blog.tetrane.com Open in urlscan Pro
2600:9000:20eb:3800:b:dcf1:9140:93a1 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Submission Tags: falconsandbox
Submission: On July 10 via api (July 10th 2021, 4:23:36 pm UTC) from US

Summary HTTP 73 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 13 IPs in 2 countries across 10 domains to perform 73 HTTP transactions. The main IP is 2600:9000:20eb:3800:b:dcf1:9140:93a1, located in United States and belongs to AMAZON-02, US. The main domain is blog.tetrane.com.
TLS certificate: Issued by Amazon on January 7th 2021. Valid for: a year.

This is the only time blog.tetrane.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	2600:9000:20e... 2600:9000:20eb:3800:b:dcf1:9140:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
2	2600:9000:215... 2600:9000:2156:5200:d:1c5c:fb80:93a1	16509 (AMAZON-02) (AMAZON-02)
12	2a04:4e42:1b:... 2a04:4e42:1b::622	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
4	2.16.186.18 2.16.186.18	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.87.45.133 52.87.45.133	14618 (AMAZON-AES) (AMAZON-AES)
1	52.6.75.166 52.6.75.166	14618 (AMAZON-AES) (AMAZON-AES)
2	50.16.76.135 50.16.76.135	14618 (AMAZON-AES) (AMAZON-AES)
73	13

43 2600:9000:20eb:3800:b:dcf1:9140:93a1 (United States)

ASN16509 (AMAZON-02, US)

blog.tetrane.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2156:5200:d:1c5c:fb80:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.calendly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a04:4e42:1b::622 (United States)

ASN54113 (FASTLY, US)

fast.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fast.wistia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.16.186.18 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-18.deploy.static.akamaitechnologies.com

embedwistia-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.87.45.133 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-87-45-133.compute-1.amazonaws.com

distillery.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.75.166 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-75-166.compute-1.amazonaws.com

pipedream.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.16.76.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-76-135.compute-1.amazonaws.com

fg8vvsvnieiv3ej16jby.litix.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	tetrane.com blog.tetrane.com	2 MB
13	wistia.com fast.wistia.com distillery.wistia.com pipedream.wistia.com	340 KB
4	akamaihd.net embedwistia-a.akamaihd.net	168 KB
3	gstatic.com fonts.gstatic.com	43 KB
2	litix.io fg8vvsvnieiv3ej16jby.litix.io	172 B
2	google-analytics.com www.google-analytics.com	19 KB
2	calendly.com assets.calendly.com	8 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	34 KB
1	wistia.net fast.wistia.net	13 KB
1	googletagmanager.com www.googletagmanager.com	36 KB
73	10

	Domain	Requested by
43	blog.tetrane.com	blog.tetrane.com
11	fast.wistia.com	blog.tetrane.com fast.wistia.com
4	embedwistia-a.akamaihd.net	blog.tetrane.com fast.wistia.com
3	fonts.gstatic.com	fonts.googleapis.com
2	fg8vvsvnieiv3ej16jby.litix.io	fast.wistia.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	assets.calendly.com	blog.tetrane.com
1	pipedream.wistia.com	fast.wistia.com
1	distillery.wistia.com	fast.wistia.com
1	fast.wistia.net
1	fonts.googleapis.com	blog.tetrane.com
1	ajax.googleapis.com	blog.tetrane.com
1	www.googletagmanager.com	blog.tetrane.com
73	13

This site contains links to these domains. Also see Links.

Domain
www.tetrane.com
helpdesk.tetrane.com
doc.tetrane.com
github.com
twitter.com
exatrack.com
public.gdatasoftware.com
blog.talosintelligence.com
artemonsecurity.com
www.volatilityfoundation.org

Subject Issuer	Validity	Valid
*.tetrane.com Amazon	`2021-01-07` - `2022-02-05`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.calendly.com Go Daddy Secure Certificate Authority - G2	`2021-02-06` - `2022-03-10`	a year	crt.sh
fast.wistia.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
fast.wistia.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.wistia.com Amazon	`2021-04-01` - `2022-04-30`	a year	crt.sh
*.litix.io Amazon	`2020-11-27` - `2021-12-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Frame ID: 2D03BFDAAC103EA833CB0EFF41110845
Requests: 74 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers via /$CloudFront$$/i
headers server /^AmazonS3$/i

Amazon Cloudfront (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /$CloudFront$$/i

Amazon S3 (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

73
Requests

100 %
HTTPS

67 %
IPv6

10
Domains

13
Subdomains

13
IPs

2
Countries

2867 kB
Transfer

4565 kB
Size

4
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://www.tetrane.com/#all

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/#technology
Title: Technology

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/#features
Title: Features

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/demos.html
Title: Try REVEN

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/Reven-pricing.html
Title: Pricing

Search URL Search Domain Scan URL

URL: https://helpdesk.tetrane.com/
Title: Helpdesk & FAQ

Search URL Search Domain Scan URL

URL: https://doc.tetrane.com/
Title: Documentation

Search URL Search Domain Scan URL

URL: https://github.com/tetrane/reven2-resources
Title: Github

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/REVEN-VMs.html#VMS
Title: VMs

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/REVEN-Scenarios-Traces-CVE-Malware.html#VMS
Title: Scenarios

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/index.html#company
Title: About

Search URL Search Domain Scan URL

URL: https://www.tetrane.com/index.html#contact
Title: Contact

Search URL Search Domain Scan URL

URL: https://twitter.com/tetrane

Search URL Search Domain Scan URL

URL: https://exatrack.com/public/Uroburos_EN.pdf
Title: already exists

Search URL Search Domain Scan URL

URL: https://public.gdatasoftware.com/Web/Content/INT/Blog/2014/02_2014/documents/GData_Uroburos_RedPaper_EN_v1.pdf
Title: multiple

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/2014/04/snake-campaign-few-words-about-uroburos.html
Title: easily

Search URL Search Domain Scan URL

URL: https://artemonsecurity.com/uroburos.pdf
Title: available

Search URL Search Domain Scan URL

URL: https://www.volatilityfoundation.org/
Title: Volatility

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/2018/08/exploitable-or-not-exploitable-using.html
Title: blog entry

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

73 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request Analysis-Uroburos-Malware-REVEN.html Show response
blog.tetrane.com/2019/ 36 KB
11 KB 83ms
48ms Document
text/html 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da912b0912c29c410c92ba7e406d21b38655015ae64853919b477140cb894f43

Request headers

:method: GET
:authority: blog.tetrane.com
:scheme: https
:path: /2019/Analysis-Uroburos-Malware-REVEN.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html
x-amz-id-2: Tn6hdpUdPiEZxMtwaR4Wwq7wKkpXSiv5eekYKGmm3u8WWKQVsWGnG63hG80g8atIACl8+QN56LE=
x-amz-request-id: 61X986S29XYAPQVY
date: Wed, 07 Jul 2021 21:42:07 GMT
last-modified: Wed, 07 Jul 2021 13:39:04 GMT
etag: W/"bbd204bdf49b68eed9e6659dd8d6863e"
cache-control: max-age=604800,public
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: xPOzpDdtrjnGODMSMtpRqnrHKgVHR8GDn0xtdgvWWxtVf9NuA6PgiA==
age: 240070

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 91 KB
36 KB 32ms
29ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-25617784-1

Requested by

Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

03eb9f536c83b4a568844e5dd5d758b79201696c112f9e7e1a7a55877d4395ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36868
x-xss-protection: 0
last-modified: Sat, 10 Jul 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 10 Jul 2021 16:23:16 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.0/ 94 KB
33 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js

Requested by

Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 14:12:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7826
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33576
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Jul 2022 14:12:50 GMT

GET
H2 200 bootstrap.min.css
blog.tetrane.com/css/ 118 KB
20 KB 75ms
73ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/bootstrap.min.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c

Request headers

:path: /css/bootstrap.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:29:43 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:27 GMT
server: AmazonS3
age: 262414
etag: W/"2f624089c65f12185e79925bc5a7fc42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: F2KA12R8BTEP3JMT
x-amz-cf-id: phaeCaKT9c-ittR7XmuMT_CbuASY3yydvIjYEU-6ZbvRbBwtp4R_0Q==
x-amz-id-2: 528a0LPXHp74h9FuJXKldqQrByCxdVtyKzY1Iv9MfQ6R89XZqEHXfgQvF/qhQvFo3NhbfO0zgOs=

GET
H2 200 css
fonts.googleapis.com/ 10 KB
902 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,300,700,800,400italic

Requested by

Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a426c9d5990240e51a6683d7da2c7787ef1cf5426d0a531840390fc94b34c01c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 10 Jul 2021 16:23:16 GMT
server: ESF
date: Sat, 10 Jul 2021 16:23:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jul 2021 16:23:16 GMT

GET
H2 200 pe-icon-7-stroke.css
blog.tetrane.com/css/ 9 KB
2 KB 214ms
213ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/pe-icon-7-stroke.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 313ca6062a2ac35e34f6e965cb8f8a2be7aad111edb628faf1b03f7e43889a39

