URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Submission: On August 31 via api from US — Scanned from DE

Summary

This website contacted 46 IPs in 6 countries across 35 domains to perform 149 HTTP transactions. The main IP is 104.198.136.223, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is redcanary.com. The Cisco Umbrella rank of the primary domain is 439602.
TLS certificate: Issued by R3 on July 24th 2023. Valid for: 3 months.
This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
28 104.198.136.223 396982 (GOOGLE-CL...)
1 2a00:1450:400... 15169 (GOOGLE)
2 104.17.71.206 13335 (CLOUDFLAR...)
5 152.195.15.58 15133 (EDGECAST)
6 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
6 2606:4700::68... 13335 (CLOUDFLAR...)
2 104.64.124.188 16625 (AKAMAI-AS)
12 2.20.142.65 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2600:1901:1:c... 15169 (GOOGLE)
1 192.28.147.68 15224 (OMNITURE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.92.152.120 16509 (AMAZON-02)
1 146.75.116.157 54113 (FASTLY)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2a04:4e42:200... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 185.89.210.212 29990 (ASN-APPNEX)
1 2600:9000:20c... 16509 (AMAZON-02)
18 2a04:4e42:8d:... 54113 (FASTLY)
1 104.244.42.69 13414 (TWITTER)
1 104.244.42.3 13414 (TWITTER)
1 151.101.1.140 54113 (FASTLY)
1 2a04:4e42:8d:... 54113 (FASTLY)
3 2a02:26f0:280... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
2 2600:1901:0:5... 15169 (GOOGLE)
1 2600:9000:26d... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
2 2a03:2880:f17... 32934 (FACEBOOK)
8 2600:1901:1:81:: 15169 (GOOGLE)
1 52.18.119.10 16509 (AMAZON-02)
2 2a02:26f0:e30... 20940 (AKAMAI-ASN1)
1 52.204.253.158 14618 (AMAZON-AES)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 35.186.247.156 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 52.58.204.254 16509 (AMAZON-02)
2 54.231.132.250 16509 (AMAZON-02)
149 46
Apex Domain
Subdomains
Transfer
30 redcanary.com
redcanary.com — Cisco Umbrella Rank: 439602
resource.redcanary.com — Cisco Umbrella Rank: 731005
2 MB
18 spotifycdn.com
embed-cdn.spotifycdn.com — Cisco Umbrella Rank: 13792
543 KB
14 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5691
c.6sc.co — Cisco Umbrella Rank: 8562
ipv6.6sc.co — Cisco Umbrella Rank: 5947
b.6sc.co — Cisco Umbrella Rank: 3992
38 KB
12 spotify.com
open.spotify.com — Cisco Umbrella Rank: 3592
apresolve.spotify.com — Cisco Umbrella Rank: 898
gew4-spclient.spotify.com — Cisco Umbrella Rank: 9281
6 KB
9 qualified.com
js.qualified.com — Cisco Umbrella Rank: 20853
app.qualified.com — Cisco Umbrella Rank: 21652
assets.qualified.com — Cisco Umbrella Rank: 22975
832 KB
7 crazyegg.com
script.crazyegg.com — Cisco Umbrella Rank: 2237
tracking.crazyegg.com — Cisco Umbrella Rank: 4119
75 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 365
www.linkedin.com — Cisco Umbrella Rank: 625
px4.ads.linkedin.com — Cisco Umbrella Rank: 6371
5 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
69 KB
4 scdn.co
i.scdn.co — Cisco Umbrella Rank: 1328
encore.scdn.co — Cisco Umbrella Rank: 6604
288 KB
4 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3238
www.google.com — Cisco Umbrella Rank: 2
868 B
4 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 6623
26 KB
3 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 450
2 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 374
13 KB
3 amazonaws.com
s3-us-west-2.amazonaws.com
qualified-production.s3.us-east-1.amazonaws.com — Cisco Umbrella Rank: 29787
67 KB
3 google.gr
www.google.gr — Cisco Umbrella Rank: 24686
625 B
3 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 87
googleads.g.doubleclick.net — Cisco Umbrella Rank: 40
2 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9384
578 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 109
232 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 169
87 KB
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 760
6 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
34 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3330
7 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 47
189 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 368
fonts.googleapis.com — Cisco Umbrella Rank: 41
32 KB
1 sentry.io
sentry.io — Cisco Umbrella Rank: 177
324 B
1 bizibly.com
cdn.bizibly.com — Cisco Umbrella Rank: 12180
328 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 881
376 B
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1523
637 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 742
396 B
1 t.co
t.co — Cisco Umbrella Rank: 577
377 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 20509
234 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 16560
278 B
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1344
8 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 758
15 KB
1 mktoresp.com
003-yru-314.mktoresp.com
318 B
149 35
Domain Requested by
28 redcanary.com redcanary.com
18 embed-cdn.spotifycdn.com open.spotify.com
embed-cdn.spotifycdn.com
8 gew4-spclient.spotify.com embed-cdn.spotifycdn.com
7 b.6sc.co
7 assets.qualified.com redcanary.com
app.qualified.com
6 script.crazyegg.com redcanary.com
script.crazyegg.com
4 www.google-analytics.com www.googletagmanager.com
cdn.bizible.com
4 cdn.bizible.com redcanary.com
cdn.bizible.com
3 px.ads.linkedin.com 3 redirects
3 encore.scdn.co embed-cdn.spotifycdn.com
3 secure.adnxs.com 2 redirects cdn.bizible.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
redcanary.com
3 www.google.gr redcanary.com
3 j.6sc.co redcanary.com
www.googletagmanager.com
j.6sc.co
2 qualified-production.s3.us-east-1.amazonaws.com
2 epsilon.6sense.com cdn.bizible.com
2 ipv6.6sc.co cdn.bizible.com
2 c.6sc.co cdn.bizible.com
2 www.facebook.com redcanary.com
2 apresolve.spotify.com embed-cdn.spotifycdn.com
2 www.google.com redcanary.com
2 connect.facebook.net redcanary.com
connect.facebook.net
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 cdnjs.cloudflare.com redcanary.com
2 open.spotify.com redcanary.com
embed-cdn.spotifycdn.com
2 stats.g.doubleclick.net www.googletagmanager.com
cdn.bizible.com
2 region1.analytics.google.com www.googletagmanager.com
2 munchkin.marketo.net redcanary.com
munchkin.marketo.net
2 www.googletagmanager.com redcanary.com
2 resource.redcanary.com redcanary.com
1 sentry.io assets.qualified.com
1 app.qualified.com js.qualified.com
1 cdn.bizibly.com redcanary.com
1 tracking.crazyegg.com script.crazyegg.com
1 px4.ads.linkedin.com redcanary.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 i.scdn.co embed-cdn.spotifycdn.com
1 alb.reddit.com redcanary.com
1 analytics.twitter.com redcanary.com
1 t.co redcanary.com
1 attr.ml-api.io redcanary.com
1 s.ml-attr.com 1 redirects
1 googleads.g.doubleclick.net www.googletagmanager.com
1 www.redditstatic.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 s3-us-west-2.amazonaws.com redcanary.com
1 003-yru-314.mktoresp.com munchkin.marketo.net
1 fonts.googleapis.com redcanary.com
1 js.qualified.com redcanary.com
1 ajax.googleapis.com redcanary.com
149 51
Subject Issuer Validity Valid
redcanary.com
R3
2023-07-24 -
2023-10-22
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
resource.redcanary.com
Cloudflare Inc ECC CA-3
2023-04-02 -
2024-04-01
a year crt.sh
io.bizible.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-06-01 -
2024-07-01
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-03-09 -
2024-03-08
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
6sc.co
R3
2023-08-19 -
2023-11-17
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.google.gr
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.spotify.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-07 -
2024-03-06
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.s3-us-west-2.amazonaws.com
Amazon RSA 2048 M01
2023-04-11 -
2023-12-28
9 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-21 -
2024-07-19
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-25 -
2024-02-21
6 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 05
2023-07-26 -
2024-01-22
6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-06-10 -
2023-09-08
3 months crt.sh
*.spotifycdn.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
*.scdn.co
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
www.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
crazyegg.com
Amazon RSA 2048 M02
2023-06-23 -
2024-07-22
a year crt.sh
app.qualified.com
R3
2023-07-22 -
2023-10-20
3 months crt.sh
sentry.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-08 -
2024-09-07
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01
2023-07-10 -
2024-06-21
a year crt.sh

This page contains 4 frames:

Primary Page: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Frame ID: 9983361DDBBCF99175DBFE97A6FC9BEC
Requests: 104 HTTP requests in this frame

Frame: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Frame ID: 58EFB51D12DC9EA680B4766E681A5268
Requests: 31 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 4D574D2FA8E2994615CEDF61B3BDAAC9
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=b46cc1bb-f162-40bd-a563-f70756bf6ade
Frame ID: EFDC8B978EF031AD98BF52E78D60E1AD
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Windows Management Instrumentation - Red Canary Threat Report

