www.esentire.com Open in urlscan Pro
104.20.162.46  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1780050&time=1725984730043&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1780050&time=1725984730043&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&tm=gtmv2&e_ipv6=AQIBtsj2c917sQAAAZHctOyOaw2D8L3bfOlKJBzZKm6y0S_7wE-44opm-0wa_QuwLbqKow

Request Chain 70

• https://insight.adsrvr.org/tags/zy90xae/11yjcw6/iframe HTTP 301
• https://d1eoo1tco6rr5e.cloudfront.net/zy90xae/11yjcw6/iframe

Request Chain 88

• https://c.clarity.ms/c.gif HTTP 302
• https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=9F72197174CB41FCBEAD91569F114A7B&RedC=c.clarity.ms&MXFR=1DA85F7145D56D8209854B8741D56379 HTTP 302
• https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=9F72197174CB41FCBEAD91569F114A7B&MUID=20B0970D59B76B3E191E83FB586A6AC3

108 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	404	Primary Request lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Show response www.esentire.com/blog/	117 KB 31 KB	728ms 605ms	Document text/html	104.20.162.46 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.162.46 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 713992853182777ef9a88f88ab5df74b8b2bc2199fc4b841eda554a779d4f4b4 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers cache-control no-store cf-cache-status BYPASS cf-ray 8c10b2aa9da7bc5a-ZRH content-encoding br content-type text/html; charset=UTF-8 date Tue, 10 Sep 2024 16:12:09 GMT permissions-policy geolocation=(), midi=(),sync-xhr=(),accelerometer=(), gyroscope=(), magnetometer=(), camera=(), fullscreen=(self) server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	200	style.css www.esentire.com/	1 MB 174 KB	44ms 43ms	Stylesheet text/css	104.20.162.46 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.esentire.com/style.css?v=4.10.27 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.162.46 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e6424686f5071b3a4e4b446b4a7fd9c104f5a7cb6d608f8a5bb9639e82e49de0 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15552000 cf-cache-status HIT age 356241 x-xss-protection 1; mode=block last-modified Fri, 06 Sep 2024 01:11:35 GMT server cloudflare etag "128e92-62169169dffc0-gzip" vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/css cache-control max-age=2592000, public permissions-policy geolocation=(), midi=(),sync-xhr=(),accelerometer=(), gyroscope=(), magnetometer=(), camera=(), fullscreen=(self) cf-ray 8c10b2ae6b78bc5a-ZRH
GET H2	200	aos.css unpkg.com/aos@2.3.1/dist/	25 KB 5 KB	127ms 69ms	Stylesheet text/css	2606:4700::6811:f6cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/aos@2.3.1/dist/aos.css Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:f6cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip via 1.1 fly.io cf-cache-status HIT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 16407663 last-modified Thu, 17 May 2018 22:11:13 GMT fly-request-id 01HR5BQP8VT9E3QZ937Q1FDMW1-fra server cloudflare etag "65c5-BVfTdFS2f0LyyxAeV+UHD7EZNXA" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 8c10b2aec8430f52-MXP
GET H2	200	swiper-bundle.min.css cdn.jsdelivr.net/npm/swiper@9/	18 KB 5 KB	82ms 23ms	Stylesheet text/css	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/swiper@9/swiper-bundle.min.css Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash af8545de3876815292506711e1369bff9dfe57ec7e04c45c3e1bdac48a11f3b2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 10 Sep 2024 16:12:09 GMT x-content-type-options nosniff content-encoding br age 881 x-jsd-version 9.4.1 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 5125 x-served-by cache-fra-etou8220057-FRA, cache-mxp6963-MXP x-jsd-version-type version etag W/"4691-p8Uo3JAYru/tmlIzcWjeyyIOL2E" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=604800, s-maxage=43200 accept-ranges bytes timing-allow-origin *
GET H2	200	evh1ctd.css use.typekit.net/	5 KB 1 KB	174ms 38ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/evh1ctd.css Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f744aac8deccee35ee463043ea3290200814752b40315b995447bf21628bc8a4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Tue, 10 Sep 2024 16:12:09 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 824
GET H2	200	amm2djb.css use.typekit.net/	10 KB 1 KB	180ms 45ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/amm2djb.css Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f4e9b4fbd7414d4edc46952b383c63b8ffee6f8ac0570e437878b25096501019 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Tue, 10 Sep 2024 16:12:09 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 1141