Request headers

:path: /css/pe-icon-7-stroke.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:28 GMT
server: AmazonS3
age: 262482
etag: W/"9a6f2ac954e7e4dcd3e6a8fc86b00b89"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: WP92AW48PXNYWFE9
x-amz-cf-id: 2XF8jgZBOER58tpyqaNahkCqdE7Yn-EfuClW5XvO_JGWgzmsyVHV3Q==
x-amz-id-2: CEUeyS66zUhex7iRAVUnOj8npepGv9id9qic/Hqz3KqPyEOkq89XJwgaZAB9ExmMBONvq6Zc990=

GET
H2 200 helper.css
blog.tetrane.com/css/ 4 KB
1 KB 49ms
47ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/helper.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2b80e4c11c367db768ff06716ce027e87db54cd4132fd75891646a9407a453ea

Request headers

:path: /css/helper.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:27 GMT
server: AmazonS3
age: 262482
etag: W/"b041b560d4bd6a2b307610fc17db2047"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: WP971JDPVMMWTF8X
x-amz-cf-id: CUO_AX1bi1mO_LWnc2C-LWbfvFtEcMd7jT60FP_Gf-LfRNcXQrAACQ==
x-amz-id-2: aJHj95XHnIleM+dlptkPKxu1ESfl6I9bZxsynDKLFQO/WF5H+3bYvsFoQAjrsl7PRJlvDckb5s4=

GET
H2 200 style.default.css
blog.tetrane.com/css/ 37 KB
7 KB 61ms
60ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/style.default.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0fc1da46fb87c7798d990a8b70bfad094886aa232a591cb34a83007a04a78ae8

Request headers

:path: /css/style.default.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:29:43 GMT
content-encoding: gzip
last-modified: Thu, 23 Jan 2020 20:45:15 GMT
server: AmazonS3
age: 262414
etag: W/"16d7b9cfbfbd9929efad4ac673600994"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: F2KFJVDKQ1BB6XWK
x-amz-cf-id: pz0NIaQZ-nWbm5nHN6AEXW_Gc5QmNMgn1J0CXuNQfkuyXUDLkI6n5g==
x-amz-id-2: YqbI3nVBSFYFXoYC6nXK1Gap2/Tsv1SiPbagJZp8dpsoTBC2D/o0nXLoOwtyigh61TunGkTRZBk=

GET
H2 200 custom.css
blog.tetrane.com/css/ 4 KB
2 KB 39ms
37ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/custom.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 936c090055735dffce05f41f859aa784869e50201fc9422fd22c3f4ceb1f88a3

Request headers

:path: /css/custom.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
content-encoding: gzip
last-modified: Tue, 05 May 2020 23:38:41 GMT
server: AmazonS3
age: 262482
etag: W/"a187f8ce36d51b57fed28521aeaf2412"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: WP9852T8R1V69CY4
x-amz-cf-id: wgXvAAp06Olftb_x4jJuzobKe5lOdWtcOfmJLSqaB7eCa9IzQqtacw==
x-amz-id-2: ib8hpZFW3u4FjW5SDMlGf4TMZiOiLpscRRLwPk+NjJKzYw3nCmRamKbjHz+LFhUGd4keoZrnNXY=

GET
H2 200 custom-blog.css
blog.tetrane.com/css/ 2 KB
1 KB 24ms
22ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/custom-blog.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 53beddc6617675473a3802447767b2e3dd3c987947c6485e1da5797f01f8a374

Request headers

:path: /css/custom-blog.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
content-encoding: gzip
last-modified: Tue, 13 Apr 2021 07:57:02 GMT
server: AmazonS3
age: 262482
etag: W/"9951524b5a26a5016a8617592c6dbfc5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: WP9E6QZFY199XBK4
x-amz-cf-id: MhZ55wKdUlpoFRGSKbkGSC00sWrN3ABGSSRnlIDySHUEzp9K1Inndg==
x-amz-id-2: nAV1kJrrbIGDti/I9yxChnV2qhKQvleMJU20udYvtYB/RG5msV4oWF3IfQAOQuOhRIuDwV6upH4=

GET
H2 200 code-syntax.css
blog.tetrane.com/css/ 3 KB
910 B 30ms
28ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/code-syntax.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9e59523346aa69ff21ad2b23ef555cf7059c78378faaf886f0f6af4b7ba47f67

Request headers

:path: /css/code-syntax.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:29:43 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:27 GMT
server: AmazonS3
age: 262414
etag: W/"0dc4a2d823eb1f32e49b173ce8ae28c8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: F2K1NBWSV5X5TP6Q
x-amz-cf-id: 00oqjjG7Wq1JROQFkTySKHyutUj7PZrh8NGaqCDLzoeJDaycdcDDWQ==
x-amz-id-2: T1j9Fco3Oa0knsRlSbyiaWjw73G0xWgtMTEWA/x37W3eJ3ZJdBWgUaDcXCZl5phAg+UQBo6iFUA=

GET
H2 200 native.css
blog.tetrane.com/css/ 5 KB
1 KB 69ms
67ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/native.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 02ec511a4d26d09eff6af15d81b01dab30bd691fc00836d9a3b89a906f975d34

Request headers

:path: /css/native.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:29:43 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:28 GMT
server: AmazonS3
age: 262414
etag: W/"49c1eab197877fce88807b7cc4a779e8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: F2KDNPRGWWYJ9JNJ
x-amz-cf-id: 3YBsvZapDTduJm6EXB063mzaeUkMm2f3zGgeOj8kmSM6PJYVXpZJpw==
x-amz-id-2: ho3w7w0ovVHy2p3ubHsN0dJhzYR/ANCO9z+PXNKS6CJt2BYu4lrxVucja59Gx5reaP6VMQjcVjA=

GET
H2 200 atom-one-dark-reasonable.css
blog.tetrane.com/css/ 2 KB
1 KB 33ms
32ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/atom-one-dark-reasonable.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d1ce0c9a83b58b6ef41a618378dbddfb913ad2434a9e1dfeb030b8687c4895ad

Request headers

:path: /css/atom-one-dark-reasonable.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:27 GMT
server: AmazonS3
age: 262482
etag: W/"110f7dd2e8babf2bfd5db9070342c6e7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: WP9DVCG0VNC8609K
x-amz-cf-id: ju-4GPDcPogbF0H7KcroJpC43817QljepjD-cuflqLlGKpgKrVMDTw==
x-amz-id-2: hGNjUW2xjIdgshrtwXD1ShOeOZzulisecQnjDJNcO2IZOXTW0Xg+Aj6hZAMo/mDd70jAKMZFMeA=

GET
H2 200 highlight.pack.js Show response
blog.tetrane.com/js/ 65 KB
26 KB 53ms
51ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/highlight.pack.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0b8bea3d419b058fa9445b470e15f960abbaa19537bd84a09ef8a5ed9108e9c8

Request headers

:path: /js/highlight.pack.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:19 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:36 GMT
server: AmazonS3
age: 262737
etag: W/"a6248103c1a601aeccc624692e532324"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: EXKC25S30GTXXTS0
x-amz-cf-id: agsQPYPAMSUYakQH6G7pm6qevWVaRLUWqNha8iYmQdj7xkTqKXo0xw==
x-amz-id-2: RNDJ9GNRmZa0aR9xb6WkKrJY08uQC2jHGYRvjFAU32Y07KLclOHVXqe2Ilao5A6ZTaNiT7tSKN8=

GET
H2 200 custom-style.css
blog.tetrane.com/css/ 4 KB
2 KB 43ms
42ms Stylesheet
text/css 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/css/custom-style.css
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4449fad78178dd923da79352e7a6c2f0d41c7f37ee67ff93a32a9f34097912ae

Request headers

:path: /css/custom-style.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
content-encoding: gzip
last-modified: Thu, 07 Nov 2019 18:52:17 GMT
server: AmazonS3
age: 262482
etag: W/"1ab97fab49879255c50da7e105d313c4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: WP99EJDKE33B02EG
x-amz-cf-id: SVrm8AruuVQhMS8YcoZHpoi9kSqrAh48nke_MZe8J-pUWCg4_kE-6g==
x-amz-id-2: fEt3c13dfTzQ8/2lmEhP0+5kpM0KBlt1C5Pz2mKXsAgHehrAHFMG3taTOz9aA7aWF0XkZtddGpA=

GET
H2 200 widget.css
assets.calendly.com/assets/external/ 3 KB
1 KB 86ms
58ms Stylesheet
text/css 2600:9000:2156:5200:d:1c5c:fb80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.calendly.com/assets/external/widget.css