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • /(?:([\d.])+/)?highlight(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

149
Requests

97 %
HTTPS

60 %
IPv6

35
Domains

51
Subdomains

46
IPs

6
Countries

4292 kB
Transfer

19629 kB
Size

45
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=redcanary.com&pId=4634038059651114651
Request Chain 66
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693507274284%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthreat-detection-report%252Ftechniques%252Fwindows-management-instrumentation%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQJpQVcylEELqQAAAYpM5kfMIavgRal7GLnhlpUoqRrw4sjZmwuAiNZNRWNr6HF_

149 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
359 KB
64 KB
Document
General
Full URL
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
8ea04aff1e26b3002a0e8f9a752c39d12eba28cb176ef120639cbcda0e8181f1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=600, must-revalidate
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 31 Aug 2023 18:41:13 GMT
feature-policy
microphone 'none'; geolocation 'none'
link
<https://redcanary.com/?p=33541>; rel=shortlink
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding
x-cache
HIT: 24
x-cache-group
normal
x-cacheable
SHORT
x-content-type-options
nosniff
x-frame-options
deny
x-permitted-cross-domain-policies
master-only
x-powered-by
WP Engine
x-wpe-request-id
e8dae77a965bf2723e2508666f30a61f
x-xss-protection
1; mode=block
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.1/
88 KB
31 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Sun, 27 Aug 2023 09:30:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
378650
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31100
x-xss-protection
0
last-modified
Thu, 08 Sep 2022 18:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Aug 2024 09:30:23 GMT
forms2.min.js
resource.redcanary.com/js/forms2/js/
208 KB
70 KB
Script
General
Full URL
https://resource.redcanary.com/js/forms2/js/forms2.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
6248
etag
"3340a86-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7ff7680c0f133674-FRA
expires
Thu, 31 Aug 2023 22:41:13 GMT
bizible.js
cdn.bizible.com/scripts/
67 KB
25 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
last-modified
Wed, 30 Aug 2023 15:35:31 GMT
server
ECS (frb/67D4)
age
52245
etag
"b215169c57dbd91:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
25470
9416.js
script.crazyegg.com/pages/scripts/0096/
6 KB
2 KB
Script
General
Full URL
https://script.crazyegg.com/pages/scripts/0096/9416.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
cf-cache-status
HIT
age
11856
cf-polished
origSize=6004
ce-version
11.5.121
cf-bgj
minify
last-modified
Thu, 31 Aug 2023 15:23:37 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
7ff7680bce141913-FRA
js
www.googletagmanager.com/gtag/
301 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a12f2c5b62db43b9b29a5be7342e0e4813e9c2da81d72f806b9cb29289f188fa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
96151
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 31 Aug 2023 18:41:13 GMT
qualified.js
js.qualified.com/
329 KB
95 KB
Script
General
Full URL
https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
via
1.1 spaces-router (devel)
strict-transport-security
max-age=63072000; includeSubDomains
cf-cache-status
MISS
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
dc10e84b-4a76-f3d5-bdf5-9993fa824554
pragma
no-cache
x-runtime
0.022338
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"d3cffae0a07184a7f41e99ed86654a87"
x-download-options
noopen
vary
Accept,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7ff7680cf93c3825-FRA
expires
Thu, 31 Aug 2023 22:41:14 GMT
munchkin.js
munchkin.marketo.net/
1 KB
2 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.64.124.188 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-64-124-188.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
ef2ca5ac3d9cf4d005d7294562694e44b40efd2c194722721a52743c2f43f1a6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:41:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Mar 2023 02:09:07 GMT
Server
AkamaiNetStorage
ETag
"fefdb331ffca929fc0e661337b64ed4f:1678241347.158405"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
741
forms2.min.js
resource.redcanary.com/js/forms2/js/
208 KB
69 KB
Script
General
Full URL
https://resource.redcanary.com/js/forms2/js/forms2.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
6248
etag
"3340a86-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7ff7680cf8d43674-FRA
expires
Thu, 31 Aug 2023 22:41:13 GMT
gtm.js
www.googletagmanager.com/
287 KB
95 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
71b438c3f1dce4a2adc5da680c742d393b36d82d1494194d799475a2550bd9fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
97001
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:41:13 GMT
6si.min.js
j.6sc.co/
51 KB
15 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Aug 2023 22:29:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64e7d9dd-cc38"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14993
expires
Thu, 31 Aug 2023 18:41:13 GMT
css
fonts.googleapis.com/
7 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:41:13 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 31 Aug 2023 18:41:13 GMT
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/site/
5 KB
2 KB
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1d4b7e28e37dd7d9a576c9b49f998374ed3a3d34a3e8cf865fa134a8486f14c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
cf-cache-status
HIT
age
9514
ce-version
11.5.121
content-length
1539
last-modified
Thu, 31 Aug 2023 16:02:39 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff7680d1f579968-FRA
collect
region1.analytics.google.com/g/
0
252 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je38u0&_p=1957396061&_gaz=1&cid=1377206414.1693507274&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1693507273&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
243 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=1377206414.1693507274&gtm=45je38u0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.gr/ads/
42 B
408 B
Image
General
Full URL
https://www.google.gr/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3K4MTNQJN&cid=1377206414.1693507274&gtm=45je38u0&aip=1&z=503317617
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:13 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
b2625509b46b716ab8df67870a7d87b8.js
script.crazyegg.com/pages/versioned/common-scripts/
91 KB
31 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 24 Aug 2023 15:03:06 GMT
server
cloudflare
age
19482
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff7680d792e1913-FRA
content-length
31312
autoptimize_7c1b044830350562b8347035fb5ab725.css
redcanary.com/wp-content/cache/autoptimize/css/
5 MB
253 KB
Stylesheet
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:30 GMT
server
nginx
etag
W/"64dce75e-53c907"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
7a979c07c63d877338931e5359d94a9f
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
truncated
/
64 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
65 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
bullet-square.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
443 B
654 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 23 Aug 2021 16:46:07 GMT
server
nginx
etag
W/"6123d0cf-1bb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
006aa35da31ff9ad2d6cb9a61b5b8f98
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
source-sans-pro-v21-latin-regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:25 GMT
server
nginx
etag
"6298f2c1-32ec"
vary
Accept-Encoding
x-wpe-request-id
418468f764924834c9b3c8ac4870051c
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13036
source-sans-pro-v21-latin-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:24 GMT
server
nginx
etag
"6298f2c0-327c"
vary
Accept-Encoding
x-wpe-request-id
346c7e7b22449dca9f4eed357d65a2d8
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12924
source-sans-pro-v21-latin-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:22 GMT
server
nginx
etag
"6298f2be-329c"
vary
Accept-Encoding
x-wpe-request-id
290269d3213dada4f3cda450eec6b383
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12956
source-sans-pro-v21-latin-600.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:23 GMT
server
nginx
etag
"6298f2bf-32fc"
vary
Accept-Encoding
x-wpe-request-id
df9f4fc76b6b54739f6b426d2da3afae
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13052
56z2qI0gKcPthQF6l8AW3E
open.spotify.com/embed/track/ Frame 58EF
11 KB
5 KB
Document
General
Full URL
https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy / Next.js
Resource Hash
f9776436ba0bf509095e148fe165af228c9a00e2b76aa8e51c0dcbed4ff1de7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 31 Aug 2023 18:41:13 GMT
etag
"z0lrntu2wb8m3"
server
envoy
sp-trace-id
6a0da2dc01783fd3
strict-transport-security
max-age=31536000
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
x-content-type-options
nosniff
x-powered-by
Next.js
truncated
/
68 B
68 B
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
munchkin.js
munchkin.marketo.net/162/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.64.124.188 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-64-124-188.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:41:13 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4677
Expires
Sat, 09 Dec 2023 18:41:13 GMT
visitWebPage
003-yru-314.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1693507273903&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1693507273902-76690&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:41:14 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
7cb3dc9b-4c89-4f6d-a738-d0639bf0fcf2
default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/
763 B
929 B
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1295125
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
267
last-modified
Thu, 22 Jun 2023 11:03:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/r2
etag
"64942a94-10b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AMi4vIXBVcQSlAHATuWYyzw%2ByTQHwBVPY76zmuPJNNVR3wR0siE4bm1ImGDyw3cIgtfaSGI92QMv4c7O5syOp5foA7ZdU3ftMdVPGZwxxeGnMQDMFzJdfROqQGloM1kEILJ49eO8YE1uy3JApFXuZuzf"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff7680e1c0e92c5-FRA
expires
Tue, 20 Aug 2024 18:41:13 GMT
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/
130 KB
33 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
10847861
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
33250
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-20801"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4xCdnsa4mK3%2B1EK8DHAONS7%2BOKfPyZDh7qR6yMPbeiIrxq1dnIf60dmcTzFCjk4l17atLSX%2Fl0JLv7lNd7FtNAEKPmFE8Bw7Qj0F6eMlCpX7rKjzNq81AZg7K1t%2BEdWh7BV%2F40EvuyMsIRYL8swop%2F97"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff7680e1c0a92c5-FRA
expires
Tue, 20 Aug 2024 18:41:13 GMT
teknkl-formsplus-1.0.5.js
s3-us-west-2.amazonaws.com/s.cdpn.io/250687/
41 KB
41 KB
Script
General
Full URL
https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.92.152.120 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:41:15 GMT
x-amz-version-id
OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO
Last-Modified
Thu, 26 Apr 2018 08:20:46 GMT
Server
AmazonS3
x-amz-request-id
0WXSDS1DZ18NSJZE
ETag
"bab0c2b3523f8244564b675fe34db610"
Content-Type
application/x-js
Cache-Control
public
Accept-Ranges
bytes
Content-Length
41617
x-amz-id-2
uzhu3w3DFgypga7SHVyE1//CFg823BOEAEjnQn79lUSvKVjpbU5RdoL2cxN6sPbPRfQHHJ2LGgE=
autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
redcanary.com/wp-content/cache/autoptimize/js/
288 KB
82 KB
Script
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:29 GMT
server
nginx
etag
W/"64dce75d-48160"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
875c31e4fadf9dd7e9d132276df007a4
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230071-FRA
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
1 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:13 GMT
x-content-type-options
nosniff
last-modified
Wed, 30 Aug 2023 18:41:20 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
content-type
application/javascript;charset=utf-8
cache-control
max-age=77707
accept-ranges
bytes
content-length
1046
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Jun 2023 20:49:59 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7409
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1693507273968&cv=11&fst=1693507273968&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&hn=www.googleadservices.com&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&auid=1436054422.1693507274&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c15f51cf77e5f05d6a774886bee79c0e75a3d1fdb0a2662ab1c48600562efe4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1354
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bat.js
bat.bing.com/
42 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Thu, 31 Aug 2023 18:41:13 GMT
last-modified
Fri, 28 Jul 2023 18:19:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 13F5A16C0A1F4AD5A0685EA50D40D18A Ref B: FRA31EDGE0205 Ref C: 2023-08-31T18:41:14Z
etag
"806f3b1280c1d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12469
fbevents.js
connect.facebook.net/en_US/
193 KB
52 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:41:13 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
52127
x-xss-protection
0
pragma
public
x-fb-debug
K050ej6EJhyEDJd/S6o/Xq8yYYiYAZLvHYL8kCevb7i6IXbH+/VLh1QQWYV7VHu4vXoiTIoqGJ93I6FAnM8LNw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=redcanary.com&pId=4634038059651114651
0
234 B
Image
General
Full URL
https://attr.ml-api.io/?domain=redcanary.com&pId=4634038059651114651
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
2600:9000:20c3:4600:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
via
1.1 7ede51d8c775deaef83b54a3beafab3c.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-C1
x-cache
Miss from cloudfront
content-type
application/json
x-amz-cf-id
-6wU0uZw9HWYiEUgR-U4l_hTBdGHnX9majC_jeAF1b-bDrSiqf62dw==
content-length
0
apigw-requestid
Kie_vi--IAMEVdg=

