pJ%2FKLorWlYjeTo6CZCk9LnoFos%2Bp4eX4y4V2ZsmIYUE3lpkmaurWNrDasD1qnxCwAg8ut0rj0W4cjDpx3tdU%2BvX3Wkuc9nVVFRvoK%2B1W"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff763ba8a1f9171-FRA
expires
Tue, 20 Aug 2024 18:38:16 GMT
teknkl-formsplus-1.0.5.js
s3-us-west-2.amazonaws.com/s.cdpn.io/250687/
41 KB
41 KB
Script
General
Full URL
https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.92.240.48 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:38:18 GMT
x-amz-version-id
OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO
Last-Modified
Thu, 26 Apr 2018 08:20:46 GMT
Server
AmazonS3
x-amz-request-id
MZEHZZEM39V03AFY
ETag
"bab0c2b3523f8244564b675fe34db610"
Content-Type
application/x-js
Cache-Control
public
Accept-Ranges
bytes
Content-Length
41617
x-amz-id-2
kBbJiDmMGx71+bLV9yA6rcDmNISzVWp0AnLXEKb+BvcXFpF0TxYQeRVzxeChlwVrCscWBt3k+es=
autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
redcanary.com/wp-content/cache/autoptimize/js/
288 KB
82 KB
Script
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:29 GMT
server
nginx
etag
W/"64dce75d-48160"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
5cc2bcd00543bf56b4dc86786dbb44b8
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-192-243-198.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:38:16 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
gtm.js
www.googletagmanager.com/
287 KB
95 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
cdccac3e5c1db56da01a50038dfe18fd5891463ba561ed0684c98693447052c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
97098
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:38:16 GMT
6si.min.js
j.6sc.co/
51 KB
15 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Aug 2023 22:29:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64e7d9dd-cc38"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14993
expires
Thu, 31 Aug 2023 18:38:17 GMT
css
fonts.googleapis.com/
7 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/ro
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:38:16 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 31 Aug 2023 18:38:16 GMT
autoptimize_7c1b044830350562b8347035fb5ab725.css
redcanary.com/wp-content/cache/autoptimize/css/
5 MB
253 KB
Stylesheet
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:30 GMT
server
nginx
etag
W/"64dce75e-53c907"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
b4cee3d823172361c3dd82353892168e
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/
763 B
614 B
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
14198669
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
271
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-2fb"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=80CT%2BWx%2Bi0Pf%2FAhFtUSbOiv4oAEzRxd%2FUmrFszzf3D82u5SWCXPjZKh7a%2BZ5S6CB9GSDfMj9q7JhwBx%2FPkbI3jWEH%2B8ELQ0gOEjECyaTBwmICoUjTaX0SgKkRyaKFfk%2Ftu49xYkVNuaMe%2FJKc0iB1jES"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff763bb2b4d9171-FRA
expires
Tue, 20 Aug 2024 18:38:16 GMT
truncated
/
64 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
65 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
bullet-square.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
443 B
655 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 23 Aug 2021 16:46:07 GMT
server
nginx
etag
W/"6123d0cf-1bb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
8b79170ddc333651895ca8745355e783
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
source-sans-pro-v21-latin-regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:25 GMT
server
nginx
etag
"6298f2c1-32ec"
vary
Accept-Encoding
x-wpe-request-id
d0b5719d2f2ba0985f2c182c132ffe04
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13036
source-sans-pro-v21-latin-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:22 GMT
server
nginx
etag
"6298f2be-329c"
vary
Accept-Encoding
x-wpe-request-id
cc9d1946b97d47e5d6c5aae3adc9a963
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12956
source-sans-pro-v21-latin-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:24 GMT
server
nginx
etag
"6298f2c0-327c"
vary
Accept-Encoding
x-wpe-request-id
c370b8ef68aec76719f99441bd7e820c
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12924
source-sans-pro-v21-latin-600.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:23 GMT
server
nginx
etag
"6298f2bf-32fc"
vary
Accept-Encoding
x-wpe-request-id
3150c1594b15bd0c95561ee077a58a59
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13052
56z2qI0gKcPthQF6l8AW3E
open.spotify.com/embed/track/ Frame 2D36
11 KB
5 KB
Document
General
Full URL
https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy / Next.js
Resource Hash
aade2be3a7a6dd383ea77837f2bc319debf8a111f189dd250daca43acb6ed315
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 31 Aug 2023 18:38:16 GMT
etag
"78f7xgxqng8m3"
server
envoy
sp-trace-id
53b5e3b28c1d0f0e
strict-transport-security
max-age=31536000
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
x-content-type-options
nosniff
x-powered-by
Next.js
truncated
/
68 B
68 B
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/site/
5 KB
2 KB
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca6fea2d10a11e9afc9d4d36b5ae2a7433ba6724ef4a7f4db2a034927e158b8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
gzip
cf-cache-status
HIT
age
10980
ce-version
11.5.121
content-length
1538
last-modified
Thu, 31 Aug 2023 15:35:16 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff763bbdb34047e-FRA
munchkin.js
munchkin.marketo.net/163/
11 KB
6 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-192-243-198.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:38:17 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sat, 09 Dec 2023 18:38:17 GMT
b2625509b46b716ab8df67870a7d87b8.js
script.crazyegg.com/pages/versioned/common-scripts/
91 KB
31 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:16 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 24 Aug 2023 15:03:06 GMT
server
cloudflare
age
19306
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff763bc18b8bbaa-FRA
content-length
31312
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230036-FRA
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
1 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a418 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
x-content-type-options
nosniff
last-modified
Wed, 30 Aug 2023 18:41:20 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
content-type
application/javascript;charset=utf-8
cache-control
max-age=77807
accept-ranges
bytes
content-length
1046
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Jun 2023 20:49:59 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7409
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1693507097005&cv=11&fst=1693507097005&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&hn=www.googleadservices.com&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&auid=1731372302.1693507097&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
71f31fa8a52e87e9ccf84a05db65619c18733021e334fa84c4aa88def6c4dc11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1355
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bat.js
bat.bing.com/
42 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Thu, 31 Aug 2023 18:38:16 GMT
last-modified
Fri, 28 Jul 2023 18:19:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 5DAC6153A5B14B88BEA059FC2E309F18 Ref B: FRAEDGE1709 Ref C: 2023-08-31T18:38:17Z
etag
"806f3b1280c1d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12469
fbevents.js
connect.facebook.net/en_US/
193 KB
52 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:38:17 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
52127
x-xss-protection
0
pragma
public
x-fb-debug
Wn3ouPM5QOW1pnZaSsJRgZZVZPEzEQU3AyxYlcvjo54JYBwqMpwmun2b0cgPM37Hxwvm0Cw+3VM4b8i67Atb3A==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=redcanary.com&pId=8154658031317354889
0
234 B
Image
General
Full URL
https://attr.ml-api.io/?domain=redcanary.com&pId=8154658031317354889
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