Requested by

Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:5200:d:1c5c:fb80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c234008dd16f9be0fd67752fab36832e286887f07ba5fd1dcda9f4b42ec4fe08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: FRA50-C1
x-cache: Hit from cloudfront
content-length: 887
access-control-allow-origin: *
last-modified: Fri, 09 Jul 2021 17:19:22 GMT
server: cloudflare
date: Sat, 10 Jul 2021 16:23:16 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: text/css
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cf-ray: 66c37db888dc3260-FRA
x-amz-cf-id: paoSMeyxoXWec--jNrfS0TEGS09iQ2WHsgDdnMAl5A67RAbME4fMBA==

GET
H2 200 widget.js Show response
assets.calendly.com/assets/external/ 25 KB
6 KB 101ms
74ms Script
application/javascript 2600:9000:2156:5200:d:1c5c:fb80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.calendly.com/assets/external/widget.js

Requested by

Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:5200:d:1c5c:fb80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ef1f35dba8c73d124c0b01211f4da3277c39f1ad2f25d02f4beb62c876e215e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: FRA50-C1
x-cache: Hit from cloudfront
content-length: 6026
access-control-allow-origin: *
last-modified: Fri, 09 Jul 2021 17:19:23 GMT
server: cloudflare
date: Sat, 10 Jul 2021 16:23:16 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cf-ray: 66c37db89fad648b-FRA
x-amz-cf-id: 5oX1sWc6tL8yhNeSvZh7rmD25ZQ62AvRP4NbyNz_eqWKQT7Vz9kvWQ==

GET
H2 200 tetrane-small-logo.png
blog.tetrane.com/img/ 1 KB
2 KB 447ms
443ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/img/tetrane-small-logo.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 55328bc94879bc6e36b31bb507cbec38afba680a17f0be5a23f8e533f8403974

Request headers

:path: /img/tetrane-small-logo.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Sun, 03 Feb 2019 02:25:15 GMT
server: AmazonS3
x-amz-request-id: VD5QJV5487GYM9ND
etag: "4f5a26a77dba0fad8e94508a8cf3f80e"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=86400,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 1384
x-amz-id-2: DIS6M19oVmOrjLpsdACypjB5PBr5XcRHsulpm6+RMHyuilL1Ap9rd5HnIftdPXxYhbgcOhyP27k=
x-amz-cf-id: 1IM9yCq2mWxBZNC-O547HqSa6ySQS4fylh-d4pNksetdMiklfim1NA==

GET
H2 200 search-white.png
blog.tetrane.com/img/ 3 KB
3 KB 72ms
68ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/img/search-white.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b6620c25c84de48a92136791590d8924b9ca68476a66c40619d5ada678827942

Request headers

:path: /img/search-white.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 13 Apr 2021 07:57:37 GMT
server: AmazonS3
age: 262482
etag: "b2f99c9b30deca11274b194c1264c6e4"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,public
content-length: 3043
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-request-id: WP9824AXF8NMFS7E
x-amz-id-2: BJEdyiucg//ug2ULmTluXB89Co1/CfzUP7v2oR4imYAuxyqnu9lnBE8KTP1H+bRwYnAFFvLl+yc=
x-amz-cf-id: ponguOHclYsQQzzk_1f92-DulQI6El_niA2Wtln3L2OxjwCXDdZOWg==

GET
H2 200 icon-new-tab.png
blog.tetrane.com/img/ 458 B
912 B 37ms
34ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/img/icon-new-tab.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3d6442fe6fc16f7fb00490a5815bdafacec67a21c2d0104f46ba0640e6f4aa32

Request headers

:path: /img/icon-new-tab.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:29:43 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Thu, 07 Nov 2019 18:52:24 GMT
server: AmazonS3
age: 262414
etag: "0e1f099f2ea84e837822f5fdb1c4ec4d"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,public
content-length: 458
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-request-id: F2KEFYGG7ZRMFPY8
x-amz-id-2: GxH9B380o2/oOA3nw3g29QClgvIRhF/P4Z041yiq4RjcQedro7+RzmN/e8Bg3T6gfgHoW68Xzmw=
x-amz-cf-id: cJKj3yKk3Pf7RSPizBfyI02jBkFwWHTJF9CGh8nK8JPDvc0eT5ad8Q==

GET
H2 200 search.png
blog.tetrane.com/img/ 2 KB
2 KB 47ms
43ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/img/search.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b49cb4c96fb40c9f38e069a99305a948cbcea1c0b8717f9b73b14d9e10d20b9d

Request headers

:path: /img/search.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:28:35 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 13 Apr 2021 07:57:36 GMT
server: AmazonS3
age: 262482
etag: "0b69117d86f3145c62ade3c50404119c"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,public
content-length: 1998
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-request-id: WP94KJYPHRRHDT6Q
x-amz-id-2: a+BoNTT3gGjx2MZtMM/bhqHGtRTYuUCuVnUsO/q3hLbzkGiu/dqciAsklj0dk3tz2Hrwt/hfuKI=
x-amz-cf-id: QEgp6JTpp2uV0XJU2ngyKyVW3fv_h5VBj-m3Ko3mj61rMNd2ko2AFw==

GET
H2 200 rss.png
blog.tetrane.com/img/ 488 B
938 B 426ms
422ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/img/rss.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 22ffd7ae4f15862fe559147108766e2903f7ff0a5b440cfd875f091cd13f26bf

Request headers

:path: /img/rss.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Sun, 03 Feb 2019 02:25:15 GMT
server: AmazonS3
x-amz-request-id: JGBBBR2XX1Y7BP7V
etag: "2e7cf9310362b5db7b43db91338a1085"
x-cache: RefreshHit from cloudfront
content-type: image/png
cache-control: max-age=86400,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 488
x-amz-id-2: y5vK4tbuCkdzv4ZAcTGfw4kHtWyHzq/0ASzRvxC/JTmtWTtfSvoRxJbxsvVBwTalOqO23A+VA/g=
x-amz-cf-id: NiFnR6MFks91z_8ok_pLIHWLAyELhqOpN_YK5Es_6smE5OsdS4SsOw==

GET
H2 200 twitter.png
blog.tetrane.com/img/ 440 B
885 B 468ms
464ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/img/twitter.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d52663a67cdd59aed11ae9301416548fb25536cba53d825b1f83410b111b4c35

Request headers

:path: /img/twitter.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Sun, 03 Feb 2019 02:25:15 GMT
server: AmazonS3
x-amz-request-id: VD5QJ4NX3H3R72CB
etag: "ce2730fcbb03349ac39787c9055ba3a2"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=86400,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 440
x-amz-id-2: rpCKsdJZeLRZT1rtqWeF6upb61+Mqx82ZTIU3/RyutXQQyNfdpAwJ4BXsfQVXXZY+cKI/yA0eEA=
x-amz-cf-id: B_Amg4o3FZMvb6ndLQMK829dZ_l4E-2hf73eaF53OjLSwT9hE1fB2A==

GET
H2 200 v3ts9n6s7i.jsonp Show response
fast.wistia.com/embed/medias/ 14 KB
6 KB 167ms
148ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/medias/v3ts9n6s7i.jsonp

Requested by

Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

942668dceb3a483949e0b1988cb8cb66f6e2b99281b4c55ce9066c90551770c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 0
x-cache: MISS, MISS
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
content-length: 5489
x-request-id: 601464e09d05f84ce8b1977720ba3c83
x-served-by: cache-dca17759-DCA, cache-hhn4047-HHN
x-runtime: 0.048048
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-timer: S1625934197.564521,VS0,VE142
etag: W/"942668dceb3a483949e0b1988cb8cb66"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 89
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 0

GET
H2 200 E-v1.js Show response
fast.wistia.com/assets/external/ 598 KB
113 KB 25ms
6ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/E-v1.js

Requested by

Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e8cd762a98dd92841fdedaf79c8c6a13dc64e656b1e592240dd58a47269764bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
vary: Accept-Encoding
age: 2840
x-cache: HIT, HIT
content-length: 115348
x-served-by: cache-dca12922-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934197.564522,VS0,VE0
etag: "60e78edc-1c294"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 495

GET
H2 200 callback_createprocess_search_001_cut_red.png
blog.tetrane.com/images/screenshots_uroburos/ 90 KB
91 KB 31ms
28ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/callback_createprocess_search_001_cut_red.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2131472e28f54787f539468ee63db570a6f544658c5d18b0992bc347c2cce0d4

Request headers

:path: /images/screenshots_uroburos/callback_createprocess_search_001_cut_red.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 22:30:11 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:15 GMT
server: AmazonS3
age: 150786
etag: "2b6d12b1c577d18419e65959b4fe1edf"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,public
content-length: 92132
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-request-id: 9HERDKENAW2NP8E4
x-amz-id-2: qP6Aod+L6mcPRE/FL3vyei6uXzqtCA7D16ZmVumF93jRhD7/vehxIjMbRZmLH7AuVNU7WYAD7AQ=
x-amz-cf-id: 8CB0BB40aWRz4aoNcAALkxi-54vPMss0Y-4diQtoeD57xa9zbReqPA==

GET
H2 200 callback_pssetcreateprocessnotifyroutine_search_001_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 17 KB
17 KB 466ms
462ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/callback_pssetcreateprocessnotifyroutine_search_001_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f8d2cbf94859f574866420106bc95d5e474e1826ee0fe9545fa27b69b1eeeb4a