Redirect headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:14 GMT
an-x-request-uuid
107e9a6d-e6d6-4c05-805d-0c31056858d0
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://attr.ml-api.io/?domain=redcanary.com&pId=4634038059651114651
x-proxy-origin
81.95.5.40; 81.95.5.40; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
8cd00e627952ec8a.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 58EF
26 KB
4 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
4434136
x-amz-meta-goog-reserved-file-mtime
1689072066
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
4039
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230058-FRA
last-modified
Tue, 11 Jul 2023 10:56:36 GMT
etag
"f3d572702831405545a59c2b3c1f6f80"
x-goog-generation
1689072996772325
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
26326
accept-ranges
bytes
x-cache-hits
6, 88142
c47c6e7745a8b455.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame 58EF
34 KB
6 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
108876
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5946
x-served-by
cache-chi-kigq8000053-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"fcbec68c9d848190b4c167a8202f2ffd"
x-goog-generation
1693398318469994
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
35014
x-amz-checksum-crc32c
v/JnmQ==
accept-ranges
bytes
x-cache-hits
2, 4636
webpack-3e4f342dbb144246.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
108876
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
2186
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"afb8c163c2105c690dae52a64acf740d"
x-goog-generation
1693398318516219
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
4611
x-amz-checksum-crc32c
lAXGCg==
accept-ranges
bytes
x-cache-hits
5, 16475
framework-33d379e787c03ddb.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
127 KB
41 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/framework-33d379e787c03ddb.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
8685416
x-amz-meta-goog-reserved-file-mtime
1684765243
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
42161
x-served-by
cache-chi-kigq8000070-CHI, cache-fra-eddf8230058-FRA
last-modified
Mon, 22 May 2023 14:27:39 GMT
etag
"124a9f12f15f3120a5ef711a66ba2662"
x-goog-generation
1684765659849262
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
129927
accept-ranges
bytes
x-cache-hits
739, 91572
main-0117c27f823659ce.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
111 KB
33 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/main-0117c27f823659ce.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
7185631
x-amz-meta-goog-reserved-file-mtime
1686222071
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
33612
x-served-by
cache-chi-kigq8000158-CHI, cache-fra-eddf8230058-FRA
last-modified
Thu, 08 Jun 2023 11:07:26 GMT
etag
"81865ede7cdb1740008282943c7855ac"
x-goog-generation
1686222445991402
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
113515
accept-ranges
bytes
x-cache-hits
617, 91242
_app-fe44d090509824d5.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/ Frame 58EF
507 KB
138 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
108877
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
140746
x-served-by
cache-chi-kigq8000132-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"5686bcaf61d1e15b5f94a8ec151d3215"
x-goog-generation
1693398318953757
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
518987
x-amz-checksum-crc32c
ZWKppg==
accept-ranges
bytes
x-cache-hits
2, 3
fec483df-b230338ad030162e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
320 KB
99 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/fec483df-b230338ad030162e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
6778806
x-amz-meta-goog-reserved-file-mtime
1686661750
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
100913
x-served-by
cache-chi-klot8100047-CHI, cache-fra-eddf8230058-FRA
last-modified
Tue, 13 Jun 2023 13:18:59 GMT
etag
"9c4d5b20d500a4646af02cb2e28e11da"
x-goog-generation
1686662339475826
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
327829
accept-ranges
bytes
x-cache-hits
462, 91708
415-d009a9159d740903.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
25 KB
6 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/415-d009a9159d740903.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
2541496
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5881
x-served-by
cache-chi-kigq8000020-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f45ad0e97a8e71419371027175275215"
x-goog-generation
1690965617730993
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25338
x-amz-checksum-crc32c
I6sMew==
accept-ranges
bytes
x-cache-hits
7, 86573
122-f7d6a526163e333e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
262 KB
72 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/122-f7d6a526163e333e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
126055
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
73305
x-served-by
cache-chi-kigq8000095-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"09569bb140037810c364b24b4e3dbfb2"
x-goog-generation
1693381086734856
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
267882
x-amz-checksum-crc32c
vgEZdw==
accept-ranges
bytes
x-cache-hits
64, 18957
345-dd05f38d7ac8a99d.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
96 KB
25 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/345-dd05f38d7ac8a99d.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
126055
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
25529
x-served-by
cache-chi-kigq8000078-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"2ae89e701fdd03960a8a00c1f5dcfa88"
x-goog-generation
1693381086719715
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
98413
x-amz-checksum-crc32c
+DCSmw==
accept-ranges
bytes
x-cache-hits
63, 18810
%5Bid%5D-025dca3822d6ecec.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/ Frame 58EF
31 KB
8 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/%5Bid%5D-025dca3822d6ecec.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
126054
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
8521
x-served-by
cache-chi-kigq8000160-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"ac10207c64f660116f59fdf475284935"
x-goog-generation
1693381086898125
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
31582
x-amz-checksum-crc32c
q2CFuQ==
accept-ranges
bytes
x-cache-hits
54, 5136
_buildManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 58EF
2 KB
1005 B
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_buildManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
108877
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
821
x-served-by
cache-chi-klot8100127-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"e4f2f5f28d975e18a45aa130cfa30f72"
x-goog-generation
1693398318168737
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
2163
x-amz-checksum-crc32c
8Pix6g==
accept-ranges
bytes
x-cache-hits
5, 16470
_ssgManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame 58EF
77 B
228 B
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_ssgManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
108876
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
61
x-served-by
cache-chi-klot8100033-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"b6652df95db52feb4daf4eca35380933"
x-goog-generation
1693398318123960
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
77
x-amz-checksum-crc32c
Ypo4GQ==
accept-ranges
bytes
x-cache-hits
1, 16512
insight.old.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Aug 2023 12:14:15 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=37569
accept-ranges
bytes
content-length
4862
1042590016249604
connect.facebook.net/signals/config/
137 KB
35 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1042590016249604?v=2.9.125&r=stable&domain=redcanary.com
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:41:14 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
35944
x-xss-protection
0
pragma
public
x-fb-debug
o5Ui6oHotDpOYSgtCUZC8GSjWfdCDZfQ9qtzJ15gvSwQ6ymKCQ7k1fdEtHzwYDOH/vVFw6lDaaa08KSzFeuhgQ==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
adsct
t.co/i/
43 B
377 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=7d57d976-d91c-4c3a-8569-65c472fda2c2&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d259945d-2330-4da9-99ad-2d735775a104&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
110
date
Thu, 31 Aug 2023 18:41:14 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
97ff2a6e465327f1
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
4859a414b771bc4c38bf07981719cacdeb38e92f736ac968d6873138547747b6
content-length
43
adsct
analytics.twitter.com/i/
43 B
396 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=7d57d976-d91c-4c3a-8569-65c472fda2c2&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d259945d-2330-4da9-99ad-2d735775a104&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
183
date
Thu, 31 Aug 2023 18:41:13 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
125397f9ff3d969e
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
2052a7e5d2b0ae3b7940a4bd98c69ddb865cb2d7a357ef73548e1ba0dbf36aba
content-length
43
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1693507274144&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=159c186f-29f7-4eae-9a47-94670116110b&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
ab67616d00001e02ebcc9144c41ae7d42efe6d94
i.scdn.co/image/ Frame 58EF
31 KB
32 KB
Image
General
Full URL
https://i.scdn.co/image/ab67616d00001e02ebcc9144c41ae7d42efe6d94
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:8d::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://embed-cdn.spotifycdn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:41:14 GMT
Age
727028
X-Cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
Connection
keep-alive
Content-Length
31979
X-Served-By
cache-chi-kigq8000117-CHI, cache-fra-eddf8230043-FRA
Last-Modified
Wed, 04 Sep 2019 11:41:29 GMT
ETag
"7684273fe7fc515e237eab3b4c5eef9d"
x-goog-generation
1567597289264217
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
x-goog-stored-content-length
31979
x-amz-checksum-crc32c
1a4KSA==
Accept-Ranges
bytes
Timing-Allow-Origin
*
X-Cache-Hits
11653, 2
CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
encore.scdn.co/fonts/ Frame 58EF
85 KB
86 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:3::213:789e Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
87344
last-modified
Thu, 19 May 2022 07:59:23 GMT
etag
"db1a27b35e26398fef4be920ea96078d"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
r/+ZKQ==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:41:14 GMT
CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
encore.scdn.co/fonts/ Frame 58EF
82 KB
82 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:3::213:789e Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
84027
last-modified
Fri, 13 May 2022 11:38:51 GMT
etag
"f7b12903dd7a2d536ceb2b7cd1dba2c1"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
rmKVPg==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:41:14 GMT
/
www.google.com/pagead/1p-user-list/759876114/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/759876114/?random=1693507273968&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=1156817338&rmt_tld=0&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:14 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.gr/pagead/1p-user-list/759876114/
42 B
154 B
Image
General
Full URL
https://www.google.gr/pagead/1p-user-list/759876114/?random=1693507273968&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=1156817338&rmt_tld=1&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:14 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
monitoring
open.spotify.com/embed/ Frame 58EF
2 B
413 B
Fetch
General
Full URL
https://open.spotify.com/embed/monitoring?o=22381&p=4505164808585216
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