2600:9000:2251:6800:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
via
1.1 dc0aad619823d3400ef947433d0af8fa.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-type
application/json
x-amz-cf-id
lpnS33glP8z1zujTI-tr4kdiHZDHvm0x2ExbCnNkZ1I1WUIkgJk5vA==
content-length
0
apigw-requestid
KiekNi_aIAMEVFA=

Redirect headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
an-x-request-uuid
330da8d1-edea-461f-a9c8-7805b473f0d5
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://attr.ml-api.io/?domain=redcanary.com&pId=8154658031317354889
x-proxy-origin
45.141.152.76; 45.141.152.76; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
8cd00e627952ec8a.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 2D36
26 KB
4 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
4433959
x-amz-meta-goog-reserved-file-mtime
1689072066
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
4039
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230119-FRA
last-modified
Tue, 11 Jul 2023 10:56:36 GMT
etag
"f3d572702831405545a59c2b3c1f6f80"
x-goog-generation
1689072996772325
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
26326
accept-ranges
bytes
x-cache-hits
6, 141828
c47c6e7745a8b455.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 2D36
34 KB
6 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
108699
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5946
x-served-by
cache-chi-kigq8000053-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"fcbec68c9d848190b4c167a8202f2ffd"
x-goog-generation
1693398318469994
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
35014
x-amz-checksum-crc32c
v/JnmQ==
accept-ranges
bytes
x-cache-hits
2, 4381
webpack-3e4f342dbb144246.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
108699
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
2186
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"afb8c163c2105c690dae52a64acf740d"
x-goog-generation
1693398318516219
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
4611
x-amz-checksum-crc32c
lAXGCg==
accept-ranges
bytes
x-cache-hits
5, 16352
framework-33d379e787c03ddb.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
127 KB
41 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/framework-33d379e787c03ddb.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
8685239
x-amz-meta-goog-reserved-file-mtime
1684765243
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
42161
x-served-by
cache-chi-kigq8000070-CHI, cache-fra-eddf8230119-FRA
last-modified
Mon, 22 May 2023 14:27:39 GMT
etag
"124a9f12f15f3120a5ef711a66ba2662"
x-goog-generation
1684765659849262
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
129927
accept-ranges
bytes
x-cache-hits
739, 148122
main-0117c27f823659ce.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
111 KB
33 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/main-0117c27f823659ce.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
7185454
x-amz-meta-goog-reserved-file-mtime
1686222071
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
33612
x-served-by
cache-chi-kigq8000158-CHI, cache-fra-eddf8230119-FRA
last-modified
Thu, 08 Jun 2023 11:07:26 GMT
etag
"81865ede7cdb1740008282943c7855ac"
x-goog-generation
1686222445991402
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
113515
accept-ranges
bytes
x-cache-hits
617, 147174
_app-fe44d090509824d5.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/ Frame 2D36
507 KB
138 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
108699
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
140746
x-served-by
cache-chi-kigq8000132-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"5686bcaf61d1e15b5f94a8ec151d3215"
x-goog-generation
1693398318953757
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
518987
x-amz-checksum-crc32c
ZWKppg==
accept-ranges
bytes
x-cache-hits
2, 44
fec483df-b230338ad030162e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
320 KB
99 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/fec483df-b230338ad030162e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
6778629
x-amz-meta-goog-reserved-file-mtime
1686661750
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
100913
x-served-by
cache-chi-klot8100047-CHI, cache-fra-eddf8230119-FRA
last-modified
Tue, 13 Jun 2023 13:18:59 GMT
etag
"9c4d5b20d500a4646af02cb2e28e11da"
x-goog-generation
1686662339475826
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
327829
accept-ranges
bytes
x-cache-hits
462, 149009
415-d009a9159d740903.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
25 KB
6 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/415-d009a9159d740903.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
2541319
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5881
x-served-by
cache-chi-kigq8000020-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f45ad0e97a8e71419371027175275215"
x-goog-generation
1690965617730993
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25338
x-amz-checksum-crc32c
I6sMew==
accept-ranges
bytes
x-cache-hits
7, 140027
122-f7d6a526163e333e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
262 KB
72 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/122-f7d6a526163e333e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
125878
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
73305
x-served-by
cache-chi-kigq8000095-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"09569bb140037810c364b24b4e3dbfb2"
x-goog-generation
1693381086734856
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
267882
x-amz-checksum-crc32c
vgEZdw==
accept-ranges
bytes
x-cache-hits
64, 18784
345-dd05f38d7ac8a99d.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
96 KB
25 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/345-dd05f38d7ac8a99d.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
125878
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
25529
x-served-by
cache-chi-kigq8000078-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"2ae89e701fdd03960a8a00c1f5dcfa88"
x-goog-generation
1693381086719715
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
98413
x-amz-checksum-crc32c
+DCSmw==
accept-ranges
bytes
x-cache-hits
63, 18634
%5Bid%5D-025dca3822d6ecec.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/ Frame 2D36
31 KB
8 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/%5Bid%5D-025dca3822d6ecec.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
125877
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
8521
x-served-by
cache-chi-kigq8000160-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"ac10207c64f660116f59fdf475284935"
x-goog-generation
1693381086898125
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
31582
x-amz-checksum-crc32c
q2CFuQ==
accept-ranges
bytes
x-cache-hits
54, 4802
_buildManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 2D36
2 KB
1004 B
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_buildManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
108700
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
821
x-served-by
cache-chi-klot8100127-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"e4f2f5f28d975e18a45aa130cfa30f72"
x-goog-generation
1693398318168737
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
2163
x-amz-checksum-crc32c
8Pix6g==
accept-ranges
bytes
x-cache-hits
5, 16329
_ssgManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 2D36
77 B
260 B
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_ssgManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
108700
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
61
x-served-by
cache-chi-klot8100033-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"b6652df95db52feb4daf4eca35380933"
x-goog-generation
1693398318123960
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
77
x-amz-checksum-crc32c
Ypo4GQ==
accept-ranges
bytes
x-cache-hits
1, 16333
collect
region1.analytics.google.com/g/
0
252 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je38u0&_p=139667631&_gaz=1&cid=953353146.1693507097&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1693507097&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
