urlscan.io logo urlscan.io
SecurityTrails logo

www.fortinet.com Open in urlscan Pro
52.9.67.191  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Submission: On July 16 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 5 countries across 12 domains to perform 40 HTTP transactions. The main IP is 52.9.67.191, located in San Jose, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on March 19th 2019. Valid for: 2 years.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 14 52.9.67.191 16509 (AMAZON-02)
2 2.19.43.118 20940 (AKAMAI-ASN1)
8 2.21.37.83 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:6ea0:cf0... 60068 (CDN77)
1 34.202.169.36 14618 (AMAZON-AES)
1 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
40 9
14    52.9.67.191 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-9-67-191.us-west-1.compute.amazonaws.com
www.fortinet.com
2    2.19.43.118 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com
platform-api.sharethis.com
buttons-config.sharethis.com
8    2.21.37.83 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-37-83.deploy.static.akamaitechnologies.com
assets.adobedtm.com
1    2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
2    2a00:1450:4001:81f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a02:6ea0:cf04::2 (United Kingdom)

ASN60068 (CDN77, GB)
cdn.omniconvert.com
1    34.202.169.36 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-202-169-36.compute-1.amazonaws.com
count-server.sharethis.com
1    2a02:26f0:10c:38f::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
sjs.bizographics.com
Domain Requested by
14 www.fortinet.com 3 redirects www.fortinet.com
8 assets.adobedtm.com www.fortinet.com
assets.adobedtm.com
2 www.google-analytics.com www.googletagmanager.com
www.fortinet.com
1 sjs.bizographics.com www.googletagmanager.com
1 count-server.sharethis.com platform-api.sharethis.com
1 cdn.omniconvert.com assets.adobedtm.com
1 www.googletagmanager.com www.fortinet.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com www.fortinet.com
0 fortinet.tt.omtrdc.net Failed assets.adobedtm.com
0 app.omniconvert.com Failed cdn.omniconvert.com
0 s.adroll.com Failed www.googletagmanager.com
0 a.optmnstr.com Failed www.googletagmanager.com
0 platform-cdn.sharethis.com Failed www.fortinet.com
0 c.sharethis.mgr.consensu.org Failed platform-api.sharethis.com
0 dpm.demdex.net Failed assets.adobedtm.com
40 16
Subject Issuer Validity Valid
www.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-03-19 -
2021-06-09		 2 years crt.sh
*.sharethis.com
DigiCert SHA2 Secure Server CA		 2018-12-16 -
2020-03-16		 a year crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA		 2019-06-27 -
2021-07-01		 2 years crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-06-18 -
2019-09-10		 3 months crt.sh
cdn.omniconvert.com
Let's Encrypt Authority X3		 2019-06-24 -
2019-09-22		 3 months crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA		 2018-04-13 -
2020-04-17		 2 years crt.sh

This page contains 5 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Frame ID: D16D8D8F6EACA5960B64DB88A7578844
Requests: 38 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 1B1155B6328533A34018E7A63994425E
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Frame ID: CCA9D38FAD1A267BC1C2E693BA15C7FD
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Frame ID: DDEE981054B62A8DF1B3BDC40129E423
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Frame ID: 382342D0AEF409C61E0D7B079D175654
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /(?:a|s)\.adroll\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/\/assets.adobedtm.com\//i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<!-- (?:End )?Google Tag Manager -->/i
Overall confidence: 100%
Detected patterns
  • script /\/s[_-]code.*\.js/i

Page Statistics

40
Requests

68 %
HTTPS

50 %
IPv6

12
Domains

16
Subdomains

9
IPs

5
Countries

1425 kB
Transfer

2321 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1086110147.img.png HTTP 301
  • https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1086110147.img.png
Request Chain 33
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1392962615.img.png HTTP 301
  • https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1392962615.img.png
Request Chain 34
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1944375857.img.png HTTP 301
  • https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1944375857.img.png