sp-trace-id
b19310399769af94
date
Thu, 31 Aug 2023 18:41:14 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
via
1.1 google, HTTP/2 edgeproxy, 1.1 google
server
envoy
vary
origin,access-control-request-method,access-control-request-headers, Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
/
apresolve.spotify.com/ Frame 58EF
273 B
270 B
XHR
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
cca95ef2a816865f55df96aedf861e29dd6dbe5c7c968a53de535de77089c6ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
110
CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
encore.scdn.co/fonts/ Frame 58EF
87 KB
88 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:3::213:789e Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
89529
last-modified
Fri, 13 May 2022 11:38:50 GMT
etag
"216b12b5a9657850b1b324e158454f8e"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
3OfNxA==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:41:14 GMT
token
cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/
36 B
376 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:fa00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:20:24 GMT
content-encoding
gzip
via
1.1 9564791ed47030dad53c797ee814c66e.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P3
age
1250
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
yBWNtxDt0k-zsCzifYQthI-CfSjLjJWA-E3GT9wxFy2RLg8rcsK1-Q==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693507274284%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthre...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookies...
0
266 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQJpQVcylEELqQAAAYpM5kfMIavgRal7GLnhlpUoqRrw4sjZmwuAiNZNRWNr6HF_
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 49A561411D384BBF9F9A1B08DAF2EE61 Ref B: DUS30EDGE0320 Ref C: 2023-08-31T18:41:14Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPGONAlRXbB8A7S7lvw==

Redirect headers

date
Thu, 31 Aug 2023 18:41:13 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: CD91FF4AF696408EA082FB6634B65E3A Ref B: DUS30EDGE0412 Ref C: 2023-08-31T18:41:14Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693507274284&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQJpQVcylEELqQAAAYpM5kfMIavgRal7GLnhlpUoqRrw4sjZmwuAiNZNRWNr6HF_
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPGOIWA0Ja7yF8/8UZA==
56383426.js
bat.bing.com/p/action/
0
118 B
Script
General
Full URL
https://bat.bing.com/p/action/56383426.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Thu, 31 Aug 2023 18:41:13 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 14EDD88A5F5E4C1587E8C863A67C4BA3 Ref B: FRA31EDGE0205 Ref C: 2023-08-31T18:41:14Z
x-cache
CONFIG_NOCACHE
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&rl=&if=false&ts=1693507274304&sw=1600&sh=1200&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1693507274302.1066590325&it=1693507274055&coo=false&rqm=GET
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Thu, 31 Aug 2023 18:41:14 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
662.dc13e1cf69424def.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
56 KB
12 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
2541495
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
12292
x-served-by
cache-chi-kigq8000034-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f63aef00c0a6fb21f8372a038ee41c3a"
x-goog-generation
1690965617313097
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
57497
x-amz-checksum-crc32c
yfdB0g==
accept-ranges
bytes
x-cache-hits
8, 82530
90.e174c663531d2840.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/90.e174c663531d2840.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
2541496
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
1750
x-served-by
cache-chi-klot8100099-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"9a75e6801ccd6da13a45572ceefe7d6b"
x-goog-generation
1690965617342176
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
5117
x-amz-checksum-crc32c
467rEw==
accept-ranges
bytes
x-cache-hits
8, 80390
/
apresolve.spotify.com/ Frame 58EF
273 B
170 B
Fetch
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
d31de08a2b682d4536faf9c2a3077992737ea91b7ad380130d0c16c691a45ebc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
110
ffd0ec40-07f5-45f0-9cc1-fc8c25df1d6b
https://open.spotify.com/ Frame 58EF
46 KB
0
Other
General
Full URL
blob:https://open.spotify.com/ffd0ec40-07f5-45f0-9cc1-fc8c25df1d6b
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
46922
Content-Type
239.07bc4bf7922798bd.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
112 KB
32 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/239.07bc4bf7922798bd.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
2541494
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
32825
x-served-by
cache-chi-klot8100053-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"754ab6b3cee4b386497a168a8900298e"
x-goog-generation
1690965617240921
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
114759
x-amz-checksum-crc32c
Xrafeg==
accept-ranges
bytes
x-cache-hits
8, 83402
70.0c0cdff9477a566b.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
241 KB
53 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/70.0c0cdff9477a566b.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
2541495
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
54273
x-served-by
cache-chi-kigq8000064-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"d01bb82fc57aa696eb7a37f25227533f"
x-goog-generation
1690965617620460
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
246299
x-amz-checksum-crc32c
60anbQ==
accept-ranges
bytes
x-cache-hits
8, 83989
spotify_player_o.42e735f526de3a43.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame 58EF
25 KB
7 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/spotify_player_o.42e735f526de3a43.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
age
2541495
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
7328
x-served-by
cache-chi-klot8100155-CHI, cache-fra-eddf8230058-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"615db0ae9631539d4b3438ee8a5a68da"
x-goog-generation
1690965617266128
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25627
x-amz-checksum-crc32c
CIvg6w==
accept-ranges
bytes
x-cache-hits
8, 80502
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:41:14 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:41:14 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 58EF
13 B
172 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:41:14 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 58EF
13 B
103 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:41:14 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
j.6sc.co/j/
4 KB
4 KB
Script
General
Full URL
https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id
a5rebSMZ.Kk9yiZR85vsDTngv6hjCogp
date
Thu, 31 Aug 2023 18:41:15 GMT
x-amz-cf-pop
FRA2-C2
x-amz-server-side-encryption
AES256
x-amz-meta-content-type
application/json
content-length
3771
pragma
no-cache
last-modified
Mon, 22 May 2023 19:07:21 GMT
server
AmazonS3
etag
"9fdd9f5f306ab8eec57207f0e3c1a4e7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
x-amz-cf-id
wXdX54QJBYMT3C5eb5-msAeCPmZIphSDfi9HhQtVpFXseWEKcEKhag==
expires
Thu, 31 Aug 2023 18:41:15 GMT
0
bat.bing.com/action/
0
286 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=1026eab8-a514-48dd-af0a-65bf27467c11&sid=f6d088a0482d11ee8970992e0dbde4ec&vid=f6d0a0a0482d11eebbb75fce942b91d7&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&r=&evt=pageLoad&sv=1&rn=729293
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:41:14 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F62BEBBE52924F7EAB10C9359112B0D7 Ref B: FRA31EDGE0205 Ref C: 2023-08-31T18:41:14Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/sampling/
158 B
260 B
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=470418
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
cf-cache-status
HIT
age
9497
ce-version
11.5.121
content-length
145
last-modified
Thu, 31 Aug 2023 16:02:57 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff76812aea69968-FRA
8f9987be-79fb-4f18-addd-a78c31c26d0c
https://redcanary.com/
45 B
0
Other
General
Full URL
blob:https://redcanary.com/8f9987be-79fb-4f18-addd-a78c31c26d0c
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
45
Content-Type
text/javascript
clock
tracking.crazyegg.com/
26 B
133 B
XHR
General
Full URL
https://tracking.crazyegg.com/clock?t=1693507274710&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=d37290a18923502c5d774f0101c22591b3089c6d&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.119.10 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-18-119-10.eu-west-1.compute.amazonaws.com
Software
awselb/2.0 /
Resource Hash
d54424037c8c20ce9ac78f6fb53935664f6b055fd7a27d3573fb792908f5641f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 31 Aug 2023 18:41:14 GMT
cache-control
no-store
server
awselb/2.0
content-length
26
content-type
text/plain
ipv
cdn.bizible.com/m/
43 B
203 B
Image
General
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=55a6e28369a64f1e8fd566f5c25c450b&_biz_s=8eac7&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693507273758&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=0&a=redcanary.com&rnd=871156&cdn_o=a&_biz_z=1693507274733
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6760) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:14 GMT
last-modified
Wed, 30 Aug 2023 04:10:18 GMT
server
ECS (frb/6760)
age
138656
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
u
cdn.bizibly.com/
43 B
328 B
Image
General
Full URL
https://cdn.bizibly.com/u?_biz_u=55a6e28369a64f1e8fd566f5c25c450b&_biz_s=8eac7&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693507274736&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&a=redcanary.com&rnd=453587&cdn_o=a&_biz_z=1693507274736
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67E0) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:14 GMT
last-modified
Wed, 30 Aug 2023 04:10:19 GMT
server
ECS (frb/67E0)
age
138655
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
d9b6b28e3d84db3e4c966a5cf73af402.js
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/
20 KB
8 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/d9b6b28e3d84db3e4c966a5cf73af402.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:50 GMT
server
cloudflare
age
19482
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff768144ca71913-FRA
content-length
8025
xdc.js
cdn.bizible.com/
116 B
325 B
Script
General
Full URL
https://cdn.bizible.com/xdc.js?_biz_u=55a6e28369a64f1e8fd566f5c25c450b&_biz_h=-1906410348&cdn_o=a&jsVer=4.23.08.24&a=redcanary.com
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
a5ee554b456a8011af8f8ae22a4ff122e0d20d7bad5b720e4f2cbeb63af9db79