252 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=953353146.1693507097&gtm=45je38u0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3K4MTNQJN&cid=953353146.1693507097&gtm=45je38u0&aip=1&z=1097280227
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1693507097132&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=ef180d3c-4f58-4f6f-8bda-7ef0770c064e&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
adsct
t.co/i/
43 B
378 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=03ca72e3-e937-41ba-9493-67b5e14a1bd1&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7179a722-96b6-42be-9235-bbdf9743fd0d&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
96
date
Thu, 31 Aug 2023 18:38:17 GMT
strict-transport-security
max-age=0
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
79e2e682dfcef4f4
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
c457c7e7222b4610707569f8e148b19e37ce3e01f8659d6f4f785a2c7a7b6e99
content-length
43
adsct
analytics.twitter.com/i/
43 B
396 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=03ca72e3-e937-41ba-9493-67b5e14a1bd1&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7179a722-96b6-42be-9235-bbdf9743fd0d&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
173
date
Thu, 31 Aug 2023 18:38:16 GMT
strict-transport-security
max-age=631138519
server
tsa_f
content-type
image/gif;charset=utf-8
x-transaction-id
5e61f11a0870d894
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
18a3e68816ea5337e757d732dd365f8c7ae62e9336c382857ddada6b0a89dd0a
content-length
43
1042590016249604
connect.facebook.net/signals/config/
137 KB
35 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1042590016249604?v=2.9.125&r=stable&domain=redcanary.com
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:38:17 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
35944
x-xss-protection
0
pragma
public
x-fb-debug
koUV37q1ZMGe56W6+2/pSEGfCWEUIwezJFwGNFmM1BV6a1dK1LFTIDNaO4EP/9IaIg9XxutkOfMwCGAh/0ZjlA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
ab67616d00001e02ebcc9144c41ae7d42efe6d94
i.scdn.co/image/ Frame 2D36
31 KB
32 KB
Image
General
Full URL
https://i.scdn.co/image/ab67616d00001e02ebcc9144c41ae7d42efe6d94
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:8d::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://embed-cdn.spotifycdn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:38:17 GMT
Age
726851
X-Cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
Connection
keep-alive
Content-Length
31979
X-Served-By
cache-chi-kigq8000117-CHI, cache-fra-eddf8230030-FRA
Last-Modified
Wed, 04 Sep 2019 11:41:29 GMT
ETag
"7684273fe7fc515e237eab3b4c5eef9d"
x-goog-generation
1567597289264217
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
x-goog-stored-content-length
31979
x-amz-checksum-crc32c
1a4KSA==
Accept-Ranges
bytes
Timing-Allow-Origin
*
X-Cache-Hits
11653, 2
CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
encore.scdn.co/fonts/ Frame 2D36
85 KB
86 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:6::17d8:4d9b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
87344
last-modified
Thu, 19 May 2022 07:59:23 GMT
etag
"db1a27b35e26398fef4be920ea96078d"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
r/+ZKQ==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:38:17 GMT
CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
encore.scdn.co/fonts/ Frame 2D36
82 KB
82 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:6::17d8:4d9b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
84027
last-modified
Fri, 13 May 2022 11:38:51 GMT
etag
"f7b12903dd7a2d536ceb2b7cd1dba2c1"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
rmKVPg==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:38:17 GMT
56383426.js
bat.bing.com/p/action/
0
116 B
Script
General
Full URL
https://bat.bing.com/p/action/56383426.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Thu, 31 Aug 2023 18:38:17 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 872574FCC57F423BA3782C98A2C4A960 Ref B: FRAEDGE1709 Ref C: 2023-08-31T18:38:17Z
x-cache
CONFIG_NOCACHE
/
www.google.com/pagead/1p-user-list/759876114/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/759876114/?random=1693507097005&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=2514151977&rmt_tld=0&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/759876114/
42 B
154 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/759876114/?random=1693507097005&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=2514151977&rmt_tld=1&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
monitoring
open.spotify.com/embed/ Frame 2D36
2 B
412 B
Fetch
General
Full URL
https://open.spotify.com/embed/monitoring?o=22381&p=4505164808585216
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

sp-trace-id
0d291b522be187c5
date
Thu, 31 Aug 2023 18:38:17 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
via
1.1 google, HTTP/2 edgeproxy, 1.1 google
server
envoy
vary
origin,access-control-request-method,access-control-request-headers, Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
/
apresolve.spotify.com/ Frame 2D36
273 B
270 B
XHR
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
d3227cea6e9e178f163dabbb176e4e7a9a07cda1d14a838d33373300af19f59c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
110
CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
encore.scdn.co/fonts/ Frame 2D36
87 KB
88 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:6::17d8:4d9b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
89529
last-modified
Fri, 13 May 2022 11:38:50 GMT
etag
"216b12b5a9657850b1b324e158454f8e"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
3OfNxA==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:38:17 GMT
insight.old.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a418 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Aug 2023 12:14:15 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=37768
accept-ranges
bytes
content-length
4862
662.dc13e1cf69424def.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
56 KB
12 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
2541319
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
12292
x-served-by
cache-chi-kigq8000034-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f63aef00c0a6fb21f8372a038ee41c3a"
x-goog-generation
1690965617313097
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
57497
x-amz-checksum-crc32c
yfdB0g==
accept-ranges
bytes
x-cache-hits
8, 133712
90.e174c663531d2840.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/90.e174c663531d2840.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
age
2541320
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
1750
x-served-by
cache-chi-klot8100099-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"9a75e6801ccd6da13a45572ceefe7d6b"
x-goog-generation
1690965617342176
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
5117
x-amz-checksum-crc32c
467rEw==
accept-ranges
bytes
x-cache-hits
8, 129892
/
apresolve.spotify.com/ Frame 2D36
273 B
169 B
Fetch
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
61630180d99e12a103d2d8d93423d0ec0a280ce92c80c4436515905dcf3d8b52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&rl=&if=false&ts=1693507097682&sw=1600&sh=1200&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1693507097680.281643025&it=1693507097172&coo=false&rqm=GET
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Thu, 31 Aug 2023 18:38:17 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
visitWebPage
003-yru-314.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1693507097690&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1693507097689-74021&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:38:18 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
a7f8f0e8-c457-4a50-beb3-998045c59eed
tdr-sidenav-grain.png
redcanary.com/wp-content/themes/redcanary/assets/img/
84 KB
84 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-sidenav-grain.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