Request headers

:path: /images/screenshots_uroburos/callback_pssetcreateprocessnotifyroutine_search_001_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:15 GMT
server: AmazonS3
x-amz-request-id: VD5KQ3QVY43TW6CM
etag: "87e938de0785aca7426c1ff504aedc5c"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 17178
x-amz-id-2: ewjMwZ9nr3Hf996nEmtrKHzYUnhJlP8OjnYy4P2potcdpo5aeYvsFa3veX/ONDglKF7NdxvNIRQ=
x-amz-cf-id: _CP1m7P-fbL9bm6FRoYcwQ_iN9y6bzWvU1-MdvSbN8JowuqH6HnnIQ==

GET
H2 200 callback_writeaccess_callback_array_memhist_002_cut_red_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 310 KB
311 KB 466ms
463ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/callback_writeaccess_callback_array_memhist_002_cut_red_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4df5af8a0caeab3228c5a0fa961bb1f411ee448af33a1e157ebd8d686a4924cc

Request headers

:path: /images/screenshots_uroburos/callback_writeaccess_callback_array_memhist_002_cut_red_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:15 GMT
server: AmazonS3
x-amz-request-id: VD5ZDH4MPBEMF84V
etag: "91f1ea300ce3b7cee591cf430cd86a5a"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 317884
x-amz-id-2: AikzxXh+dVX2Fh6jsm7q3xn2HtAN+T9n9pLxDJOhDEDAV3HDDvBQV+4JymUouec+4Jln1uEZFLo=
x-amz-cf-id: kxNio7Kjl1-3V38Qg97RhnJOWYYMiBV11H3cfPc3U60rY0_GkS6W4g==

GET
H2 200 callback_callout_argument_pushed_001_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 26 KB
26 KB 451ms
448ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/callback_callout_argument_pushed_001_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fcb77bd19f9fdb2afbb5123a48f9b6cc05cb2d73ded1512f4e775ba07a90d8c5

Request headers

:path: /images/screenshots_uroburos/callback_callout_argument_pushed_001_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:15 GMT
server: AmazonS3
x-amz-request-id: VD5R6B70AN98ZC1Z
etag: "5de14794a6405058c2a424352e63b758"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 26233
x-amz-id-2: oMNk/0cTkrrGeBMWKk/akbkXExnAJB5Hx6QYvju3eqqVlgV32zf3BENcZFg6Fo++8g8PYk53Otg=
x-amz-cf-id: friBr4wZugfX65k-8LRabH6DOCxLjglyr8jG77aqhnyLWVP5gS-CAA==

GET
H2 200 taint_pssetcreateprocessnotify_memcpy01_001_cut_red_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 109 KB
110 KB 482ms
479ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/taint_pssetcreateprocessnotify_memcpy01_001_cut_red_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2e6abba136acdfffef3d032ea642596c607e1d9f30e116845f95b4b42e57c2be

Request headers

:path: /images/screenshots_uroburos/taint_pssetcreateprocessnotify_memcpy01_001_cut_red_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:16 GMT
server: AmazonS3
x-amz-request-id: VD5QCPP6J0VGKNMZ
etag: "fbf3a5fa4d1ae465210bf6ddd1e14732"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 112116
x-amz-id-2: lrFlh0bImwUhMmTEev0HJ3yrkDqZjht/BFSS3thUCyOuI33BT1GJbYuMAmSNV2xTrWb/eccLyEk=
x-amz-cf-id: ttgJDwInp__TqL0pmZigQVGxbwcE8JHYTv_L-ZW1YEladY_8H8r64Q==

GET
H2 200 taint_pssetcreateprocessnotify_usbehub_001_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 193 KB
194 KB 482ms
479ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/taint_pssetcreateprocessnotify_usbehub_001_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7242efc1aa69d337246aa1d202d6de88390646421d81e068537ae01fe955bbdf

Request headers

:path: /images/screenshots_uroburos/taint_pssetcreateprocessnotify_usbehub_001_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:17 GMT
server: AmazonS3
x-amz-request-id: VD5X6ZRPCGDVY9NX
etag: "5cf4dd902092599aea101cdb22092949"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 197737
x-amz-id-2: 5mKhNuWzP+D+Ia2fssVjE8H4jmIyhEG3bSEOgkUI7N+SktWtIjoli5KyprEFuvkV2P+6fTexhag=
x-amz-cf-id: stP4YdLKl0WJAdkuTUtxV6z24xIrPAy0y0WdGL_6iut7Goq6n5b90w==

GET
H2 200 taint_pssetcreateprocessnotify_memcpy_pxinsi64_002_cut_red_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 250 KB
251 KB 535ms
532ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/taint_pssetcreateprocessnotify_memcpy_pxinsi64_002_cut_red_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c1f5a89bec701ef9dece6b1646c1683449ede6e5cd7d01f6e1606df819b34377

Request headers

:path: /images/screenshots_uroburos/taint_pssetcreateprocessnotify_memcpy_pxinsi64_002_cut_red_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:16 GMT
server: AmazonS3
x-amz-request-id: VD5Y9W6DH5V3RKMQ
etag: "cf5d13848ad5336182af4bbee916f205"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 256384
x-amz-id-2: Vrc5MK34pj/nOtQmJzHZ/uhgRcqljMyt/yQJbS45AnwpyAadVF4GJ8Wj+l/9a1BqK/sYjS8zakI=
x-amz-cf-id: mVX1jzxZldF2XmklNIoFtqSp2bOBy9VxCgJIF1DtHk6Di0si8WYszA==

GET
H2 200 taint_pssetcreateprocessnotify_wololoooo_001_cut_red_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 292 KB
292 KB 513ms
511ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/taint_pssetcreateprocessnotify_wololoooo_001_cut_red_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 252c2996f3f45ab0e84236f775a9ef3b0874186368a5bfae765591db28e464ba

Request headers

:path: /images/screenshots_uroburos/taint_pssetcreateprocessnotify_wololoooo_001_cut_red_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:17 GMT
server: AmazonS3
x-amz-request-id: VD5VAGH6C1P12EH4
etag: "641bf3e4000d7e9ec313ea57587ab1ac"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 298545
x-amz-id-2: FBZoBY/BTNzkihvP2HMdIQ3/wal7t4LMJQIfcEHd585RFxPOqd5HZ68OOEovEfKPcKhZIR0teXU=
x-amz-cf-id: RUUtfqllUVBTOaDq-53CtXlzvVXQA0dR0F8spp-CJD1X_lK9uWOK8A==

GET
H2 200 uroburosdump_MZoverwrite_hexdump_memhist_001_cut_red_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 87 KB
87 KB 513ms
511ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/uroburosdump_MZoverwrite_hexdump_memhist_001_cut_red_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f628e1a047024c13167e22dfa0859e71867ea42b11c102cd481fc8d1407d79f4

Request headers

:path: /images/screenshots_uroburos/uroburosdump_MZoverwrite_hexdump_memhist_001_cut_red_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:17 GMT
server: AmazonS3
x-amz-request-id: VD5K148HA8XDS8QW
etag: "1c2457ec9bc5f2bf33a83d6c380b394b"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 88631
x-amz-id-2: DFPBjRW9bZvCIjk8DC3OKRwxG2tvF+rZL7jRekd1skn9jOGFZUwmC2nIptY1QBdsf/zS4pF6VX8=
x-amz-cf-id: BChCLZGdIh7oVQcQ7qASeiD3v13Ub18P83C9t1d460Il3IkZ80xF2Q==

GET
H2 200 usbehubdump_taint_cidll_001_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 80 KB
81 KB 492ms
490ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/usbehubdump_taint_cidll_001_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f7297ac673c31ade5c42a37f7d321545886cc4bb5364ef0bea4258384a12c0a7

Request headers

:path: /images/screenshots_uroburos/usbehubdump_taint_cidll_001_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:18 GMT
server: AmazonS3
x-amz-request-id: VD5TRB7NZ9XSZQH0
etag: "04057b32227ecdbeb892fd53ba0c29d5"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 82175
x-amz-id-2: rS8MWdpfAQu8uFHuxKjDq7DCQIsrQGQTfoBZ55n//3LsKPsAFdmbLzT/SZTghRArniQUS1LutCw=
x-amz-cf-id: 99FR8M1ovBxSSVMlPjD1GkLpwu3gCPFjJXRo-VsdJ3Pd9Cz6flf0Pw==

GET
H2 200 usbehubdump_kernel32writefile_001_cut_red.png
blog.tetrane.com/images/screenshots_uroburos/ 29 KB
29 KB 450ms
448ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/usbehubdump_kernel32writefile_001_cut_red.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1ffa0dd71aa5a4b259705d54a86e9ac0da0e595f266596274976329a2b3cdaac