40 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request icedid-malware-analysis-part-two.html
www.fortinet.com/blog/threat-research/ 		55 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
3b00b1796a43d5546f7db7afc2173bfa8479731090096f8511e5a77c4bc90002
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.fortinet.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=600, public
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 16 Jul 2019 19:11:05 GMT
ETag
"da3a-58dd0bb6930a8-gzip"
Last-Modified
Tue, 16 Jul 2019 18:42:00 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Length
11645
Connection
keep-alive
clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		212 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
29f41d54055e58ed9dc430f8fe9963a7c5b25c8a5898faec74f6336df470f165
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:05 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 15 Jul 2019 17:35:18 GMT
Server
Apache
ETag
"350ee-58dbbaf022ed0-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
text/css
Cache-Control
max-age=43200, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
16944
X-XSS-Protection
1; mode=block
sharethis.js
platform-api.sharethis.com/js/ 		87 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
46872a8d05ef5bd483919c20e84f584cc89ec0d3b759a016f9d066a437948dda

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:05 GMT
Content-Encoding
gzip
ETag
W/"15bde-KdkKaAGz3tBIemwvctebjNKVKuE"
Vary
Accept-Encoding
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
27547
satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		147 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
415d4d0b74937146bbb7aad206f48c524e48d5785fbffd63b377d2b6dfa0a98e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 16 Jul 2019 19:11:06 GMT
content-encoding
gzip
last-modified
Mon, 15 Jul 2019 17:38:06 GMT
server
Apache
etag
"1e4d852aa4678d1ccba14aad4c16e65b:1563212286"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 16 Jul 2019 20:11:06 GMT
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:05 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 15 Jul 2019 17:36:27 GMT
Server
Apache
ETag
"7ebb-58dbbb3279079-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
1998
X-XSS-Protection
1; mode=block
clientlib-base.min.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		165 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:05 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 15 Jul 2019 17:36:24 GMT
Server
Apache
ETag
"2931b-58dbbb2f65e86-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/javascript
Cache-Control
max-age=43200, public
transfer-encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
X-XSS-Protection
1; mode=block
5977d47080bb1d0011ab6d8f.js
buttons-config.sharethis.com/js/ 		444 B
865 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5977d47080bb1d0011ab6d8f.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:05 GMT
Last-Modified
Tue, 16 Jan 2018 20:14:52 GMT
Server
AmazonS3
x-amz-request-id
33BF777283B6DCED
ETag
"6167cc13570c31ffc1713616a6fb087d"
Content-Type
text/javascript
Cache-Control
public, max-age=60
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
444
x-amz-id-2
hsILMaWrKRvq3dU3rIiiMpbXCpEB1o2SKOTVgl6vRXE0vKuZmuHru/osDcmeuqMHuHCSYNUlvNc=
gtm.js
www.googletagmanager.com/ 		63 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ba07afd991b9af8f3873d78cd30bd64f603bd55ba4218658f3aed086b8af024b
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 16 Jul 2019 19:11:05 GMT
content-encoding
br
last-modified
Tue, 16 Jul 2019 18:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23931
x-xss-protection
0
expires
Tue, 16 Jul 2019 19:11:05 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 20 Jun 2019 21:35:04 GMT
server
Golfe2
age
6206
date
Tue, 16 Jul 2019 17:27:39 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17707
expires
Tue, 16 Jul 2019 19:27:39 GMT
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j77&a=923918585&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ficedid-malware-analysis-part-two.html&ul=en-us&de=UTF-8&dt=A%20Deep%20Dive%20Into%20IcedID%20Malware%3A%20Part%20II%20-%20Analysis%20of%20the%20Core%20IcedID%20Payload%20(Parent%20Process)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAAB~&jid=761435059&gjid=1413574556&cid=104490882.1563304266&tid=UA-767980-6&_gid=1302571388.1563304266&_r=1&gtm=2wg7a0NBSLLPJ&z=425046141
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 16 Jul 2019 19:11:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
id
dpm.demdex.net/ 		0
0
mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 16 Jul 2019 19:11:06 GMT
content-encoding
gzip
last-modified
Mon, 15 Jul 2019 17:38:06 GMT
server
Apache
etag
"eb6d969848d866a39a78150c4a347735:1563212286"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
27590
expires
Tue, 16 Jul 2019 20:11:06 GMT
satellite-5cc2479e64746d71bb001113.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ 		639 B
558 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5cc2479e64746d71bb001113.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
97d587ffd230ea0166ff97d4b9a5e513f99590e36c168566d8993f37b8fb6ff7