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:14 GMT
content-encoding
gzip
server
ECS (frb/6711)
etag
5CDCDA6E
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
text/javascript; charset=utf-8
cache-control
private, must-revalidate, max-age=21600
content-length
219
a9b76616-8dfe-4e17-b729-e005c0974baa
https://redcanary.com/
241 B
0
Other
General
Full URL
blob:https://redcanary.com/a9b76616-8dfe-4e17-b729-e005c0974baa
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
241
Content-Type
text/javascript
/
www.facebook.com/tr/ Frame 4D57
0
47 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://redcanary.com
Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://redcanary.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Thu, 31 Aug 2023 18:41:14 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
spotify-logo-black-8-01.svg
redcanary.com/wp-content/uploads/2021/03/
898 B
857 B
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2021/03/spotify-logo-black-8-01.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:15 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 29 Mar 2021 15:22:29 GMT
server
nginx
etag
W/"6061f0b5-382"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
c8b99d066cf8d1e1c6e67520fe3a316a
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
autoptimize_7c1b044830350562b8347035fb5ab725.css
redcanary.com/wp-content/cache/autoptimize/css/
5 MB
253 KB
Stylesheet
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:15 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:30 GMT
server
nginx
etag
W/"64dce75e-53c907"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
a97f1ee15fb4ab419bcc38e54503577a
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
u
cdn.bizible.com/m/
43 B
144 B
Image
General
Full URL
https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1693507273902-76690&_biz_u=55a6e28369a64f1e8fd566f5c25c450b&_biz_s=8eac7&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693507274737&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=1&a=redcanary.com&rnd=359192&cdn_o=a&_biz_z=1693507275153
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6776) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:15 GMT
last-modified
Wed, 30 Aug 2023 04:10:23 GMT
server
ECS (frb/6776)
age
138652
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
TDR-Logo-Lockup-02.png
redcanary.com/wp-content/uploads/2023/03/
7 KB
8 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Logo-Lockup-02.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:15 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 02:03:06 GMT
server
nginx
etag
"6419105a-1d03"
vary
Accept-Encoding
x-wpe-request-id
e370a9cf59f3f5a90da2a1a719a4ffa3
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
7427
661bb7e9d0e0abee5d7403d3d65553a1.js
script.crazyegg.com/pages/versioned/tracking-scripts/
98 KB
32 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/tracking-scripts/661bb7e9d0e0abee5d7403d3d65553a1.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:15 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:48 GMT
server
cloudflare
age
19485
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff76815cf1c1913-FRA
content-length
32149
6si.min.js
j.6sc.co/
51 KB
15 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Aug 2023 22:29:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64e7d9dd-cc38"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14993
expires
Thu, 31 Aug 2023 18:41:15 GMT
/
c.6sc.co/
7 B
191 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:15 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
14 B
299 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:e300::5f64:9219 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
0cbee5f32eeccb2fd9d710b78a7cdfc0293adb361f1675e3db04be4c01f3344c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:15 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:2b::8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693507275222_1600426517_564001633_18_854_14_35_219";dur=1
content-length
14
expires
Thu, 31 Aug 2023 18:41:15 GMT
messenger
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame EFDC
6 KB
3 KB
Document
General
Full URL
https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=b46cc1bb-f162-40bd-a563-f70756bf6ade
Requested by
Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.204.253.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-204-253-158.compute-1.amazonaws.com
Software
/
Resource Hash
b53ab548d004bc41e5b4e13e007727310d5800a6713b7871e2cd0312ff7952ce
Security Headers
Name Value
Content-Security-Policy
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
max-age=0, private, must-revalidate
Content-Encoding
gzip
Content-Length
1832
Content-Security-Policy
Content-Type
text/html; charset=utf-8
Date
Thu, 31 Aug 2023 18:41:15 GMT
Etag
W/"b53ab548d004bc41e5b4e13e00772731"
Link
<https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=63072000; includeSubDomains
Vary
Accept-Encoding
Via
1.1 spaces-router (devel)
X-Content-Type-Options
nosniff
X-Download-Options
noopen
X-Permitted-Cross-Domain-Policies
none
X-Request-Id
5eac0586-668a-6a83-10d0-4dbe36d261a5
X-Runtime
0.020298
X-Xss-Protection
1; mode=block
source-sans-pro-v21-latin-regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:15 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:25 GMT
server
nginx
etag
"6298f2c1-32ec"
vary
Accept-Encoding
x-wpe-request-id
26e5acd2c7b3d80baff4911b1d047068
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13036
tdr-sidenav-grain.png
redcanary.com/wp-content/themes/redcanary/assets/img/
84 KB
84 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-sidenav-grain.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:15 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
"64187eac-14f3f"
vary
Accept-Encoding
x-wpe-request-id
3e0b344cb8484c8de9a6ec025b8081b8
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
85823
tdr-search-icon.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
773 B
764 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-search-icon.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
W/"64187eac-305"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
337dde370407d8c956b445493ad215fc
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-canaries.png
redcanary.com/wp-content/themes/redcanary/assets/img/
10 KB
10 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-canaries.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-27ad"
vary
Accept-Encoding
x-wpe-request-id
768d9f411947bc9c6bd0539d21a81fdf
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
10157
topic-hero.jpg
redcanary.com/wp-content/themes/redcanary/assets/img/
244 KB
245 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/topic-hero.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:15 GMT
server
nginx
etag
"5c76b1f3-3d141"
vary
Accept-Encoding
x-wpe-request-id
1b982807591db3c65206a377dc58846a
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
250177
source-sans-pro-v21-latin-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:24 GMT
server
nginx
etag
"6298f2c0-327c"
vary
Accept-Encoding
x-wpe-request-id
e3e3e5364d8ea2384d6bb1e514435e01
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12924
source-sans-pro-v21-latin-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:22 GMT
server
nginx
etag
"6298f2be-329c"
vary
Accept-Encoding
x-wpe-request-id
697893dc14fd4e2fff5bc9e2ee08c7a5
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12956
graphic-soundwave.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
3 KB
836 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/graphic-soundwave.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:29 GMT
server
nginx
etag
W/"64187ea9-abb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
3b594e3512edcc93fa2bab83f84f4ede
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
icon-spotify.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
2 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/icon-spotify.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:30 GMT
server
nginx
etag
W/"64187eaa-653"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
9c7e3e61d9708f6aa42805526488b6f4
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-dots.png
redcanary.com/wp-content/themes/redcanary/assets/img/
11 KB
11 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-dots.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-2b89"
vary
Accept-Encoding
x-wpe-request-id
31e0f87c9154b91e1c73bc4fbc266c7e
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
11145
button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
350 B
619 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:05 GMT
server
nginx
etag
W/"5c76b1e9-15e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
5fbfb0e511be9c236527575803c171ee
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
TDR-Header03-1200w.jpeg
redcanary.com/wp-content/themes/redcanary/assets/img/
331 KB
332 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/TDR-Header03-1200w.jpeg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 18:01:24 GMT
server
nginx
etag
"6419f0f4-52bf0"
vary
Accept-Encoding
x-wpe-request-id
4fa72611e9b57d85046a7cdd8c489993
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
338928
search-btn.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
161 B
473 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 08 Sep 2021 23:08:04 GMT
server
nginx
etag
W/"61394254-a1"
vary
Accept-Encoding, Accept-Encoding
x-wpe-request-id
1fed5768884e180ebcc8cd830db4841c
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
messenger-94e6eccc.chunk.css
assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame EFDC
35 KB
7 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
x-amz-version-id
nZxsrH887GdfUGGuQnwzmaU9YPeyQVEN
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
07RN9PT5FDTFQ4HK
age
1678
x-amz-server-side-encryption
AES256
x-amz-id-2
imJXSfUgYshmruBeNCdPgS2qiXJ2whfZ4wFxWAj9gXscsFpN5FEo48kca0ALe1i9yNOejItUMic=
last-modified
Sat, 26 Aug 2023 01:50:02 GMT
server
cloudflare
etag
W/"a788ecf510f83ee517cbaf79306145dd"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff7681b3c7f3825-FRA
expires
Thu, 31 Aug 2023 22:41:16 GMT
messenger-84a66aeb.chunk.css
assets.qualified.com/packs/css/widget/sandboxed/ Frame EFDC
5 KB
1 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
x-amz-version-id
h8ucmJiFt84zH1W0e6Ruobtgt6ETiM19
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
Y2BVRYP7FPAERKM7
age
3654
x-amz-server-side-encryption