"64187eac-14f3f"
vary
Accept-Encoding
x-wpe-request-id
5b0b9affed1215c8101a2a4a3a9573db
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
85823
tdr-search-icon.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
773 B
764 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-search-icon.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
W/"64187eac-305"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
62e4dc4ad762b995c6d2a83701edb916
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-canaries.png
redcanary.com/wp-content/themes/redcanary/assets/img/
10 KB
10 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-canaries.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-27ad"
vary
Accept-Encoding
x-wpe-request-id
85464e958e0021518747366acfb32ffd
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
10157
topic-hero.jpg
redcanary.com/wp-content/themes/redcanary/assets/img/
244 KB
245 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/topic-hero.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:15 GMT
server
nginx
etag
"5c76b1f3-3d141"
vary
Accept-Encoding
x-wpe-request-id
f410b3df2633591ab40192460d77f468
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
250177
graphic-soundwave.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
3 KB
836 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/graphic-soundwave.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:29 GMT
server
nginx
etag
W/"64187ea9-abb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
0f4ad1ad48acd73a51cf592fdbecf260
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
icon-spotify.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
2 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/icon-spotify.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:30 GMT
server
nginx
etag
W/"64187eaa-653"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
8fee42c5bc1522f5c7d423d029ebb28e
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-dots.png
redcanary.com/wp-content/themes/redcanary/assets/img/
11 KB
11 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-dots.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-2b89"
vary
Accept-Encoding
x-wpe-request-id
c60f9440c5fbaa2097a19f7595380de7
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
11145
TDR-Header03-1200w.jpeg
redcanary.com/wp-content/themes/redcanary/assets/img/
331 KB
332 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/TDR-Header03-1200w.jpeg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 18:01:24 GMT
server
nginx
etag
"6419f0f4-52bf0"
vary
Accept-Encoding
x-wpe-request-id
2177673383ead5d0889c4e5020d95f7b
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
338928
search-btn.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
161 B
473 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:17 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 08 Sep 2021 23:08:04 GMT
server
nginx
etag
W/"61394254-a1"
vary
Accept-Encoding, Accept-Encoding
x-wpe-request-id
f81a6051cbe49f9eb1a7b0a3026b51fb
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
ab1e4d70-4fad-4329-ae83-62c59167c1ca
https://open.spotify.com/ Frame 2D36
46 KB
0
Other
General
Full URL
blob:https://open.spotify.com/ab1e4d70-4fad-4329-ae83-62c59167c1ca
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
46922
Content-Type
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/sampling/
158 B
256 B
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=470418
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-encoding
gzip
cf-cache-status
HIT
age
10980
ce-version
11.5.121
content-length
145
last-modified
Thu, 31 Aug 2023 15:35:18 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff763c2cd93047e-FRA
ipv
cdn.bizible.com/m/
43 B
203 B
Image
General
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=9b6d5e11926d49b4830f9ee9a38966f5&_biz_s=834ede&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693507096810&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=0&a=redcanary.com&rnd=29002&cdn_o=a&_biz_z=1693507098045
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B75) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:18 GMT
last-modified
Wed, 30 Aug 2023 18:20:37 GMT
server
ECS (amb/6B75)
age
87461
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
u
cdn.bizibly.com/
43 B
327 B
Image
General
Full URL
https://cdn.bizibly.com/u?_biz_u=9b6d5e11926d49b4830f9ee9a38966f5&_biz_s=834ede&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693507098050&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&a=redcanary.com&rnd=588161&cdn_o=a&_biz_z=1693507098050
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B97) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:18 GMT
last-modified
Sun, 27 Aug 2023 01:23:05 GMT
server
ECS (amb/6B97)
age
407713
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
0
bat.bing.com/action/
0
286 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=cbdfbbbb-f358-4957-8bee-0bc5e0f7d150&sid=8da6ad30482d11eeaa2d2f4220bcee9c&vid=8da6e0c0482d11eeb1e4b3284b303fbb&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&r=&lt=2238&evt=pageLoad&sv=1&rn=827328
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:38:17 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: AACD8E38D6AC456C9820ED5246DE6D44 Ref B: FRAEDGE1709 Ref C: 2023-08-31T18:38:18Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
c.6sc.co/
7 B
191 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
36 B
336 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:22::1726:62ed Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
0c5fa42a718dbb5295dc7d57d7a1404accc306abefb2b83420fd029ceb5fafe8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:18 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:ac8:20:3a00:1012:7623:a423:a93c
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693507098309_389993773_253868789_22_989_27_141_219";dur=1
content-length
36
expires
Thu, 31 Aug 2023 18:38:18 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
j.6sc.co/j/
4 KB
2 KB
Script
General
Full URL
https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id
a5rebSMZ.Kk9yiZR85vsDTngv6hjCogp
content-encoding
gzip
date
Thu, 31 Aug 2023 18:38:18 GMT
x-amz-cf-pop
TPA52-P2
x-amz-server-side-encryption
AES256
x-amz-meta-content-type
application/json
content-length
1176
pragma
no-cache
last-modified
Mon, 22 May 2023 19:07:21 GMT
server
AmazonS3
etag
"9fdd9f5f306ab8eec57207f0e3c1a4e7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
x-amz-cf-id
cWunvl1Zn3A08elSvDJCakr1Jnr2oFhl6rW8JDVElLRAlauNKyJm8A==
expires
Thu, 31 Aug 2023 18:38:18 GMT
token
cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/
36 B
366 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:8e00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:20:24 GMT
content-encoding
gzip
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
1074
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
0GZULEJ_7cnBImZZbdy7KPqc1eHT9D0vIAE9zV7-3TbNHbOH8iHq0g==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693507098457%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthre...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookies...
0
264 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLPkcheO3igoAAAAYpM45mc3jU4xFOqxM8eEQkDcjf2AKWa7lgMRR2jOrdGfWek0755k2iWaYiLWWwR6CgSqvck_jhFDQ
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 7FC827AD9F3744F5837E1DAB800C6C00 Ref B: FRAEDGE1307 Ref C: 2023-08-31T18:38:19Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPFkSoU/F9Yreic0GUA==

Redirect headers

date
Thu, 31 Aug 2023 18:38:18 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 8974ECB0C7834C40A468BCFA2BC8CCFF Ref B: FRAEDGE1405 Ref C: 2023-08-31T18:38:18Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507098457&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLPkcheO3igoAAAAYpM45mc3jU4xFOqxM8eEQkDcjf2AKWa7lgMRR2jOrdGfWek0755k2iWaYiLWWwR6CgSqvck_jhFDQ
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPFkP8I/DCGG2xzMRHA==
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 2D36