Request headers

:path: /images/screenshots_uroburos/usbehubdump_kernel32writefile_001_cut_red.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:17 GMT
server: AmazonS3
x-amz-request-id: VD5Q21T08X5H9V8W
etag: "10d243cad063f83a6e5c1c1b39a5f7a6"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 29563
x-amz-id-2: i++3QInyCPmLZlSwI7g3+dlXEhwKjMudLq1TU9giaKkxB1di3ujfS1i4ouHdvScUXqNHd/QF4zA=
x-amz-cf-id: tSecQRaJVosUCUwQAEq_YATrr5_QS_ToEm8vU5_Nx2c_LqnYMi4XJg==

GET
H2 200 usbehubdump_signeddriver_001_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 12 KB
12 KB 465ms
463ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/usbehubdump_signeddriver_001_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f31774c8b93b9c8ae88ac38dbdde5ceeb2ced6e82ff5df7d2158dfa1143ba03a

Request headers

:path: /images/screenshots_uroburos/usbehubdump_signeddriver_001_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:18 GMT
server: AmazonS3
x-amz-request-id: VD5GY3YEE11X95EK
etag: "b46fd7f85234e70897f9037871b2ddcf"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 11990
x-amz-id-2: tLP9ncoNxD7oI4EqNMJY7J5iFMc2n9O7YUmKY9/QRZ5bRui1bjpi9JeB1JsBgrgsqkHInIeUsrA=
x-amz-cf-id: bfvaoT62kw-d7ysLLFmfb4KvumDRj_N9azzbjFCpJEGvK_RlT9j2Dw==

GET
H2 200 pxinsi64dump_part1_001_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 135 KB
136 KB 481ms
479ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/pxinsi64dump_part1_001_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3ee889acf2eebdd1680e0cbb0e0e2e821cb1815b405cde40eedea6e7c7dc4be0

Request headers

:path: /images/screenshots_uroburos/pxinsi64dump_part1_001_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:15 GMT
server: AmazonS3
x-amz-request-id: VD5G5NPKWG4SYH1N
etag: "079b39239f0592e1e0642429aefd8be8"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 138471
x-amz-id-2: rQIDcmQTAYu/0WaPcSbtxAdqY4MyTQhG1bJgsIdAuUhuu6NyfJwcCzJgDdjeYNDcUkKXHz97lKE=
x-amz-cf-id: hvknt-PSHeFAx-MypqfPe28pSrDu8uhhfTlH2rP7jcyhY596if-kwQ==

GET
H2 200 pxinsi64dump_part1_DeviceIoControl_001_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 40 KB
41 KB 512ms
510ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/pxinsi64dump_part1_DeviceIoControl_001_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3ed006094dc9a86b6e5e78b329d9331fd7e74c523fa1901518291795b6f06878

Request headers

:path: /images/screenshots_uroburos/pxinsi64dump_part1_DeviceIoControl_001_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:15 GMT
server: AmazonS3
x-amz-request-id: VD5RZPRWJJPDCP6A
etag: "47d022778a1d4a293ed713f0572a51c2"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 41362
x-amz-id-2: jkez+surdUhf0TyNkcYdnNHrIQbPpBim0BnBxoYN8hrcIw0g+S8nfwxp5hNlkgNRjQ/Cp9V3dPo=
x-amz-cf-id: iSkhL0yILIsA48O6zmkSxTHnbXDuH7vV0DTrIiUKCYRX_cm7NCz20g==

GET
H2 200 pxinsi64dump_part1_IDA12_cut_red_cut.png
blog.tetrane.com/images/screenshots_uroburos/ 204 KB
205 KB 485ms
483ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/pxinsi64dump_part1_IDA12_cut_red_cut.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0f111b41b55953067f99cecaeb2436e8c5469a70aaf1f79d8a94ddf7eb32bafc

Request headers

:path: /images/screenshots_uroburos/pxinsi64dump_part1_IDA12_cut_red_cut.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:16 GMT
server: AmazonS3
x-amz-request-id: VD5H954FN9A50SV6
etag: "9552fa4eff8cbc7056d6589c32a72284"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 208756
x-amz-id-2: s/qvO3KFtHd0tAQr7a59G1Ph5NVX1VFtoA6pGFkdC67gn6AT4qqWQORCuMPLtWvshysFvJ7EBUY=
x-amz-cf-id: qGk5WaTjm-LpbuCpvRwfeI4eCvcXdOO351hfty7mMhFsBCyPbqQ6Gg==

GET
H2 200 pxinsi64dump_part1_IDA34_cut_red.png
blog.tetrane.com/images/screenshots_uroburos/ 85 KB
86 KB 492ms
490ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/pxinsi64dump_part1_IDA34_cut_red.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 94ad2bab0b86e0b8af7b838d141d29eeeef1cad347c05d5bc7bbe538ac411c06

Request headers

:path: /images/screenshots_uroburos/pxinsi64dump_part1_IDA34_cut_red.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:16 GMT
server: AmazonS3
x-amz-request-id: VD5VJRZWRYKZH60A
etag: "6808f1eb09729a8159a80fc57d361f61"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 86996
x-amz-id-2: 2YbzyiYzpSOXRCpyIeDlgl9k27XhYCi3x0ihanyOp/zNbyqzUMWJOGSfLlP0KEa9mYGOG4FYOJw=
x-amz-cf-id: C_Mi_ePzd8S43UFqySKrIvgnpVYtGwu12Z9TG09LnCsbr5Z2b33L5g==

GET
H2 200 pxinsi64dump_part1_IDA56_cut_red.png
blog.tetrane.com/images/screenshots_uroburos/ 122 KB
123 KB 641ms
639ms Image
image/png 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.tetrane.com/images/screenshots_uroburos/pxinsi64dump_part1_IDA56_cut_red.png
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27b6dba6bcc39f8025fa3ac8b2660810a8ff8b7dd726385524d5016a6b6fb079

Request headers

:path: /images/screenshots_uroburos/pxinsi64dump_part1_IDA56_cut_red.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:18 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
last-modified: Tue, 21 May 2019 00:10:16 GMT
server: AmazonS3
x-amz-request-id: P76JH1KNRT3ZQGEC
etag: "c55d76ee8af48818e1f72a514bdb11b2"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 124996
x-amz-id-2: 7hAG/EwxxmyMmZD960yKiYn+cZEnA7plX3/8ejXELCZjfZOsKe2rqBjHQB+/uSyV0PstFlTfuoU=
x-amz-cf-id: MdY5Xp2yldC-4Ocwazdg9DPwW8_PWfoRYJFDClyYdCq1IsGg5qGP6w==

GET
H2 200 transition.js Show response
blog.tetrane.com/js/ 2 KB
1 KB 26ms
26ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/transition.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 59789a7abcff96a1615a74c47c047bcb0b689859cf3af48c25a5f6f7128d5c2a

Request headers

:path: /js/transition.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:16 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:37 GMT
server: AmazonS3
age: 262741
etag: W/"db7d039381f3a80c478fb67652c30155"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: R1T8KC3J9B0JW72R
x-amz-cf-id: D5nYviKv9opGfiUBCbB8xbY8bVHzmI1Q1ZBxw6kgPuHe61mhCsz7rQ==
x-amz-id-2: MUAf1wrUEcq3JdjQtrvLEXqmwv040fA7WwxC42fGLWFWctoCP58cXirW5OW6dsIdCwWsq8vnTVk=

GET
H2 200 zoom.js Show response
blog.tetrane.com/js/ 8 KB
3 KB 34ms
34ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/zoom.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2a304facff10412c468c60aa1d2a476fe69a822957ef6c4755dac690f7560e2e

Request headers

:path: /js/zoom.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:17 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:37 GMT
server: AmazonS3
age: 262740
etag: W/"89b21982398deafa535741491c236f8b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: ZHXGHG3DMKYAGVB8
x-amz-cf-id: 587YXOUbDzOf96apVmB9Fo6HApLcux6dFDFYfRcJavoZL_NXw4eRKw==
x-amz-id-2: 1SRF24ffW/BIIs4V/gASbIwzuLfT7TWpQieI+Yy56VbjL/n5v5uBRy+ZEUre6vDJrpUBnsTYEAA=

GET
H2 200 bootstrap.min.js Show response
blog.tetrane.com/js/ 36 KB
10 KB 21ms
21ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/bootstrap.min.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a

Request headers

:path: /js/bootstrap.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:18 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:36 GMT
server: AmazonS3
age: 262739
etag: W/"c5b5b2fa19bd66ff23211d9f844e0131"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: BSBRCRPE9TRHFCSM
x-amz-cf-id: ESptNplJXvXzwhmxma3wFn-KgI092SuAB303tK41rERBHS4WEya24A==
x-amz-id-2: 4FY0xAI+t0uWf1ZTvh7tcnMGxyAGjJf/69ryb11g+CAS5VfvvAjvxpkmmBSzXygKnZ1McUe2aRw=

GET
H2 200 jquery.cookie.js Show response
blog.tetrane.com/js/ 3 KB
2 KB 24ms
24ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/jquery.cookie.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: afd6a5f6de40e9e67b55ff6afec66fff4827e775c996ab80c9e964a872a92523