AES256
x-amz-id-2
G5Fz/ZqHCohFcbpRLtAmNf/T4WbOA2yuBeH/dNsf4gIFzBblm+9m6gwN9exnz5Fr5isDJ17qS+A=
last-modified
Thu, 27 Apr 2023 00:02:34 GMT
server
cloudflare
etag
W/"22d5f23e695250d3c5a5b1e76a015c5e"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff7681b3c813825-FRA
expires
Thu, 31 Aug 2023 22:41:16 GMT
messenger~runtime-f4ac063cf9338bc709b8.js
assets.qualified.com/packs/js/widget/sandboxed/ Frame EFDC
2 KB
2 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-f4ac063cf9338bc709b8.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=b46cc1bb-f162-40bd-a563-f70756bf6ade
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
x-amz-version-id
PdfsJsTwxZSJ8tn07cjcyE.BvIAlLvhP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
QZJY10GAACRKCKM7
age
5717
x-amz-server-side-encryption
AES256
x-amz-id-2
1UFuozJN+IrLQ+c885d6X/6Dn1utV7cM/TFVvx0WjQyfwHA6kp1czd8xMbnWocbd8blXl1Bem+HouwwR5GefZ4RdABBooe8N
last-modified
Thu, 31 Aug 2023 01:01:43 GMT
server
cloudflare
etag
W/"211c830511b7e3f0f42259032f070166"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff7681c0daa3825-FRA
expires
Thu, 31 Aug 2023 22:41:16 GMT
messenger-369223c5490f8cdcf187.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame EFDC
1 MB
362 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=b46cc1bb-f162-40bd-a563-f70756bf6ade
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
x-amz-version-id
oK9jovqhn.gYLI4zbnGqtErXgbUHzdXb
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
P4DCTZ83DJX4B97F
age
6749
x-amz-server-side-encryption
AES256
x-amz-id-2
QyO2ne4Pt2UCDU+0XZFMEKBwphRkx/Oj7RSzTPECLXuI1UV+H/5kcqCcNC4Abm4p7wDkkbrzSnlnHO9PEdjFI2NlP7vSCe+QDtOwC4qV8zE=
last-modified
Mon, 28 Aug 2023 20:31:37 GMT
server
cloudflare
etag
W/"07365b735e31be744e837d71d12cb7ad"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff7681c0dae3825-FRA
expires
Thu, 31 Aug 2023 22:41:16 GMT
messenger-4dcf43b9b54c3f5764c6.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame EFDC
622 KB
162 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-4dcf43b9b54c3f5764c6.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=b46cc1bb-f162-40bd-a563-f70756bf6ade
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
x-amz-version-id
TbFSaWaZouDNzEPRloXQJWsSi3g5kbCP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
NZYHG12SDRH8SG3B
age
5550
x-amz-server-side-encryption
AES256
x-amz-id-2
VUH4BNz3OHNTDaZb6SnQW6+QBZ3/+6989FCJJvECqBolq1L0d3PhZAz82I+FvqKzLIWqG8HMZNk=
last-modified
Thu, 31 Aug 2023 01:01:44 GMT
server
cloudflare
etag
W/"94ddddc8eac8fb41be3179fa9a2943df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff7681c0db23825-FRA
expires
Thu, 31 Aug 2023 22:41:16 GMT
Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame EFDC
97 KB
97 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=b46cc1bb-f162-40bd-a563-f70756bf6ade
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
x-amz-version-id
Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos
cf-cache-status
HIT
x-amz-request-id
41Z3KJK24K5VH2VW
age
22957065
content-length
98868
x-amz-id-2
Ta7QduaUx53oJBC61pF3hnNKwZ0PRiLBlPs9GI8HcAGX1x9nffwkEv3HAik928cdZO2VmzvSgxE=
last-modified
Thu, 08 Dec 2022 23:17:25 GMT
server
cloudflare
etag
"dc131113894217b5031000575d9de002"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff7681b5c0d1c13-FRA
expires
Sat, 31 Aug 2024 00:41:16 GMT
Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame EFDC
103 KB
104 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=b46cc1bb-f162-40bd-a563-f70756bf6ade
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
x-amz-version-id
mi4mtB4aFvR25WPQCmnfUnVk6AWhr_W6
cf-cache-status
HIT
x-amz-request-id
2HMTVDXWHRZ097M7
age
10847203
x-amz-server-side-encryption
AES256
content-length
105804
x-amz-id-2
YD0z6E8yfMvUoX00yyhaPzBel56CXdfQkpFrBSUa2Gb4Y85wQsKNp3wT67eM7XPXdMbk10RgCP0=
last-modified
Fri, 28 Apr 2023 01:11:03 GMT
server
cloudflare
etag
"007ad31a53f4ab3f58ee74f2308482ce"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff7681b5c0f1c13-FRA
expires
Sat, 31 Aug 2024 00:41:16 GMT
birdInFlight-flipped-975x975-1.jpg
redcanary.com/wp-content/uploads/2022/03/
18 KB
18 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2022/03/birdInFlight-flipped-975x975-1.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 07 Mar 2022 19:56:58 GMT
server
nginx
etag
"6226638a-460b"
vary
Accept-Encoding
x-wpe-request-id
d4466d3ba55e80252cbe63d2b109793a
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
17931
TDR-Header01-1200w.jpg
redcanary.com/wp-content/uploads/2023/03/
339 KB
340 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Header01-1200w.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 20:12:02 GMT
server
nginx
etag
"6418be12-54b50"
vary
Accept-Encoding
x-wpe-request-id
e0f735593c1dc9ecdcbaee763e3db04f
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
346960
Icon_Alert-Center_Investigation.svg
redcanary.com/wp-content/uploads/2020/09/
4 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2020/09/Icon_Alert-Center_Investigation.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 24 Sep 2020 17:12:27 GMT
server
nginx
etag
W/"5f6cd37b-e55"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
7100ffbba5be21691e1bbad8c2f3aba7
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
source-sans-pro-v21-latin-600.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:23 GMT
server
nginx
etag
"6298f2bf-32fc"
vary
Accept-Encoding
x-wpe-request-id
09960edadcc5bbfafec2cb3eb1642cdf
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13052
/
sentry.io/api/1332833/envelope/ Frame EFDC
2 B
324 B
Fetch
General
Full URL
https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1
Requested by
Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
156.247.186.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.qualified.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 31 Aug 2023 18:41:16 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
server
nginx
vary
origin,access-control-request-method,access-control-request-headers
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
1
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:41:18 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 58EF
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:41:17 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 58EF
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:41:17 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:41:17 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
getuidj
secure.adnxs.com/
29 B
698 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
397f714b2824f04310d0b974a6eba38eae535faf4ffe14ab8150a1f885ba11fa
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:18 GMT
an-x-request-uuid
61f2a620-abb2-4ca9-a492-5abaca00e475
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/json; charset=utf-8
access-control-allow-origin
https://redcanary.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
81.95.5.40; 81.95.5.40; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
29
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
191 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:18 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
14 B
298 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:e300::5f64:9219 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
0cbee5f32eeccb2fd9d710b78a7cdfc0293adb361f1675e3db04be4c01f3344c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:18 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:2b::8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693507278299_1600426517_564016066_16_896_13_0_219";dur=1
content-length
14
expires
Thu, 31 Aug 2023 18:41:18 GMT
optimize.js
www.google-analytics.com/gtm/
124 KB
48 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:18 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
49085
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:41:18 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=062c1715-a7fc-4e2a-8e65-12fa61f25fee&session=b53a2736-67be-4495-8570-2cca8a4ff687&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2b%3A%3A8%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=18701cea-d77b-408c-842f-7264563a1023&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:18 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=062c1715-a7fc-4e2a-8e65-12fa61f25fee&session=b53a2736-67be-4495-8570-2cca8a4ff687&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A13%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A41%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A41%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A41%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=18701cea-d77b-408c-842f-7264563a1023&an_uid=4634038059651114651&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:18 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 17:49:43 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
3095
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Thu, 31 Aug 2023 19:49:43 GMT
collect
www.google-analytics.com/j/
4 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1957396061&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=1072270173&gjid=1144952996&cid=1377206414.1693507274&tid=UA-52702906-1&_gid=693537002.1693507278&_r=1&_slc=1&gtm=45He38u0n81PXWC8JW&cd18=null&z=1408835098
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
151 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-52702906-1&cid=1377206414.1693507274&jid=1072270173&gjid=1144952996&_gid=693537002.1693507278&_u=YADAAEAAQAAAACAAI~&z=413281735
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aceb906b19be5a14a045dc9d5c9b04b948ef85f4aff28394e7453bea3c3d9422
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:41:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=1377206414.1693507274&jid=1072270173&_u=YADAAEAAQAAAACAAI~&z=1645081212
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:18 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.gr/ads/
42 B
63 B
Image
General
Full URL
https://www.google.gr/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=1377206414.1693507274&jid=1072270173&_u=YADAAEAAQAAAACAAI~&z=1645081212
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:18 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
details
epsilon.6sense.com/v3/company/
740 B
578 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.204.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-204-254.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
d7d62f1b6fc6f96998066b32b4d71d1ad2f1b399758f0e429398306f7571fa3d