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 16 Jul 2019 19:11:06 GMT
content-encoding
gzip
last-modified
Mon, 15 Jul 2019 17:38:08 GMT
server
Apache
etag
"509600c70b4deb0e384b1ee713162637:1563212288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
325
expires
Tue, 16 Jul 2019 20:11:06 GMT
truncated
/ 		71 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
icedtwo-fig-eight.png
www.fortinet.com/content/dam/fortinet-blog/article-images/icedid-analysis-two/ 		358 KB
358 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/icedid-analysis-two/icedtwo-fig-eight.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
a4b9f10ef3e64da899a1524cc53feb238338825f294f7f5888016389e52cc2d0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:06 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 16 Jul 2019 17:07:13 GMT
Server
Apache
ETag
"597e6-58dcf687017ee"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
366566
X-XSS-Protection
1; mode=block
icedid-fig-two.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/icedid-malware-analysis/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/icedid-malware-analysis/icedid-fig-two.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
602a797227cdb6b1cc2161b8fc2ed0bfb7e91d18693dd0341922ac60f881ee46
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:06 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 16 Jul 2019 17:09:09 GMT
Server
Apache
ETag
"af94-58dcf6f5f357f"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
44948
X-XSS-Protection
1; mode=block
fortinet_quarterly_threat_landscape_report_battle_against_cybercrime_continues_to_escalate.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 		200 KB
200 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/fortinet_quarterly_threat_landscape_report_battle_against_cybercrime_continues_to_escalate.jpg.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
e24ff7b3bf64f39822bf3e91f8c6779b12e993ef544739bfaf8d492371c1f5ec
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:07 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 15 Jul 2019 17:53:26 GMT
Server
Apache
ETag
"31e9d-58dbbefe78592"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
204445
X-XSS-Protection
1; mode=block
sstic-2017-in-a-nutshell.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 		117 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/sstic-2017-in-a-nutshell.jpg.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
aa698da44354a1e326d721d504704e31cbbdc54c6244a210276c01d703860f36
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:07 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 15 Jul 2019 17:53:26 GMT
Server
Apache
ETag
"1d536-58dbbefe83943"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
120118
X-XSS-Protection
1; mode=block
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 1B11 		0
0
ze8e288.js
cdn.omniconvert.com/js/ 		309 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.omniconvert.com/js/ze8e288.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5cc2479e64746d71bb001113.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:cf04::2 , United Kingdom, ASN60068 (CDN77, GB),
Reverse DNS
Software
BunnyCDN-DE1-540 /
Resource Hash
77bbafe831a76fd691284bf3cbe42c8a7bf44f569a8dda50d8d7e727f9712672

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 16 Jul 2019 19:11:06 GMT
content-encoding
br
cdn-edgestorageid
540
status
200
cdn-cachedat
2019-07-16 21:10:46
cdn-pullzone
50707
x-cache-sr-miss
0
last-modified
Tue, 16 Jul 2019 19:10:46 GMT
server
BunnyCDN-DE1-540
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
x-cache-sr-hit
9
cdn-uid
a414a5a9-9113-4a32-adb9-1a38230f6340
cache-control
public, max-age=180
cdn-requestcountrycode
DE
x-cache-cr-hit
0
cdn-requestid
2c21c48de5d57f4c8deec3706b6b4659
x-machine
Tracking-PROD-2
x-cache-cr-miss
0
x-robots-tag
noindex, nofollow, nosnippet, noarchive
cdn-cache
HIT
satellite-5aa864a164746d58b700412b.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame CCA9 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html