Request headers

:path: /js/jquery.cookie.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:19 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:36 GMT
server: AmazonS3
age: 262738
etag: W/"a79ce0f6eed17894a3d9b854fe700461"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: EXK4JKP8CB3RBDFX
x-amz-cf-id: VXN08deBrbNZikSzVBIKgX4zQ33FCXt8AKWvrxY7MgKQSMXCfC8EYg==
x-amz-id-2: tG+3wypiaehXiPuW/b046tt3l5+GQ7P0q3tbMamJfF2pZaY+Kiwm+5NfQ8ZNiaHLbb1kc9DOnzw=

GET
H2 200 ekko-lightbox.js Show response
blog.tetrane.com/js/ 16 KB
4 KB 29ms
28ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/ekko-lightbox.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8e5d44a1aec810d1b071aee410fe7cd692f7516e140a86b92a6cb1fe5576a403

Request headers

:path: /js/ekko-lightbox.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:20 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:36 GMT
server: AmazonS3
age: 262737
etag: W/"cadc5d59062ffc7aaea3c250482d24d3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: DZ5E0X0HQ4AKJWYA
x-amz-cf-id: Ewc1-qsCm5DTTS8hHFd1YMDmJtl9znyN9gAPVj3STy3NvINwrduwxg==
x-amz-id-2: Ow0nnwwPljTSmvvD/GJYIsDBj7DU+MM/9Y6zSDrXJQaG/Hg59Ycfu+UPtsc1+EFddfJisBr837Q=

GET
H2 200 jquery.simple-text-rotator.min.js Show response
blog.tetrane.com/js/ 3 KB
1 KB 29ms
28ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/jquery.simple-text-rotator.min.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4700acbf4c43e6decb3ce5b5e3927f2cf90cb04916a10e1211562737dfdd956c

Request headers

:path: /js/jquery.simple-text-rotator.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:21 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:36 GMT
server: AmazonS3
age: 262736
etag: W/"71ea2390cbfaa65089328b13d56a049c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: 31RR5JTEJGG4M81S
x-amz-cf-id: 9vW1jBYFqVJB2k0A9hwqGQV97e_JNfZJcALyRorExBvf45HLoVneMA==
x-amz-id-2: yX9DXJS7ELkbRz2xf0VhQw3ZODfWmma+as6B65YAFczrfCmkfXkidHHV/eu2h5ECG7ZMbezsGh4=

GET
H2 200 jquery.scrollTo.min.js Show response
blog.tetrane.com/js/ 2 KB
2 KB 30ms
26ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/jquery.scrollTo.min.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ed04b5707b07ef987720582b14ab1d8662871e95aa17cdac6fff6f34ba9caacd

Request headers

:path: /js/jquery.scrollTo.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:17 GMT
content-encoding: gzip
last-modified: Sun, 03 Feb 2019 23:36:36 GMT
server: AmazonS3
age: 262740
etag: W/"4f3d9d7281a2828e319de38b9142f860"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: ZHXNNZEDQFDY8EF3
x-amz-cf-id: Ozwn-TNxexTUSTiNrFpbIOg3nWeEGZuN5PCPbC3YlX-R-vFTriuBxw==
x-amz-id-2: +xRqLJ8ek1UmmHWnoRxdtsLQLtx7fke48crU1JjPVh/J9VlLFRGk+0lTtvbjSzMduebk3uaONns=

GET
H2 200 front.js Show response
blog.tetrane.com/js/ 10 KB
3 KB 28ms
24ms Script
application/javascript 2600:9000:20eb:3800:b:dcf1:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.tetrane.com/js/front.js
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3800:b:dcf1:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ebafd0f3b94620d20556480d4036b121e3b864ee126c4828fcd210ff2802f33e

Request headers

:path: /js/front.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.tetrane.com
referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:24:18 GMT
content-encoding: gzip
last-modified: Thu, 07 Nov 2019 18:52:25 GMT
server: AmazonS3
age: 262739
etag: W/"913d0e50c95bd46ebf185edc9c10b4d3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
cache-control: max-age=604800,public
x-amz-cf-pop: FRA2-C1
x-amz-request-id: BSBSY4Z5XC5DHX97
x-amz-cf-id: _szSsqTQV0-OO1byfgBq7r2gk6reli619xu1RrLnhSsSwyQELiv0DQ==
x-amz-id-2: WdHmU627TpQD8AsEgJlXufJ2kVs3P07+85Q3oM9gsWE4G6z6igrxSiOSSFany2cMWCuMd3ZAMoI=

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-25617784-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 3451
date: Sat, 10 Jul 2021 15:25:45 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Sat, 10 Jul 2021 17:25:45 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,300,700,800,400italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.tetrane.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 23:06:01 GMT
x-content-type-options: nosniff
age: 407835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15112
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 23:06:01 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v20/ 14 KB
14 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,300,700,800,400italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.tetrane.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 11:17:37 GMT
x-content-type-options: nosniff
age: 363939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:19 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Jul 2022 11:17:37 GMT

GET
H2 200 mem6YaGs126MiZpBA-UFUK0Zdc0.woff2
fonts.gstatic.com/s/opensans/v20/ 13 KB
14 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem6YaGs126MiZpBA-UFUK0Zdc0.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,300,700,800,400italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa4607112a6b3245394fee13973cf8cf8a22b727f919f60636436a945886005b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.tetrane.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 10:54:23 GMT
x-content-type-options: nosniff
age: 365333
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13792
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:17 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Jul 2022 10:54:23 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 27ms
13ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1657284206&t=pageview&_s=1&dl=https%3A%2F%2Fblog.tetrane.com%2F2019%2FAnalysis-Uroburos-Malware-REVEN.html&ul=en-us&de=UTF-8&dt=Tetrane%20-%20Automated%20Reverse%20Engineering%20Platform&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=348320804&gjid=1559968341&cid=1044340230.1625934197&tid=UA-25617784-1&_gid=1807788089.1625934197&_r=1&gtm=2ou770&z=2015849297

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 10 Jul 2021 16:23:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.tetrane.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 popover.js Show response
fast.wistia.com/assets/external/ 198 KB
41 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/popover.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f0bd9e3a2fb1861951048e7da6367e06a42f9b28b0fc424d935c54a5c2591fe5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
vary: Accept-Encoding
age: 2838
x-cache: HIT, HIT
content-length: 41847
x-served-by: cache-dca17750-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934197.857081,VS0,VE0
etag: "60e78edc-a377"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 43

GET
H2 200 wistia-mux.js Show response
fast.wistia.com/assets/external/ 92 KB
24 KB 9ms
9ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/wistia-mux.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6e1b1e3c604972c779dcc1149be5533d0f9d80c963112e41cdc3d161f7665313

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
vary: Accept-Encoding
age: 2839
x-cache: HIT, HIT
content-length: 24741
x-served-by: cache-dca17767-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934197.857126,VS0,VE0
etag: "60e78edc-60a5"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 202

GET
H2 200 postRoll-v2.js Show response
fast.wistia.com/assets/external/ 57 KB
12 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/postRoll-v2.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

39ee05cd76c42ba72df2047a96cd18edfc53c6648fabe61da41fd043e74105f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
vary: Accept-Encoding
age: 2835
x-cache: HIT, HIT
content-length: 12544
x-served-by: cache-dca17748-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934197.908838,VS0,VE0
etag: "60e78edc-3100"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 15

GET
H2 200 captions.js Show response
fast.wistia.com/assets/external/ 162 KB
27 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/captions.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

563d90a3cad00e7333e30fe2871a566a484af588f5c39cbfca08667b6138c0c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
vary: Accept-Encoding
age: 2839
x-cache: HIT, HIT
content-length: 27303
x-served-by: cache-dca17741-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934197.908929,VS0,VE0
etag: "60e78edc-6aa7"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 48

GET
H2 200 OverlaysBehavior.js Show response
fast.wistia.com/assets/external/vulcanV2Player/behaviors/ 70 KB
15 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/vulcanV2Player/behaviors/OverlaysBehavior.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9648d757830e7a5547731e162c059388e6323f7afdf2d58f533de0be36567c6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:16 GMT
content-encoding: br
vary: Accept-Encoding
age: 2836
x-cache: HIT, HIT
content-length: 15280
x-served-by: cache-dca17770-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934197.939044,VS0,VE0
etag: "60e78edc-3bb0"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 27

GET
H2 200 v3ts9n6s7i.json Show response
fast.wistia.com/embed/captions/ 14 KB
6 KB 115ms
115ms Script
text/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/captions/v3ts9n6s7i.json?callback=wistiajson1

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c27bb10f5f465bd8f53be71d5fb48619491a12d526622390efc2b728689f4b02