13 B
172 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:38:18 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 2D36
13 B
103 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:38:18 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:38:18 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:38:18 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
239.07bc4bf7922798bd.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
112 KB
32 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/239.07bc4bf7922798bd.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-encoding
gzip
age
2541319
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
32825
x-served-by
cache-chi-klot8100053-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"754ab6b3cee4b386497a168a8900298e"
x-goog-generation
1690965617240921
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
114759
x-amz-checksum-crc32c
Xrafeg==
accept-ranges
bytes
x-cache-hits
8, 135478
70.0c0cdff9477a566b.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
241 KB
53 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/70.0c0cdff9477a566b.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-encoding
gzip
age
2541319
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
54273
x-served-by
cache-chi-kigq8000064-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"d01bb82fc57aa696eb7a37f25227533f"
x-goog-generation
1690965617620460
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
246299
x-amz-checksum-crc32c
60anbQ==
accept-ranges
bytes
x-cache-hits
8, 136676
spotify_player_o.42e735f526de3a43.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 2D36
25 KB
7 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/spotify_player_o.42e735f526de3a43.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-encoding
gzip
age
2541320
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
7328
x-served-by
cache-chi-klot8100155-CHI, cache-fra-eddf8230119-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"615db0ae9631539d4b3438ee8a5a68da"
x-goog-generation
1690965617266128
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25627
x-amz-checksum-crc32c
CIvg6w==
accept-ranges
bytes
x-cache-hits
8, 130318
6ebf0a3d-0730-48a8-b892-c18b97abd474
https://redcanary.com/
45 B
0
Other
General
Full URL
blob:https://redcanary.com/6ebf0a3d-0730-48a8-b892-c18b97abd474
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
45
Content-Type
text/javascript
TDR-Logo-Lockup-02.png
redcanary.com/wp-content/uploads/2023/03/
7 KB
8 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Logo-Lockup-02.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 02:03:06 GMT
server
nginx
etag
"6419105a-1d03"
vary
Accept-Encoding
x-wpe-request-id
6a4722629b05ba23c750b33541bb5d61
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
7427
birdInFlight-flipped-975x975-1.jpg
redcanary.com/wp-content/uploads/2022/03/
18 KB
18 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2022/03/birdInFlight-flipped-975x975-1.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 07 Mar 2022 19:56:58 GMT
server
nginx
etag
"6226638a-460b"
vary
Accept-Encoding
x-wpe-request-id
afd906925245abc28705749a9a6c85fa
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
17931
TDR-Header01-1200w.jpg
redcanary.com/wp-content/uploads/2023/03/
339 KB
340 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Header01-1200w.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 20:12:02 GMT
server
nginx
etag
"6418be12-54b50"
vary
Accept-Encoding
x-wpe-request-id
e07b8f00250f69bd30937583ef7e3f37
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
346960
Icon_Alert-Center_Investigation.svg
redcanary.com/wp-content/uploads/2020/09/
4 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2020/09/Icon_Alert-Center_Investigation.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 24 Sep 2020 17:12:27 GMT
server
nginx
etag
W/"5f6cd37b-e55"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
728e9ede96d202e0c68e68c2f6acba4d
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
xdc.js
cdn.bizible.com/
116 B
243 B
Script
General
Full URL
https://cdn.bizible.com/xdc.js?_biz_u=9b6d5e11926d49b4830f9ee9a38966f5&_biz_h=-1906410348&cdn_o=a&jsVer=4.23.08.24&a=redcanary.com
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6BBB) /
Resource Hash
170be6f6ede4d5aa355a41db08ae4a222e540fdfe93f86f6117f4d28013c8174

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-type
text/javascript; charset=utf-8
date
Thu, 31 Aug 2023 18:38:17 GMT
cache-control
private, must-revalidate, max-age=21600
server
ECS (amb/6BBB)
etag
A3C80A0D
content-length
116
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
/
www.facebook.com/tr/ Frame 251C
0
70 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://redcanary.com
Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://redcanary.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Thu, 31 Aug 2023 18:38:18 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
350 B
619 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:05 GMT
server
nginx
etag
W/"5c76b1e9-15e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
9b45761ea2094d57ef283f3c06b5b809
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
spotify-logo-black-8-01.svg
redcanary.com/wp-content/uploads/2021/03/
898 B
856 B
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2021/03/spotify-logo-black-8-01.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 29 Mar 2021 15:22:29 GMT
server
nginx
etag
W/"6061f0b5-382"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
dfd04561e39ca6c87220c16e39220ed0
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
u
cdn.bizible.com/m/
43 B
122 B
Image
General
Full URL
https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1693507097689-74021&_biz_u=9b6d5e11926d49b4830f9ee9a38966f5&_biz_s=834ede&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693507098052&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=1&a=redcanary.com&rnd=426652&cdn_o=a&_biz_z=1693507098560
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6BBE) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:18 GMT
last-modified
Fri, 25 Aug 2023 01:58:50 GMT
server
ECS (amb/6BBE)
age
578368
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3a00%3A1012%3A7623%3Aa423%3Aa93c%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
clock
tracking.crazyegg.com/ Frame 7F3B
29 B
136 B
XHR
General
Full URL
https://tracking.crazyegg.com/clock?t=1693507098577&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=e11e81b5c83128ebc3080c46d44c823040f54788&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.97.62 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-97-62.eu-west-1.compute.amazonaws.com
Software
awselb/2.0 /
Resource Hash
aa2e56c37baae50a85e39b043b3b43929798d7ab6ecf68d4ba65218c2ee6605c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 31 Aug 2023 18:38:18 GMT
cache-control
no-store
server
awselb/2.0
content-length
29
content-type
text/plain
messenger
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame ECB0
6 KB
3 KB
Document
General
Full URL
https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e3c73bf8-ce99-435b-80e2-a631e19bd567
Requested by
Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.202.52.191 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-52-191.compute-1.amazonaws.com
Software
/
Resource Hash
09a56e62ad76c8c6141bda78d3a8f02716c14e9d87f6d4c58af9684c22e29897
Security Headers
Name Value
Content-Security-Policy
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
max-age=0, private, must-revalidate
Content-Encoding
gzip
Content-Length
1832
Content-Security-Policy
Content-Type
text/html; charset=utf-8
Date
Thu, 31 Aug 2023 18:38:19 GMT
Etag
W/"09a56e62ad76c8c6141bda78d3a8f027"
Link
<https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=63072000; includeSubDomains
Vary
Accept-Encoding
Via
1.1 spaces-router (devel)
X-Content-Type-Options
nosniff
X-Download-Options
noopen
X-Permitted-Cross-Domain-Policies
none
X-Request-Id
28a38187-6b6f-2371-f404-0fa30a906e67
X-Runtime