Response headers

status
200
server
Apache
etag
"52fa849a16651953dc915efbae88d0cc:1563212291"
last-modified
Mon, 15 Jul 2019 17:38:11 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
803
cache-control
max-age=3600
expires
Tue, 16 Jul 2019 20:11:06 GMT
date
Tue, 16 Jul 2019 19:11:06 GMT
timing-allow-origin
*
satellite-5aa864f264746d7629003a65.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame DDEE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html

Response headers

status
200
server
Apache
etag
"8227658d1e33b9eaa91028e35c3beb4f:1563212291"
last-modified
Mon, 15 Jul 2019 17:38:11 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
782
cache-control
max-age=3600
expires
Tue, 16 Jul 2019 20:11:06 GMT
date
Tue, 16 Jul 2019 19:11:06 GMT
timing-allow-origin
*
satellite-5aa8640864746d58b700411f.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 3823 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html

Response headers

status
200
server
Apache
etag
"94b6dd03c710fe7140881c36dbb5ab47:1563212291"
last-modified
Mon, 15 Jul 2019 17:38:11 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
899
cache-control
max-age=3600
expires
Tue, 16 Jul 2019 20:11:06 GMT
date
Tue, 16 Jul 2019 19:11:06 GMT
timing-allow-origin
*
s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 16 Jul 2019 19:11:06 GMT
content-encoding
gzip
last-modified
Mon, 15 Jul 2019 17:38:06 GMT
server
Apache
etag
"9a1e762486f8afef7a6f384a1e9c253d:1563212286"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
13170
expires
Tue, 16 Jul 2019 20:11:06 GMT
get_counts
count-server.sharethis.com/v2.0/ 		250 B
356 B 		Script
General
Check archive.org
Download Go to
Full URL
https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ficedid-malware-analysis-part-two.html&refDomain=www.fortinet.com&sop=true
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.169.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-202-169-36.compute-1.amazonaws.com
Software
/
Resource Hash
095c63e7deb6acec556041607fa92383ff50ebd2f64f0b4ce244071d736f4542

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:22 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
199
Content-Type
application/json
facebook.svg
platform-cdn.sharethis.com/img/ 		0
0
twitter.svg
platform-cdn.sharethis.com/img/ 		0
0
linkedin.svg
platform-cdn.sharethis.com/img/ 		0
0
email.svg
platform-cdn.sharethis.com/img/ 		0
0
sharethis.svg
platform-cdn.sharethis.com/img/ 		0
0
arrow_left.svg
platform-cdn.sharethis.com/img/ 		0
0
arrow_right.svg
platform-cdn.sharethis.com/img/ 		0
0
satellite-59ceae2064746d21fe0037dd.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ 		1 KB
692 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-59ceae2064746d21fe0037dd.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 16 Jul 2019 19:11:06 GMT
content-encoding
gzip
last-modified
Mon, 15 Jul 2019 17:38:09 GMT
server
Apache
etag
"d8619d86a5e27900726ec96a76ead3cc:1563212290"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
459
expires
Tue, 16 Jul 2019 20:11:06 GMT
image_1086110147.img.png
www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/
Redirect Chain
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1086110147.img.png
  • https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1086110147.img.png
161 KB
161 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1086110147.img.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
2bed61c5abc85c1258c3b5b5bd7994fa5f67fab78c99498e5533bff154810521
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:07 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 16 Jul 2019 17:11:33 GMT
Server
Apache
ETag
"2832c-58dcf77f05ea7"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
164652
X-XSS-Protection
1; mode=block

Redirect headers

Location
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1086110147.img.png
Date
Tue, 16 Jul 2019 19:11:07 GMT
Server
Apache
Connection
keep-alive
Content-Length
344
Content-Type
text/html; charset=iso-8859-1
image_1392962615.img.png
www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/
Redirect Chain
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1392962615.img.png
  • https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1392962615.img.png
106 KB
106 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1392962615.img.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
aa575469dc2d0e558e32fe60024625c352a4ac0c1acb7ebb15547c08772f0fb3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:07 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 16 Jul 2019 17:09:10 GMT
Server
Apache
ETag
"1a638-58dcf6f6f1dc0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
108088
X-XSS-Protection
1; mode=block