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
content-encoding: br
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 0
x-cache: MISS, MISS
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,Accept-Language
content-length: 5231
x-request-id: 9a2b4e97b330a79e03c3aacd8b6bd953
x-served-by: cache-dca17735-DCA, cache-hhn4047-HHN
x-runtime: 0.014095
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-timer: S1625934197.939752,VS0,VE109
etag: W/"c27bb10f5f465bd8f53be71d5fb48619"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/javascript; charset=utf-8
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 89
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 0

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe2d7250cc0730dc655721c5fa4bf5236dcabdf57f8593e8fe2096a42c0c8baf

Request headers

Origin: https://blog.tetrane.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H/1.1 200
OK cf38cb12a23f3fe55bfacffca3b72051.webp
embedwistia-a.akamaihd.net/deliveries/ 30 KB
31 KB 926ms
909ms Image
image/webp 2.16.186.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embedwistia-a.akamaihd.net/deliveries/cf38cb12a23f3fe55bfacffca3b72051.webp?image_crop_resized=1920x1080
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fc7a910d4b88b8a04822f1ef8e80f8afa8263ffb8ef946b2cfa7a97d414305ed

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Jul 2021 16:23:17 GMT
Access-Control-Request-Method: *
surrogate-key: cf38cb12a23f3fe55bfacffca3b72051 thumbnail-delivery
Last-Modified: Sat, 21 Dec 2019 11:34:05 UTC
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: image/webp
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Origin, Content-Type, Accept, Server, x-amz-version-id, X-Cache
Cache-Control: max-age=31258339
content-disposition: inline
Connection: keep-alive
Accept-Ranges: none
Content-Length: 31020

GET
H/1.1 200
OK cf38cb12a23f3fe55bfacffca3b72051.webp
embedwistia-a.akamaihd.net/deliveries/ 9 KB
10 KB 547ms
534ms Image
image/webp 2.16.186.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embedwistia-a.akamaihd.net/deliveries/cf38cb12a23f3fe55bfacffca3b72051.webp?image_crop_resized=640x360
Requested by: Host: blog.tetrane.com
URL: https://blog.tetrane.com/2019/Analysis-Uroburos-Malware-REVEN.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 712d7410484c11c78c98b3edb65b927bf9801d783bda697e9e57638419a1249a

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Jul 2021 16:23:17 GMT
Access-Control-Request-Method: *
surrogate-key: cf38cb12a23f3fe55bfacffca3b72051 thumbnail-delivery
Last-Modified: Sat, 21 Dec 2019 11:34:05 UTC
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: image/webp
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Origin, Content-Type, Accept, Server, x-amz-version-id, X-Cache
Cache-Control: max-age=31536000
content-disposition: inline
Connection: keep-alive
Accept-Ranges: none
Content-Length: 9530

GET
DATA 200
OK truncated
/ 241 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c4ca229b8313d7625b61ab2a711c5f7b6ff025ee87f8620187d4c5b1ebac57d2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 playPauseLoadingControl.js Show response
fast.wistia.com/assets/external/ 59 KB
13 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/playPauseLoadingControl.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7b923ac810a4f853fdd1263525e2a89aa55dac196445a270b5acd311ba427487

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:17 GMT
content-encoding: br
vary: Accept-Encoding
age: 2840
x-cache: HIT, HIT
content-length: 12667
x-served-by: cache-dca17733-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934198.996070,VS0,VE0
etag: "60e78edc-317b"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 293

GET
H2 200 hls_video.js Show response
fast.wistia.com/assets/external/engines/ 346 KB
82 KB 7ms
7ms Script
application/javascript 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/engines/hls_video.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

31c25b7ad946267adfb9a574e60d6560970b2726d94a624b9de817792c439cc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:18 GMT
content-encoding: br
vary: Accept-Encoding
age: 2840
x-cache: HIT, HIT
content-length: 83500
x-served-by: cache-dca17763-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
x-browser-version: 89
last-modified: Thu, 08 Jul 2021 23:48:44 GMT
x-timer: S1625934198.000242,VS0,VE0
etag: "60e78edc-1462c"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 201

GET
H2 200 blank.gif
fast.wistia.com/assets/images/ 1 KB
2 KB 21ms
6ms Image
image/gif 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.com/assets/images/blank.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Origin: https://blog.tetrane.com
Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:18 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
age: 82042
x-cache: HIT, HIT
x-cache-hits: 2, 6209
content-length: 1214
x-served-by: cache-dca17727-DCA, cache-hhn4082-HHN
x-browser-version: 89
last-modified: Fri, 09 Jul 2021 17:33:46 GMT
x-timer: S1625934198.064974,VS0,VE0
etag: "60e8887a-4be"
strict-transport-security: max-age=0
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=315360000, public
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 v3ts9n6s7i.vtt
fast.wistia.net/embed/captions/ 13 KB
13 KB 130ms
114ms TextTrack
text/vtt 2a04:4e42:1b::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/embed/captions/v3ts9n6s7i.vtt?language=eng

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

062b25afa45dd58ba30e854defaffea0d2fdc4916aa5a65058a6ab91e3026e1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Origin: https://blog.tetrane.com
Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 16:23:18 GMT
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 0
x-cache: MISS, MISS
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,Accept-Language
content-length: 12998
x-request-id: 80eedcaf37baaa0ee86eb967b2a58daa
x-served-by: cache-dca17758-DCA, cache-hhn4062-HHN
x-runtime: 0.009277
referrer-policy: strict-origin-when-cross-origin
x-timer: S1625934198.073784,VS0,VE108
etag: W/"062b25afa45dd58ba30e854defaffea0"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/vtt; charset=utf-8
access-control-allow-origin: *
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 89
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 0

GET
H/1.1 200
OK f4129a3be1209b7b3f6d786c5f9842aa10559a4c.m3u8 Show response
embedwistia-a.akamaihd.net/deliveries/ 29 KB
30 KB 367ms
354ms XHR
application/vnd.apple.mpegurl 2.16.186.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://embedwistia-a.akamaihd.net/deliveries/f4129a3be1209b7b3f6d786c5f9842aa10559a4c.m3u8
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/engines/hls_video.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a76ffaae78a1ec599dddc124069996070a1d4be080acff8351794539087426ff

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Jul 2021 16:23:18 GMT
Access-Control-Request-Method: *
surrogate-key: f4129a3be1209b7b3f6d786c5f9842aa10559a4c hls-segment
Last-Modified: Mon, 05 Nov 2018 10:11:00 GMT
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: application/vnd.apple.mpegurl
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Server,range,Content-Length,Content-Range
Cache-Control: max-age=31535962
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 30088
Expires: Sun, 10 Jul 2022 16:22:40 GMT

POST
H2 204 x Show response
distillery.wistia.com/ 0
96 B 305ms
98ms XHR
text/plain 52.87.45.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://distillery.wistia.com/x
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.87.45.133 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-87-45-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Sat, 10 Jul 2021 16:23:18 GMT
cache-control: max-age=0, private, must-revalidate

GET
H/1.1 200
OK seg-1-v1-a1.ts Show response
embedwistia-a.akamaihd.net/deliveries/f4129a3be1209b7b3f6d786c5f9842aa10559a4c.m3u8/ 97 KB
98 KB 279ms
279ms XHR
video/mp2t 2.16.186.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://embedwistia-a.akamaihd.net/deliveries/f4129a3be1209b7b3f6d786c5f9842aa10559a4c.m3u8/seg-1-v1-a1.ts
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/engines/hls_video.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a032cc750bc9f3cd54609c5f999f39553d26b7d8045fe3835633189a73ef8c32

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Jul 2021 16:23:18 GMT
Access-Control-Request-Method: *
surrogate-key: f4129a3be1209b7b3f6d786c5f9842aa10559a4c hls-segment
Last-Modified: Mon, 05 Nov 2018 10:11:00 GMT
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: video/MP2T
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Server,range,Content-Length,Content-Range
Cache-Control: max-age=31535996
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 99640
Expires: Sun, 10 Jul 2022 16:23:14 GMT

POST
H2 200 mput Show response
pipedream.wistia.com/ 2 B
136 B 289ms
95ms XHR
text/plain 52.6.75.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pipedream.wistia.com/mput?topic=metrics
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.6.75.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-75-166.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Sat, 10 Jul 2021 16:23:18 GMT
content-length: 2
access-control-allow-methods: POST, OPTIONS
content-type: text/plain; charset=utf-8

POST
H/1.1 200
OK / Show response
fg8vvsvnieiv3ej16jby.litix.io/ 0
172 B 94ms
93ms XHR
text/plain 50.16.76.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fg8vvsvnieiv3ej16jby.litix.io/
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/wistia-mux.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.76.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-76-135.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.tetrane.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: *
Date: Sat, 10 Jul 2021 16:23:23 GMT
Connection: keep-alive
Content-Length: 0
Access-Control-Allow-Methods: POST, GET

OPTIONS
H/1.1 200
OK /
fg8vvsvnieiv3ej16jby.litix.io/ 0
0 386ms
93ms Preflight 50.16.76.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fg8vvsvnieiv3ej16jby.litix.io/
Protocol: HTTP/1.1
Server: 50.16.76.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-76-135.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://blog.tetrane.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: POST, GET
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
Date: Sat, 10 Jul 2021 16:23:23 GMT
Content-Length: 0
Connection: keep-alive