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
Authorization
Token e8bebcdaa132f727ae8d16d9967447769318945e
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
X-6s-CustomID
WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a

Response headers

date
Thu, 31 Aug 2023 18:41:18 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
content-length
395
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.204.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-204-254.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://redcanary.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://redcanary.com
access-control-max-age
1800
date
Thu, 31 Aug 2023 18:41:18 GMT
server
nginx
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=1957396061&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aADAAEABQAAAACAAI~&jid=&gjid=&cid=1377206414.1693507274&tid=UA-52702906-1&_gid=693537002.1693507278&gtm=45He38u0n81PXWC8JW&cd4=&cd5=&cd10=&cd11=&cd20=&z=1129793800
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 30 Aug 2023 23:10:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
70233
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame EFDC
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.132.250 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:41:19 GMT
Last-Modified
Thu, 20 Oct 2022 23:47:27 GMT
Server
AmazonS3
x-amz-request-id
VYCT0FJRS5PZBG7R
ETag
"fd481ec600c1b3fad6f9e29aa732a946"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
12932
x-amz-id-2
+y8pEuIpLIUTtKbgSNNpqyqBSI7WNzwGbgkh6td5Fh0W7oWYOl3Sq3rFaZ9FPYfJqYK18ucdQkw=
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je38u0&_p=1957396061&cid=1377206414.1693507274&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EEA&_s=2&sid=1693507273&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&en=scroll&epn.percent_scrolled=90&_et=3
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:41:18 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame EFDC
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.132.250 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:41:20 GMT
Last-Modified
Thu, 20 Oct 2022 23:48:08 GMT
Server
AmazonS3
x-amz-request-id
WMQR2J9SN1ZV00QF
ETag
"7797b96a7f999ac42de528bede3329af"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
13099
x-amz-id-2
qycur3njcmEmLwGdx9FAqa2Dd6jn1eu986Req55JBQrnq+CnO9R5LtjGqRyYCideTxwpxSfU+rY=
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=062c1715-a7fc-4e2a-8e65-12fa61f25fee&session=b53a2736-67be-4495-8570-2cca8a4ff687&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A13%20GMT%22%2C%22timeSpent%22%3A%225380%22%2C%22totalTimeSpent%22%3A%225380%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=18701cea-d77b-408c-842f-7264563a1023&an_uid=4634038059651114651&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:19 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=062c1715-a7fc-4e2a-8e65-12fa61f25fee&session=b53a2736-67be-4495-8570-2cca8a4ff687&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226381%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=18701cea-d77b-408c-842f-7264563a1023&an_uid=4634038059651114651&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:20 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=062c1715-a7fc-4e2a-8e65-12fa61f25fee&session=b53a2736-67be-4495-8570-2cca8a4ff687&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227382%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=18701cea-d77b-408c-842f-7264563a1023&an_uid=4634038059651114651&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:21 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
483 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=062c1715-a7fc-4e2a-8e65-12fa61f25fee&session=b53a2736-67be-4495-8570-2cca8a4ff687&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A21%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228383%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=18701cea-d77b-408c-842f-7264563a1023&an_uid=4634038059651114651&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:22 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=062c1715-a7fc-4e2a-8e65-12fa61f25fee&session=b53a2736-67be-4495-8570-2cca8a4ff687&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A41%3A22%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229384%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=18701cea-d77b-408c-842f-7264563a1023&an_uid=4634038059651114651&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.142.65 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-142-65.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:41:23 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

98 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| documentPictureInPicture function| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| MktoForms2 object| dataLayer object| _6si function| gtag string| QualifiedObject function| qualified object| Bizible object| BizTrackingA object| BizA boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_SITE_DATA_URL string| CE_USER_DATA_URL object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal string| CE_USER_COMMON_SCRIPT_URL string| CE_USER_THIRDPARTY_SCRIPT_URL function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| webpackChunkCE2 object| CE2BH function| CE_URL_FINGERPRINT object| CE_API object| MunchkinTracker function| postscribe object| google_tag_manager_external function| twq string| _linkedin_data_partner_id function| rdt object| GooglebQhCsO function| fbq function| _fbq function| getParam function| getExpiryRecord function| addGclid object| hljs object| theme_ajax_object object| lazyLoadOptions object| regeneratorRuntime object| twttr object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels function| UET function| UET_init function| UET_push function| lintrk boolean| _already_called_lintrk object| ueto_1cfb63777d object| uetq boolean| _q_widgetInitialized object| FormsPlus undefined| Cookies undefined| URI object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| webpackChunknylon function| LazyLoad object| images boolean| is_image object| iframes boolean| is_iframe object| rocket_lazy object| _vis_opt_queue object| LC_API string| _q_lastClientActivityAt string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed string| GoogleAnalyticsObject function| ga object| google_optimize object| gaplugins object| gaData boolean| _storagePopulated