0.124965
X-Xss-Protection
1; mode=block
getuidj
secure.adnxs.com/
29 B
706 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
f3e34008c8cbaaf31223a11f38625e79cd70c447ab95b2f491c5692026155227
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:18 GMT
an-x-request-uuid
85799997-e56b-4459-a3cb-591a6b165dd7
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/json; charset=utf-8
access-control-allow-origin
https://redcanary.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
45.141.152.76; 45.141.152.76; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
29
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
232 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2ce753ffa9cf7f69f8af2d27ae2d9e368e33c08d552db4ad4e55cfbde76d75e0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/plain
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
47
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22590%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22e8bebcdaa132f727ae8d16d9967447769318945e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22591%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22591%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22592%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22f3744a5e-342b-429c-9d2c-2c1b7b45310a%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22593%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22593%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22594%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
c.6sc.co/
47 B
232 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2ce753ffa9cf7f69f8af2d27ae2d9e368e33c08d552db4ad4e55cfbde76d75e0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/plain
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
47
/
ipv6.6sc.co/
36 B
335 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:22::1726:62ed Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
0c5fa42a718dbb5295dc7d57d7a1404accc306abefb2b83420fd029ceb5fafe8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:18 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:ac8:20:3a00:1012:7623:a423:a93c
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693507098848_389993773_253869352_17_957_23_0_219";dur=1
content-length
36
expires
Thu, 31 Aug 2023 18:38:18 GMT
d9b6b28e3d84db3e4c966a5cf73af402.js
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/
20 KB
8 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/d9b6b28e3d84db3e4c966a5cf73af402.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:50 GMT
server
cloudflare
age
19304
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff763c7fc49bbaa-FRA
content-length
8025
b9d32794-612b-4c82-bb88-f2db2488d360
https://redcanary.com/
241 B
0
Other
General
Full URL
blob:https://redcanary.com/b9d32794-612b-4c82-bb88-f2db2488d360
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
241
Content-Type
text/javascript
661bb7e9d0e0abee5d7403d3d65553a1.js
script.crazyegg.com/pages/versioned/tracking-scripts/
98 KB
32 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/tracking-scripts/661bb7e9d0e0abee5d7403d3d65553a1.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:18 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:48 GMT
server
cloudflare
age
19307
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff763c81c7dbbaa-FRA
content-length
32149
details
epsilon.6sense.com/v3/company/
746 B
581 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.23.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-23-65.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
92bf4ed91337d45e56707628028b3d620a3d3f05a677b555bfa0d924f51ea2b7

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
Authorization
Token e8bebcdaa132f727ae8d16d9967447769318945e
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
X-6s-CustomID
WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
content-length
398
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.23.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-23-65.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://redcanary.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://redcanary.com
access-control-max-age
1800
date
Thu, 31 Aug 2023 18:38:19 GMT
server
nginx
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 17:49:43 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2916
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Thu, 31 Aug 2023 19:49:43 GMT
collect
www.google-analytics.com/j/
4 B
207 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=139667631&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YADAAEABAAAAACAAI~&jid=1414424133&gjid=1276624700&cid=953353146.1693507097&tid=UA-52702906-1&_gid=146866123.1693507099&_r=1&_slc=1&gtm=45He38u0n81PXWC8JW&cd4=&cd5=&cd10=&cd11=&cd20=&z=1992597030
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
151 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-52702906-1&cid=953353146.1693507097&jid=1414424133&gjid=1276624700&_gid=146866123.1693507099&_u=YADAAEAAAAAAACAAI~&z=21376818
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=953353146.1693507097&jid=1414424133&_u=YADAAEAAAAAAACAAI~&z=95966098
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=953353146.1693507097&jid=1414424133&_u=YADAAEAAAAAAACAAI~&z=95966098
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
messenger-94e6eccc.chunk.css
assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame ECB0
35 KB
7 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-amz-version-id
pW4oZk56_cZoM3p5nVORTV5h8aVxMTFP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
NDXEKETD9CNZTENQ
age
6639
x-amz-server-side-encryption
AES256
x-amz-id-2
+kRf72J0e7K69t7PvyeMMd3skyMn4hmp4wHftz0eSqf/EFyospAMforJddtxVYA9VHKOMtK+sic=
last-modified
Fri, 07 Apr 2023 23:58:38 GMT
server
cloudflare
etag
W/"a788ecf510f83ee517cbaf79306145dd"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff763ca4fb3699b-FRA
expires
Thu, 31 Aug 2023 22:38:19 GMT
messenger-84a66aeb.chunk.css
assets.qualified.com/packs/css/widget/sandboxed/ Frame ECB0
5 KB
1 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-amz-version-id
5Ydu6k4rPSG3QXcV_n2ryczMueyoFhYW
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 04 Jan 2023 23:05:35 GMT
server
cloudflare
x-amz-request-id
0H6CRDXNHH647F2N
age
2135
etag
W/"22d5f23e695250d3c5a5b1e76a015c5e"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff763ca4fb6699b-FRA
x-amz-id-2
rgn5P6CR8m+rf3P03WxBD6f0A3s75us0cIGzLusOeSJLRNmmksDkjKFiVjH/czeIIGLM4GOsUqU=
expires
Thu, 31 Aug 2023 22:38:19 GMT
messenger~runtime-f4ac063cf9338bc709b8.js
assets.qualified.com/packs/js/widget/sandboxed/ Frame ECB0
2 KB
1 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-f4ac063cf9338bc709b8.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e3c73bf8-ce99-435b-80e2-a631e19bd567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-amz-version-id
PdfsJsTwxZSJ8tn07cjcyE.BvIAlLvhP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
VGH906Z6ZHBER695
age
5269
x-amz-server-side-encryption
AES256
x-amz-id-2
9Mm04IrN/kuerp41mUDLrQqrtwMui6QztUEmwgVC5teo20Y/NLbB8ovy3l2piDIH8OEfUnYs5vA=
last-modified
Thu, 31 Aug 2023 01:01:43 GMT
server
cloudflare
etag
W/"211c830511b7e3f0f42259032f070166"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff763ca5fc7699b-FRA
expires
Thu, 31 Aug 2023 22:38:19 GMT
messenger-369223c5490f8cdcf187.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame ECB0
1 MB
362 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e3c73bf8-ce99-435b-80e2-a631e19bd567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-amz-version-id
oK9jovqhn.gYLI4zbnGqtErXgbUHzdXb
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
YDWKBM3WF1YTXAZR
age
6551
x-amz-server-side-encryption
AES256
x-amz-id-2
U8aupclnzvxC6qN26xexPB3884wSBOlDwyS5kP3nCU1tXrqz/JcV+iDQelj9KR4KZvJ8SXVlTtQp3i4zf8WY2Xon3nYEYVdTwuGQzcx+kxQ=
last-modified
Mon, 28 Aug 2023 20:31:37 GMT
server
cloudflare
etag
W/"07365b735e31be744e837d71d12cb7ad"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff763ca5fc8699b-FRA
expires
Thu, 31 Aug 2023 22:38:19 GMT