Redirect headers

Location
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1392962615.img.png
Date
Tue, 16 Jul 2019 19:11:07 GMT
Server
Apache
Connection
keep-alive
Content-Length
344
Content-Type
text/html; charset=iso-8859-1
image_1944375857.img.png
www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/
Redirect Chain
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1944375857.img.png
  • https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1944375857.img.png
97 KB
98 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1944375857.img.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.9.67.191 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-9-67-191.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
dbb524ca8eda9eff2fa0e45797e71bfd33108e154f70457ccecedd187ec83424
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:07 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 16 Jul 2019 17:09:10 GMT
Server
Apache
ETag
"185b7-58dcf6f6f1fc7"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
99767
X-XSS-Protection
1; mode=block

Redirect headers

Location
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two/_jcr_content/root/responsivegrid/image_1944375857.img.png
Date
Tue, 16 Jul 2019 19:11:07 GMT
Server
Apache
Connection
keep-alive
Content-Length
344
Content-Type
text/html; charset=iso-8859-1
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
api.min.js
a.optmnstr.com/app/js/ 		0
0
roundtrip.js
s.adroll.com/j/ 		0
0
insight.min.js
sjs.bizographics.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:10c:38f::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer
https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 16 Jul 2019 19:11:08 GMT
Content-Encoding
gzip
Last-Modified
Mon, 03 Dec 2018 23:03:30 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=43345
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
mktzsave
app.omniconvert.com/ 		0
0
json
fortinet.tt.omtrdc.net/m2/fortinet/mbox/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
dpm.demdex.net
URL
https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1563304266715
Domain
c.sharethis.mgr.consensu.org
URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Domain
platform-cdn.sharethis.com
URL
https://platform-cdn.sharethis.com/img/facebook.svg
Domain
platform-cdn.sharethis.com
URL
https://platform-cdn.sharethis.com/img/twitter.svg
Domain
platform-cdn.sharethis.com
URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Domain
platform-cdn.sharethis.com
URL
https://platform-cdn.sharethis.com/img/email.svg
Domain
platform-cdn.sharethis.com
URL
https://platform-cdn.sharethis.com/img/sharethis.svg
Domain
platform-cdn.sharethis.com
URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Domain
platform-cdn.sharethis.com
URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Domain
a.optmnstr.com
URL
https://a.optmnstr.com/app/js/api.min.js
Domain
s.adroll.com
URL
https://s.adroll.com/j/roundtrip.js
Domain
app.omniconvert.com
URL
https://app.omniconvert.com/mktzsave?event=view&uid=5728443301572738723&session=sess.2.322693093.1563304267076&id_website=19830&page_url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ficedid-malware-analysis-part-two.html&svo=0&time=2019-07-16T21%3A11%3A07%2B02%3A00&version=5kgmf3u57mo088coggowwwk0k&versionTimestamp=1563304246&browser=Chrome+74&resolution=1600x1200&device_type=desktop&referer_type=direct&visitor_type=new&os=Linux
Domain
fortinet.tt.omtrdc.net
URL
https://fortinet.tt.omtrdc.net/m2/fortinet/mbox/json?mbox=target-global-mbox&mboxSession=78baafc6aa56464f8b50404db80420c2&mboxPC=&mboxPage=db4e20f3a4444952af0219dbe0340399&mboxRid=0dc59cd6b4744470b4528b63e0c20af0&mboxVersion=1.6.4&mboxCount=1&mboxTime=1563311466853&mboxHost=www.fortinet.com&mboxURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ficedid-malware-analysis-part-two.html&mboxReferrer=&browserHeight=1200&browserWidth=1585&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=0086987C524F80CC-1F2A2D74F2C669EC&vst.trk=nsmetrics.fortinet.com&vst.trks=metrics.fortinet.com