45 Cookies

Domain/Path Name / Value
.resource.redcanary.com/ Name: __cf_bm
Value: nMXG3eJMifKBcjhNeVpItdfiOTA8gGGO9z2KmmHMMSw-1693507273-0-AXaZdL8qgIwlDylPmRhbWwwrjx4W0eXF0qEphAWp1KeCESQ6muYfH00TQ/bzCdocbN8t0NjSw4Hj0kNTmfA2tL0=
.redcanary.com/ Name: _biz_uid
Value: 55a6e28369a64f1e8fd566f5c25c450b
.redcanary.com/ Name: _biz_sid
Value: 8eac7
.redcanary.com/ Name: _ga_T3K4MTNQJN
Value: GS1.1.1693507273.1.0.1693507273.60.0.0
.redcanary.com/ Name: _mkto_trk
Value: id:003-YRU-314&token:_mch-redcanary.com-1693507273902-76690
.redcanary.com/ Name: _gcl_au
Value: 1.1.1436054422.1693507274
.spotify.com/ Name: sp_t
Value: 54566f1612fe852016bdbe03b62dd92b
.spotify.com/ Name: sp_landing
Value: https%3A%2F%2Fredcanary.com%2F%3Fsp_cid%3D54566f1612fe852016bdbe03b62dd92b%26device%3Ddesktop
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.redcanary.com/ Name: _rdt_uuid
Value: 1693507274141.159c186f-29f7-4eae-9a47-94670116110b
.t.co/ Name: muc_ads
Value: 4b2ac1a1-2c6e-4e2b-af68-53db85a544a7
.redcanary.com/ Name: _fbp
Value: fb.1.1693507274302.1066590325
.twitter.com/ Name: personalization_id
Value: "v1_Uqvu1hKmpxT+ceKB/RkdNA=="
redcanary.com/ Name: ln_or
Value: eyIxNTQwNzUzIjoiZCJ9
.linkedin.com/ Name: li_sugr
Value: d772c85a-1dcf-422a-88fb-5a5dd5455b5e
.linkedin.com/ Name: bcookie
Value: "v=2&4c321a40-a06e-4461-877b-af73c70c773f"
.linkedin.com/ Name: lidc
Value: "b=VGST03:s=V:r=V:a=V:p=V:g=2948:u=1:x=1:i=1693507274:t=1693593674:v=2:sig=AQEszFZW8PrjJf5v7yt5dj_IRam7HdYt"
.adnxs.com/ Name: uuid2
Value: 4634038059651114651
.linkedin.com/ Name: UserMatchHistory
Value: AQLPj2IY0q02KAAAAYpM5kbqZYqkLxANmE3FZEfynYvxvf8szt03PkFRPjLQQfsdgbdWBMIxfGuBAw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKoRDcnp22v-wAAAYpM5kbqAIWo4sqgSVJg2LjFkqsZbVGzPfKYp9DjtlC6_9Xi6-HtyyIMAY_t787jze1OfA
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230831184114239ed5c8-408c-4936-821b-6278bc71e670AQGG3pzYLMw11U-xV8kOP5u3tjj_9UDp"
.linkedin.com/ Name: li_gc
Value: MTswOzE2OTM1MDcyNzQ7MjswMjFniuzrmBMK+1syHd8GdGdM8Hlb6yS84G0S5RGb0Gs6ig==
.redcanary.com/ Name: _uetsid
Value: f6d088a0482d11ee8970992e0dbde4ec
.redcanary.com/ Name: _uetvid
Value: f6d0a0a0482d11eebbb75fce942b91d7
.bing.com/ Name: MUID
Value: 3647A12452B26EAC31BEB25A53396FD2
.redcanary.com/ Name: cebs
Value: 1
.redcanary.com/ Name: _ce.s
Value: v~d37290a18923502c5d774f0101c22591b3089c6d~lcw~1693507274695~vpv~0~lcw~1693507274696
.redcanary.com/ Name: _ce.clock_event
Value: 1
.redcanary.com/ Name: _biz_nA
Value: 2
.bizibly.com/ Name: _BUID
Value: 433052c9f8694b506cdf99837b2e2b55
.bizible.com/ Name: _BUID
Value: 55a6e28369a64f1e8fd566f5c25c450b
redcanary.com/ Name: cookielawinfo-checkbox-necessary
Value: yes
redcanary.com/ Name: cookielawinfo-checkbox-non-necessary
Value: yes
.redcanary.com/ Name: _ce.clock_data
Value: 113%2C81.95.5.40%2C1%2C0f286e8f7fa153358c622af13d09b529
.redcanary.com/ Name: cebsp_
Value: 1
.redcanary.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.redcanary.com/ Name: _biz_pendingA
Value: %5B%5D
redcanary.com/ Name: _gd_visitor
Value: 062c1715-a7fc-4e2a-8e65-12fa61f25fee
redcanary.com/ Name: _gd_session
Value: b53a2736-67be-4495-8570-2cca8a4ff687
redcanary.com/ Name: _an_uid
Value: 4634038059651114651
.redcanary.com/ Name: _ga
Value: GA1.2.1377206414.1693507274
.redcanary.com/ Name: _gid
Value: GA1.2.693537002.1693507278
.redcanary.com/ Name: _gat_UA-52702906-1
Value: 1
.6sc.co/ Name: 6suuid
Value: 3d8e140284723d00cedef0642c020000b7e30000
.redcanary.com/ Name: __q_state_bAEbi2aHVysBKzuy
Value: eyJ1dWlkIjoiYjQ2Y2MxYmItZjE2Mi00MGJkLWE1NjMtZjcwNzU2YmY2YWRlIiwiY29va2llRG9tYWluIjoicmVkY2FuYXJ5LmNvbSIsIm1lc3NlbmdlckV4cGFuZGVkIjpmYWxzZSwicHJvbXB0RGlzbWlzc2VkIjpmYWxzZSwiY29udmVyc2F0aW9uSWQiOiIxMjE0NDA4OTM3MTU2NjY1NTQ4In0=

3 Console Messages

Source Level URL
Text
other warning URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/(Line 306)
Message:
Allow attribute will take precedence over 'allowfullscreen'.
javascript warning URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Message:
It is recommended that a robustness level be specified. Not specifying the robustness level could result in unexpected behavior.
javascript verbose URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js(Line 1)
Message:
Rendering was performed in a subtree hidden by content-visibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
ajax.googleapis.com
alb.reddit.com
analytics.twitter.com
app.qualified.com
apresolve.spotify.com
assets.qualified.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
connect.facebook.net
embed-cdn.spotifycdn.com
encore.scdn.co
epsilon.6sense.com
fonts.googleapis.com
gew4-spclient.spotify.com
googleads.g.doubleclick.net
i.scdn.co
ipv6.6sc.co
j.6sc.co
js.qualified.com
munchkin.marketo.net
open.spotify.com
px.ads.linkedin.com
px4.ads.linkedin.com
qualified-production.s3.us-east-1.amazonaws.com
redcanary.com
region1.analytics.google.com
resource.redcanary.com
s.ml-attr.com
s3-us-west-2.amazonaws.com
script.crazyegg.com
secure.adnxs.com
sentry.io
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tracking.crazyegg.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.gr
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
104.17.71.206
104.198.136.223
104.244.42.3
104.244.42.69
104.64.124.188
13.107.42.14
146.75.116.157
151.101.1.140
152.195.15.58
185.89.210.212
192.28.147.68
2.20.142.65
2001:4860:4802:32::36
2600:1901:0:524d::
2600:1901:1:81::
2600:1901:1:c36::
2600:9000:20c3:4600:12:3734:2a40:93a1
2600:9000:26db:fa00:2:53b2:240:93a1
2606:4700::6811:180e
2606:4700::6812:1005
2606:4700::6812:1105
2606:4700::6813:9308
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:802::2003
2a00:1450:4001:802::200a
2a00:1450:4001:806::2008
2a00:1450:4001:811::2004
2a00:1450:4001:828::200a
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2002
2a00:1450:400c:c07::9b
2a02:26f0:280:3::213:789e
2a02:26f0:3500:16::215:149b
2a02:26f0:e300::5f64:9219
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a04:4e42:200::396
2a04:4e42:8d::760
2a04:4e42:8d::762
35.186.247.156
52.18.119.10
52.204.253.158
52.58.204.254
52.92.152.120
54.231.132.250
68.67.153.60
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5
0cbee5f32eeccb2fd9d710b78a7cdfc0293adb361f1675e3db04be4c01f3344c
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
397f714b2824f04310d0b974a6eba38eae535faf4ffe14ab8150a1f885ba11fa
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
71b438c3f1dce4a2adc5da680c742d393b36d82d1494194d799475a2550bd9fd
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33
8ea04aff1e26b3002a0e8f9a752c39d12eba28cb176ef120639cbcda0e8181f1
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22
a12f2c5b62db43b9b29a5be7342e0e4813e9c2da81d72f806b9cb29289f188fa
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e
a5ee554b456a8011af8f8ae22a4ff122e0d20d7bad5b720e4f2cbeb63af9db79
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aceb906b19be5a14a045dc9d5c9b04b948ef85f4aff28394e7453bea3c3d9422
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6
b53ab548d004bc41e5b4e13e007727310d5800a6713b7871e2cd0312ff7952ce
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c15f51cf77e5f05d6a774886bee79c0e75a3d1fdb0a2662ab1c48600562efe4a
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d
cca95ef2a816865f55df96aedf861e29dd6dbe5c7c968a53de535de77089c6ee
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
d31de08a2b682d4536faf9c2a3077992737ea91b7ad380130d0c16c691a45ebc
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
d54424037c8c20ce9ac78f6fb53935664f6b055fd7a27d3573fb792908f5641f
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
d7d62f1b6fc6f96998066b32b4d71d1ad2f1b399758f0e429398306f7571fa3d
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2ca5ac3d9cf4d005d7294562694e44b40efd2c194722721a52743c2f43f1a6
f1d4b7e28e37dd7d9a576c9b49f998374ed3a3d34a3e8cf865fa134a8486f14c
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1
f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
f9776436ba0bf509095e148fe165af228c9a00e2b76aa8e51c0dcbed4ff1de7d
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a