Verdicts & Comments Add Verdict or Comment

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.tetrane.com/	1970-01-19 19:38:54	Name: _gat_gtag_UA_25617784_1 Value: 1
.tetrane.com/	1970-01-19 19:40:20	Name: _gid Value: GA1.2.1807788089.1625934197
.tetrane.com/	1970-01-20 13:10:06	Name: _ga Value: GA1.2.1044340230.1625934197
blog.tetrane.com/2019	1969-12-31 23:59:59	Name: loglevel Value: WARN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
assets.calendly.com
blog.tetrane.com
distillery.wistia.com
embedwistia-a.akamaihd.net
fast.wistia.com
fast.wistia.net
fg8vvsvnieiv3ej16jby.litix.io
fonts.googleapis.com
fonts.gstatic.com
pipedream.wistia.com
www.google-analytics.com
www.googletagmanager.com
2.16.186.18
2600:9000:20eb:3800:b:dcf1:9140:93a1
2600:9000:2156:5200:d:1c5c:fb80:93a1
2a00:1450:4001:808::200e
2a00:1450:4001:810::200a
2a00:1450:4001:812::2008
2a00:1450:4001:82f::200a
2a00:1450:4001:830::2003
2a04:4e42:1b::622
50.16.76.135
52.6.75.166
52.87.45.133
02ec511a4d26d09eff6af15d81b01dab30bd691fc00836d9a3b89a906f975d34
03eb9f536c83b4a568844e5dd5d758b79201696c112f9e7e1a7a55877d4395ba
062b25afa45dd58ba30e854defaffea0d2fdc4916aa5a65058a6ab91e3026e1a
0b8bea3d419b058fa9445b470e15f960abbaa19537bd84a09ef8a5ed9108e9c8
0f111b41b55953067f99cecaeb2436e8c5469a70aaf1f79d8a94ddf7eb32bafc
0fc1da46fb87c7798d990a8b70bfad094886aa232a591cb34a83007a04a78ae8
1ffa0dd71aa5a4b259705d54a86e9ac0da0e595f266596274976329a2b3cdaac
2131472e28f54787f539468ee63db570a6f544658c5d18b0992bc347c2cce0d4
22ffd7ae4f15862fe559147108766e2903f7ff0a5b440cfd875f091cd13f26bf
252c2996f3f45ab0e84236f775a9ef3b0874186368a5bfae765591db28e464ba
27b6dba6bcc39f8025fa3ac8b2660810a8ff8b7dd726385524d5016a6b6fb079
2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a
2a304facff10412c468c60aa1d2a476fe69a822957ef6c4755dac690f7560e2e
2b80e4c11c367db768ff06716ce027e87db54cd4132fd75891646a9407a453ea
2e6abba136acdfffef3d032ea642596c607e1d9f30e116845f95b4b42e57c2be
313ca6062a2ac35e34f6e965cb8f8a2be7aad111edb628faf1b03f7e43889a39
31c25b7ad946267adfb9a574e60d6560970b2726d94a624b9de817792c439cc9
39ee05cd76c42ba72df2047a96cd18edfc53c6648fabe61da41fd043e74105f7
3d6442fe6fc16f7fb00490a5815bdafacec67a21c2d0104f46ba0640e6f4aa32
3ed006094dc9a86b6e5e78b329d9331fd7e74c523fa1901518291795b6f06878
3ee889acf2eebdd1680e0cbb0e0e2e821cb1815b405cde40eedea6e7c7dc4be0
3ef1f35dba8c73d124c0b01211f4da3277c39f1ad2f25d02f4beb62c876e215e
4449fad78178dd923da79352e7a6c2f0d41c7f37ee67ff93a32a9f34097912ae
4700acbf4c43e6decb3ce5b5e3927f2cf90cb04916a10e1211562737dfdd956c
4df5af8a0caeab3228c5a0fa961bb1f411ee448af33a1e157ebd8d686a4924cc
53beddc6617675473a3802447767b2e3dd3c987947c6485e1da5797f01f8a374
55328bc94879bc6e36b31bb507cbec38afba680a17f0be5a23f8e533f8403974
563d90a3cad00e7333e30fe2871a566a484af588f5c39cbfca08667b6138c0c0
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
59789a7abcff96a1615a74c47c047bcb0b689859cf3af48c25a5f6f7128d5c2a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e1b1e3c604972c779dcc1149be5533d0f9d80c963112e41cdc3d161f7665313
712d7410484c11c78c98b3edb65b927bf9801d783bda697e9e57638419a1249a
7242efc1aa69d337246aa1d202d6de88390646421d81e068537ae01fe955bbdf
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
7b923ac810a4f853fdd1263525e2a89aa55dac196445a270b5acd311ba427487
8e5d44a1aec810d1b071aee410fe7cd692f7516e140a86b92a6cb1fe5576a403
936c090055735dffce05f41f859aa784869e50201fc9422fd22c3f4ceb1f88a3
942668dceb3a483949e0b1988cb8cb66f6e2b99281b4c55ce9066c90551770c7
94ad2bab0b86e0b8af7b838d141d29eeeef1cad347c05d5bc7bbe538ac411c06
9648d757830e7a5547731e162c059388e6323f7afdf2d58f533de0be36567c6d
9e59523346aa69ff21ad2b23ef555cf7059c78378faaf886f0f6af4b7ba47f67
a032cc750bc9f3cd54609c5f999f39553d26b7d8045fe3835633189a73ef8c32
a426c9d5990240e51a6683d7da2c7787ef1cf5426d0a531840390fc94b34c01c
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a76ffaae78a1ec599dddc124069996070a1d4be080acff8351794539087426ff
a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2
aa4607112a6b3245394fee13973cf8cf8a22b727f919f60636436a945886005b
afd6a5f6de40e9e67b55ff6afec66fff4827e775c996ab80c9e964a872a92523
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b49cb4c96fb40c9f38e069a99305a948cbcea1c0b8717f9b73b14d9e10d20b9d
b6620c25c84de48a92136791590d8924b9ca68476a66c40619d5ada678827942
c1f5a89bec701ef9dece6b1646c1683449ede6e5cd7d01f6e1606df819b34377
c234008dd16f9be0fd67752fab36832e286887f07ba5fd1dcda9f4b42ec4fe08
c27bb10f5f465bd8f53be71d5fb48619491a12d526622390efc2b728689f4b02
c4ca229b8313d7625b61ab2a711c5f7b6ff025ee87f8620187d4c5b1ebac57d2
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
d1ce0c9a83b58b6ef41a618378dbddfb913ad2434a9e1dfeb030b8687c4895ad
d52663a67cdd59aed11ae9301416548fb25536cba53d825b1f83410b111b4c35
da912b0912c29c410c92ba7e406d21b38655015ae64853919b477140cb894f43
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8cd762a98dd92841fdedaf79c8c6a13dc64e656b1e592240dd58a47269764bb
ebafd0f3b94620d20556480d4036b121e3b864ee126c4828fcd210ff2802f33e
ed04b5707b07ef987720582b14ab1d8662871e95aa17cdac6fff6f34ba9caacd
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
f0bd9e3a2fb1861951048e7da6367e06a42f9b28b0fc424d935c54a5c2591fe5
f31774c8b93b9c8ae88ac38dbdde5ceeb2ced6e82ff5df7d2158dfa1143ba03a
f628e1a047024c13167e22dfa0859e71867ea42b11c102cd481fc8d1407d79f4
f7297ac673c31ade5c42a37f7d321545886cc4bb5364ef0bea4258384a12c0a7
f8d2cbf94859f574866420106bc95d5e474e1826ee0fe9545fa27b69b1eeeb4a
fc7a910d4b88b8a04822f1ef8e80f8afa8263ffb8ef946b2cfa7a97d414305ed
fcb77bd19f9fdb2afbb5123a48f9b6cc05cb2d73ded1512f4e775ba07a90d8c5
fe2d7250cc0730dc655721c5fa4bf5236dcabdf57f8593e8fe2096a42c0c8baf

blog.tetrane.com Open in urlscan Pro 2600:9000:20eb:3800:b:dcf1:9140:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

73 Requests

100 %HTTPS

67 %IPv6

10 Domains

13 Subdomains

13 IPs

2 Countries

2867 kBTransfer

4565 kBSize

4 Cookies

19 Outgoing links

Redirected requests

73 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.tetrane.com Open in urlscan Pro
2600:9000:20eb:3800:b:dcf1:9140:93a1 Public Scan

Screenshot
Live screenshot

Full Image

73
Requests

100 %
HTTPS

67 %
IPv6

10
Domains

13
Subdomains

13
IPs

2
Countries

2867 kB
Transfer

4565 kB
Size

4
Cookies

73 HTTP transactions
2 data transactions