Verdicts & Comments Add Verdict or Comment

124 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| dataLayer function| postscribe object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| e function| Visitor object| _satellite object| s_c_il number| s_c_in function| targetPageParams object| _mktz object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| csCookies object| cookieScriptWindow object| cookieScripts string| cookieScriptSrc function| cookieQuery string| cookieScriptPosition string| cookieScriptSource string| cookieScriptDomain string| cookieScriptReadMore string| cookieId number| cookieScriptDebug boolean| cookieScriptShowBadge string| cookieScriptCurrentUrl string| pagePath string| cookieScriptTitle string| cookieScriptDesc string| cookieScriptAccept string| cookieScriptMore string| cookieScriptCopyrights string| cookieBackground function| setImmediate function| clearImmediate function| $ function| jQuery undefined| Cookies string| cookieScriptReject function| cookieScriptLoadJavaScript function| InjectCookieScript string| cookieScriptStatsDomain function| cookieScriptCreateCookie function| cookieScriptReadCookie function| cookieScriptAddBox object| cookieScriptCurrentValue string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| t function| _omni string| mktz_nocache object| _old_mktz object| mktz_d object| _mktz_params object| _mktz_features function| _mktzInteract object| _survey function| mktz_$

0 Cookies

2 Console Messages

Source Level URL
Text
console-api log URL: https://cdn.omniconvert.com/js/ze8e288.js(Line 1)
Message:
[MKTZ] Consent is disabled
console-api warning URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js(Line 7)
Message:
AT:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optmnstr.com
app.omniconvert.com
assets.adobedtm.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cdn.omniconvert.com
count-server.sharethis.com
dpm.demdex.net
fortinet.tt.omtrdc.net
platform-api.sharethis.com
platform-cdn.sharethis.com
s.adroll.com
sjs.bizographics.com
www.fortinet.com
www.google-analytics.com
www.googletagmanager.com
a.optmnstr.com
app.omniconvert.com
c.sharethis.mgr.consensu.org
dpm.demdex.net
fortinet.tt.omtrdc.net
platform-cdn.sharethis.com
s.adroll.com
2.19.43.118
2.21.37.83
2a00:1450:4001:81d::2008
2a00:1450:4001:81f::200e
2a02:26f0:10c:38f::3adf
2a02:6ea0:cf04::2
34.202.169.36
52.9.67.191
095c63e7deb6acec556041607fa92383ff50ebd2f64f0b4ce244071d736f4542
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316
29f41d54055e58ed9dc430f8fe9963a7c5b25c8a5898faec74f6336df470f165
2bed61c5abc85c1258c3b5b5bd7994fa5f67fab78c99498e5533bff154810521
3b00b1796a43d5546f7db7afc2173bfa8479731090096f8511e5a77c4bc90002
415d4d0b74937146bbb7aad206f48c524e48d5785fbffd63b377d2b6dfa0a98e
46872a8d05ef5bd483919c20e84f584cc89ec0d3b759a016f9d066a437948dda
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
602a797227cdb6b1cc2161b8fc2ed0bfb7e91d18693dd0341922ac60f881ee46
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0
77bbafe831a76fd691284bf3cbe42c8a7bf44f569a8dda50d8d7e727f9712672
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
97d587ffd230ea0166ff97d4b9a5e513f99590e36c168566d8993f37b8fb6ff7
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
a4b9f10ef3e64da899a1524cc53feb238338825f294f7f5888016389e52cc2d0
aa575469dc2d0e558e32fe60024625c352a4ac0c1acb7ebb15547c08772f0fb3
aa698da44354a1e326d721d504704e31cbbdc54c6244a210276c01d703860f36
ba07afd991b9af8f3873d78cd30bd64f603bd55ba4218658f3aed086b8af024b
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
dbb524ca8eda9eff2fa0e45797e71bfd33108e154f70457ccecedd187ec83424
e24ff7b3bf64f39822bf3e91f8c6779b12e993ef544739bfaf8d492371c1f5ec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629