messenger-4dcf43b9b54c3f5764c6.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame ECB0
622 KB
162 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-4dcf43b9b54c3f5764c6.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e3c73bf8-ce99-435b-80e2-a631e19bd567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-amz-version-id
TbFSaWaZouDNzEPRloXQJWsSi3g5kbCP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
VGHA6VHQYZVR0BNC
age
5269
x-amz-server-side-encryption
AES256
x-amz-id-2
oAwhlpmmu9MPavAAmYBjCOv5/2zGLCpt35q4A0e9Mtml5fULNpcq2m3+exEnpy8WVy8ujUoo0Vs=
last-modified
Thu, 31 Aug 2023 01:01:44 GMT
server
cloudflare
etag
W/"94ddddc8eac8fb41be3179fa9a2943df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff763ca5fda699b-FRA
expires
Thu, 31 Aug 2023 22:38:19 GMT
Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame ECB0
97 KB
97 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e3c73bf8-ce99-435b-80e2-a631e19bd567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-amz-version-id
6ViLFLq9kOtWUYiO9HXHYQ7YKbNk.uBQ
cf-cache-status
HIT
x-amz-request-id
B88E1DP4V281RRAN
age
18285815
content-length
98868
x-amz-id-2
riQSS2Uk2meWe9+qjtJCWfC7Cc6wg/dIl98t0u8lbNTHETPwrBJn1UDNRquf/2qLvjNWprm/DWI=
last-modified
Wed, 01 Feb 2023 01:20:27 GMT
server
cloudflare
etag
"dc131113894217b5031000575d9de002"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff763ca6fe4377c-FRA
expires
Sat, 31 Aug 2024 00:38:19 GMT
Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame ECB0
103 KB
104 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e3c73bf8-ce99-435b-80e2-a631e19bd567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-amz-version-id
NA2I0kQulZCiV5b2Gxm6HRkKcLK6RFay
cf-cache-status
HIT
x-amz-request-id
B88EMSW3WBFWA6XM
age
18285815
content-length
105804
x-amz-id-2
DZkrX5Bbe/BzgKwx/5gOQ7LDFv5I9cCbUydrigIqo4mkP2/+GlYXHW1Nrz6LU/0p2Z3oE5mOn9Q=
last-modified
Wed, 01 Feb 2023 01:20:27 GMT
server
cloudflare
etag
"007ad31a53f4ab3f58ee74f2308482ce"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff763ca6fe9377c-FRA
expires
Sat, 31 Aug 2024 00:38:19 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=f72a3517a18730001adef0645d020000c5cd0300&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A18%20GMT%22%2C%22timeSpent%22%3A%221011%22%2C%22totalTimeSpent%22%3A%221011%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&an_uid=8154658031317354889&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
sentry.io/api/1332833/envelope/ Frame ECB0
2 B
324 B
Fetch
General
Full URL
https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1
Requested by
Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
156.247.186.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.qualified.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
server
nginx
vary
origin,access-control-request-method,access-control-request-headers
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
optimize.js
www.google-analytics.com/gtm/
124 KB
48 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:19 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
49085
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:38:19 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=139667631&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABQAAAACAAI~&jid=&gjid=&cid=953353146.1693507097&tid=UA-52702906-1&_gid=146866123.1693507099&gtm=45He38u0n81PXWC8JW&cd4=&cd5=&cd10=&cd11=&cd20=&cd6=Germany&cd7=Hesse&cd8=Frankfurt%20am%20Main&cd9=&cd12=&cd13=&cd14=&cd18=null&z=1746162750
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 08:16:00 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
37339
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=f72a3517a18730001adef0645d020000c5cd0300&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222012%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&an_uid=8154658031317354889&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:20 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame ECB0
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.136.162 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:38:22 GMT
Last-Modified
Thu, 20 Oct 2022 23:47:27 GMT
Server
AmazonS3
x-amz-request-id
P8ZRN0CRS6BCPWQP
ETag
"fd481ec600c1b3fad6f9e29aa732a946"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
12932
x-amz-id-2
+e62TEjBwvSwvcf/aNRjdzdrTSx+nWhpfeNLCdbXzsnIGwSoecIk7l4yVls1U32nQcazzmyek98=
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=f72a3517a18730001adef0645d020000c5cd0300&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&an_uid=8154658031317354889&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:21 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame ECB0
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.136.162 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:38:22 GMT
Last-Modified
Thu, 20 Oct 2022 23:48:08 GMT
Server
AmazonS3
x-amz-request-id
P8ZTTPDME2D708WC
ETag
"7797b96a7f999ac42de528bede3329af"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
13099
x-amz-id-2
5hG97/jF6DgAB/39covC4lwcZdv4W2A3eo1saAywYpg4RdjJTNjq/xi2zfvJ0PN7GxgXEPJPzbQ=
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:38:21 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 2D36
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:38:21 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 2D36
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:38:21 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:38:21 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=f72a3517a18730001adef0645d020000c5cd0300&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A21%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&an_uid=8154658031317354889&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:22 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=f72a3517a18730001adef0645d020000c5cd0300&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A22%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&an_uid=8154658031317354889&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:23 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=f72a3517a18730001adef0645d020000c5cd0300&visitor=ca4fcee4-5821-48ed-8741-4ac7e6f44f2f&session=bb2bbbaa-eddc-4510-86d4-9afa56fc3652&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A38%3A23%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226016%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=9462ac8b-4f6d-4ab8-8f51-011e67bf0664&an_uid=8154658031317354889&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-42-251.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:38:24 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| documentPictureInPicture function| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| MktoForms2 object| dataLayer object| _6si function| gtag string| QualifiedObject function| qualified object| Bizible object| BizTrackingA object| BizA object| hljs boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_SITE_DATA_URL string| CE_USER_DATA_URL object| theme_ajax_object object| lazyLoadOptions function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data string| CE_USER_COMMON_SCRIPT_URL string| CE_USER_THIRDPARTY_SCRIPT_URL function| twq string| _linkedin_data_partner_id function| rdt object| GooglebQhCsO function| fbq function| _fbq function| getParam function| getExpiryRecord function| addGclid function| onYouTubeIframeAPIReady object| gaGlobal object| webpackChunkCE2 object| CE2BH function| CE_URL_FINGERPRINT object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels object| regeneratorRuntime object| twttr object| CE_API function| UET function| UET_init function| UET_push object| ueto_0be53e4575 object| uetq object| MunchkinTracker object| FormsPlus undefined| Cookies undefined| URI boolean| _q_widgetInitialized object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| webpackChunknylon function| LazyLoad object| images boolean| is_image object| iframes boolean| is_iframe object| rocket_lazy object| _vis_opt_queue object| LC_API string| _q_lastClientActivityAt string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed function| lintrk boolean| _already_called_lintrk boolean| _storagePopulated string| GoogleAnalyticsObject function| ga object| gaplugins object| gaData object| google_optimize

46 Cookies

Domain/Path Name / Value
.resource.redcanary.com/ Name: __cf_bm
Value: 1YPtt6H8IcCa328T7Bn7fIQImHSCgpQsK9zeHpl6YbE-1693507096-0-AZ6Vkxvjs4tEwx0NPNhxfTGJXDy1iixZpvgY7FLWrYZQBvJ8v7iE1nQIkVR2Ob33Mo8EGqRlnkU3Yy5kUcmBD0k=
.redcanary.com/ Name: _biz_uid
Value: 9b6d5e11926d49b4830f9ee9a38966f5
.redcanary.com/ Name: _biz_sid
Value: 834ede
.spotify.com/ Name: sp_t
Value: d5c93cb0f5d26c4d23c6c13b0a5d7636
.spotify.com/ Name: sp_landing
Value: https%3A%2F%2Fredcanary.com%2F%3Fsp_cid%3Dd5c93cb0f5d26c4d23c6c13b0a5d7636%26device%3Ddesktop
.redcanary.com/ Name: _gcl_au
Value: 1.1.1731372302.1693507097
.redcanary.com/ Name: _ga_T3K4MTNQJN
Value: GS1.1.1693507097.1.0.1693507097.60.0.0
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.redcanary.com/ Name: _rdt_uuid
Value: 1693507097123.ef180d3c-4f58-4f6f-8bda-7ef0770c064e
.t.co/ Name: muc_ads
Value: 463e9c4b-bb3a-4517-a21c-3d901f790dd8
.twitter.com/ Name: personalization_id
Value: "v1_mlXp7w7TTqcW5tKsywk2QA=="
.adnxs.com/ Name: uuid2
Value: 8154658031317354889
.redcanary.com/ Name: _fbp
Value: fb.1.1693507097680.281643025
.redcanary.com/ Name: _mkto_trk
Value: id:003-YRU-314&token:_mch-redcanary.com-1693507097689-74021
.redcanary.com/ Name: _biz_nA
Value: 2
.bizibly.com/ Name: _BUID
Value: 8b683ab22a2a52efc2a6ff80782ac757
.bizible.com/ Name: _BUID
Value: 9b6d5e11926d49b4830f9ee9a38966f5
.redcanary.com/ Name: _uetsid
Value: 8da6ad30482d11eeaa2d2f4220bcee9c
.redcanary.com/ Name: _uetvid
Value: 8da6e0c0482d11eeb1e4b3284b303fbb
redcanary.com/ Name: _gd_visitor
Value: ca4fcee4-5821-48ed-8741-4ac7e6f44f2f
redcanary.com/ Name: _gd_session
Value: bb2bbbaa-eddc-4510-86d4-9afa56fc3652
redcanary.com/ Name: cookielawinfo-checkbox-necessary
Value: yes
redcanary.com/ Name: cookielawinfo-checkbox-non-necessary
Value: yes
.bing.com/ Name: MUID
Value: 0D902F547BD2641D36083C2A7AD26549
.redcanary.com/ Name: cebs
Value: 1
.redcanary.com/ Name: _ce.s
Value: v~e11e81b5c83128ebc3080c46d44c823040f54788~lcw~1693507098287~vpv~0~lcw~1693507098288
redcanary.com/ Name: ln_or
Value: eyIxNTQwNzUzIjoiZCJ9
.redcanary.com/ Name: _ce.clock_event
Value: 1
.redcanary.com/ Name: _biz_pendingA
Value: %5B%5D
.linkedin.com/ Name: li_sugr
Value: 7e6bf91d-becf-418c-9b9e-7c04c2d3b592
.linkedin.com/ Name: bcookie
Value: "v=2&3ad2e9ff-54f4-444e-8012-bf264b35df9f"
.linkedin.com/ Name: lidc
Value: "b=TGST01:s=T:r=T:a=T:p=T:g=3124:u=1:x=1:i=1693507098:t=1693593498:v=2:sig=AQG-g-OztMSO47ZzDH970WSw0GeJ_USF"
.redcanary.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.linkedin.com/ Name: UserMatchHistory
Value: AQI3C_a4xoR7WwAAAYpM45hWZr3kDLeA7Ph-1cGpoekriff1d5D60YYaVfqgKewzVle8y-LsEM1DJg
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLLwn9MtlIRdAAAAYpM45hW1VHwr7BKN3QZZnrK42eYOMtkRFmnWondH5wzuh5oqomxP7M78xAm9tSx-mFCUA
redcanary.com/ Name: _an_uid
Value: 8154658031317354889
.redcanary.com/ Name: _ce.clock_data
Value: 71%2C45.141.152.76%2C1%2C0f286e8f7fa153358c622af13d09b529
.redcanary.com/ Name: cebsp_
Value: 1
.www.linkedin.com/ Name: bscookie
Value: "v=1&2023083118381856d5c6bc-71c9-46cd-86b3-37481fac9684AQHfShJHf1mJtFIVk5L_Pi9-z2n_-RG7"
.linkedin.com/ Name: li_gc
Value: MTswOzE2OTM1MDcwOTg7MjswMjGXGMpLl27PchdG7EYIAKAZT9mao8w4ZtuAoTM8V7mpAg==
redcanary.com/ Name: _gd_svisitor
Value: f72a3517a18730001adef0645d020000c5cd0300
.redcanary.com/ Name: _ga
Value: GA1.2.953353146.1693507097
.redcanary.com/ Name: _gid
Value: GA1.2.146866123.1693507099
.redcanary.com/ Name: _gat_UA-52702906-1
Value: 1
.6sc.co/ Name: 6suuid
Value: f72a3517a18730001adef0645d020000c5cd0300
.redcanary.com/ Name: __q_state_bAEbi2aHVysBKzuy
Value: eyJ1dWlkIjoiZTNjNzNiZjgtY2U5OS00MzViLTgwZTItYTYzMWUxOWJkNTY3IiwiY29va2llRG9tYWluIjoicmVkY2FuYXJ5LmNvbSIsIm1lc3NlbmdlckV4cGFuZGVkIjpmYWxzZSwicHJvbXB0RGlzbWlzc2VkIjpmYWxzZSwiY29udmVyc2F0aW9uSWQiOiIxMjE0NDA3NDgxMDEyNDk0NTUxIn0=

3 Console Messages

Source Level URL
Text
other warning URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/(Line 306)
Message:
Allow attribute will take precedence over 'allowfullscreen'.
javascript warning URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Message:
It is recommended that a robustness level be specified. Not specifying the robustness level could result in unexpected behavior.
javascript verbose URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js(Line 1)
Message:
Rendering was performed in a subtree hidden by content-visibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
ajax.googleapis.com
alb.reddit.com
analytics.twitter.com
app.qualified.com
apresolve.spotify.com
assets.qualified.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
connect.facebook.net
embed-cdn.spotifycdn.com
encore.scdn.co
epsilon.6sense.com
fonts.googleapis.com
gew4-spclient.spotify.com
googleads.g.doubleclick.net
i.scdn.co
ipv6.6sc.co
j.6sc.co
js.qualified.com
munchkin.marketo.net
open.spotify.com
px.ads.linkedin.com
px4.ads.linkedin.com
qualified-production.s3.us-east-1.amazonaws.com
redcanary.com
region1.analytics.google.com
resource.redcanary.com
s.ml-attr.com
s3-us-west-2.amazonaws.com
script.crazyegg.com
secure.adnxs.com
sentry.io
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tracking.crazyegg.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
104.17.73.206
104.198.136.223
104.244.42.131
104.244.42.69
13.107.42.14
146.75.116.157
151.101.65.140
152.195.15.58
192.28.147.68
2001:4860:4802:34::36
23.192.243.198
23.53.42.251
2600:1901:0:524d::
2600:1901:1:81::
2600:1901:1:c36::
2600:9000:20eb:8e00:2:53b2:240:93a1
2600:9000:2251:6800:12:3734:2a40:93a1
2606:4700::6811:190e
2606:4700::6812:1005
2606:4700::6813:9408
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:808::200a
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2002
2a00:1450:4001:812::2004
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2003
2a00:1450:4001:82f::2008
2a00:1450:400c:c0c::9c
2a02:26f0:3500:6::17d8:4d9b
2a02:26f0:480:22::1726:62ed
2a02:26f0:780::210:a418
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a04:4e42:400::396
2a04:4e42:8d::760
2a04:4e42:8d::762
34.202.52.191
35.158.23.65
35.186.247.156
37.252.171.52
52.216.136.162
52.92.240.48
54.77.97.62
68.67.153.60
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5
09a56e62ad76c8c6141bda78d3a8f02716c14e9d87f6d4c58af9684c22e29897
0c5fa42a718dbb5295dc7d57d7a1404accc306abefb2b83420fd029ceb5fafe8
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83
170be6f6ede4d5aa355a41db08ae4a222e540fdfe93f86f6117f4d28013c8174
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
2ce753ffa9cf7f69f8af2d27ae2d9e368e33c08d552db4ad4e55cfbde76d75e0
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
61138641513730f618f72fbadc63ea68084a8fc7dcc423982402d26bba8470e6
61630180d99e12a103d2d8d93423d0ec0a280ce92c80c4436515905dcf3d8b52
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
71f31fa8a52e87e9ccf84a05db65619c18733021e334fa84c4aa88def6c4dc11
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33
8ea04aff1e26b3002a0e8f9a752c39d12eba28cb176ef120639cbcda0e8181f1
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
92bf4ed91337d45e56707628028b3d620a3d3f05a677b555bfa0d924f51ea2b7
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e
aa2e56c37baae50a85e39b043b3b43929798d7ab6ecf68d4ba65218c2ee6605c
aade2be3a7a6dd383ea77837f2bc319debf8a111f189dd250daca43acb6ed315
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
ca6fea2d10a11e9afc9d4d36b5ae2a7433ba6724ef4a7f4db2a034927e158b8c
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9
cdccac3e5c1db56da01a50038dfe18fd5891463ba561ed0684c98693447052c8
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
d3227cea6e9e178f163dabbb176e4e7a9a07cda1d14a838d33373300af19f59c
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f3e34008c8cbaaf31223a11f38625e79cd70c447ab95b2f491c5692026155227
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1
f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a