GET H/1.1	200 OK	mdr_nav_1.png esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/	6 KB 7 KB	410ms 147ms	Image image/png	16.12.4.116 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/mdr_nav_1.png Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 16.12.4.116 Montreal, Canada, ASN16509 (AMAZON-02, US), Reverse DNS s3-w.ca-central-1.amazonaws.com Software AmazonS3 / Resource Hash 059056575901aa7a59d7873b94ea1a173fca5cd4f716e802188507ba9cf87075 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:10 GMT x-amz-version-id 9DH8p1EmU4QiSTUD1rI6.VRI1nMbMXBE Last-Modified Wed, 19 Jun 2024 15:41:29 GMT Server AmazonS3 x-amz-request-id F3Y66TK8R4M20R1W ETag "aab205f16dc5c31a332797af14383a22" x-amz-server-side-encryption AES256 Content-Type image/png Accept-Ranges bytes Content-Length 6378 x-amz-id-2 qOyOs6AMTIXLcZup2Dz5DraHEWBY5oyl3iaj1ZwNFQKop+05l9X8nUmdzOvRVIhySIZ9CUaJbEI=
GET H/1.1	200 OK	dfir_nav_1.png esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/	8 KB 8 KB	406ms 144ms	Image image/png	16.12.4.116 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/dfir_nav_1.png Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 16.12.4.116 Montreal, Canada, ASN16509 (AMAZON-02, US), Reverse DNS s3-w.ca-central-1.amazonaws.com Software AmazonS3 / Resource Hash 292d424d2f2b6cacac6680fa03279e7344085e0b7af46102b8792357837f7d1c Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:10 GMT x-amz-version-id pRO2_x5tq58HAgXSJTezEnueBMF6tWYu Last-Modified Wed, 19 Jun 2024 16:51:18 GMT Server AmazonS3 x-amz-request-id F3Y1H6MZXXEV7P7A ETag "2ea5ff8b1cb1a2c21d1332e4da0f2a19" x-amz-server-side-encryption AES256 Content-Type image/png Accept-Ranges bytes Content-Length 7969 x-amz-id-2 fS+iffQ6Xc5cGhnDwP+TTXkn1pBoKD+cUJQ0UNxfD3T73EnQTBCNbOHr9znki6ewT8tbldDn56k=
GET H/1.1	200 OK	exposure_nav_1.png esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/	8 KB 8 KB	324ms 142ms	Image image/png	16.12.4.116 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/exposure_nav_1.png Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 16.12.4.116 Montreal, Canada, ASN16509 (AMAZON-02, US), Reverse DNS s3-w.ca-central-1.amazonaws.com Software AmazonS3 / Resource Hash 394458008b8fadfc2ad3c2a30a423b2a0b266571021b1994b114be3fc76f5173 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:10 GMT x-amz-version-id eJESwbEvw8z6lGLQ92vkj1lllj8eruVv Last-Modified Wed, 19 Jun 2024 16:51:19 GMT Server AmazonS3 x-amz-request-id F3Y8C5XCTRNNDS5S ETag "33667c79cca845be7ce5742429361825" x-amz-server-side-encryption AES256 Content-Type image/png Accept-Ranges bytes Content-Length 8179 x-amz-id-2 sEYn8tNB2IlYXapKpNK8OFdhMKXiWhIXZwGepk051VCOuhZjPO/fCZcBAXPtmSo2hxzEfwdnT5Q=
GET H2	200	gtm.js Show response www.googletagmanager.com/	331 KB 108 KB	144ms 66ms	Script application/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ebd63b88bfe6b79b12ec7603ad8f47b22b683d0d572e970ec577d4f22f50b0aa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 109724 x-xss-protection 0 last-modified Tue, 10 Sep 2024 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 10 Sep 2024 16:12:09 GMT
GET H3	200	3k8XsFBkOniCq5dTRwpV Show response ws.zoominfo.com/pixel/	0 650 B	209ms 179ms	Script text/javascript	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/3k8XsFBkOniCq5dTRwpV Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT via 1.1 google x-content-type-options nosniff cf-cache-status DYNAMIC server cloudflare x-powered-by Express content-type text/javascript access-control-allow-origin * access-control-allow-credentials true x-robots-tag noindex, nofollow access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url content-length 0 cf-ray 8c10b2b00f3e5231-MXP alt-svc h3=":443"; ma=86400
GET H2	200	p.css p.typekit.net/	5 B 173 B	109ms 41ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=bji2rhx&ht=tk&f=9785.9786.9787.9788.9791.9792.9793.9794.10884.32874&a=5128113&app=typekit&e=css Requested by Host: www.esentire.com URL: https://www.esentire.com/style.css?v=4.10.27 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT last-modified Sun, 19 May 2024 12:57:48 GMT server nginx etag "6649f74c-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	main.js Show response www.esentire.com/	681 KB 168 KB	41ms 39ms	Script application/javascript	104.20.162.46 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.esentire.com/main.js?v=4.10.27 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.162.46 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7075befd3bf43d8abf3cdc002ecef678a8f0b77bf271d77e84ff5a759e0d3603 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15552000 cf-cache-status HIT age 356239 x-xss-protection 1; mode=block last-modified Fri, 06 Sep 2024 01:11:35 GMT server cloudflare etag "aa369-62169169dffc0-gzip" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=2592000, public permissions-policy geolocation=(), midi=(),sync-xhr=(),accelerometer=(), gyroscope=(), magnetometer=(), camera=(), fullscreen=(self) cf-ray 8c10b2afdda5bc5a-ZRH
GET H2	200	style.js Show response www.esentire.com/	4 KB 1 KB	47ms 46ms	Script application/javascript	104.20.162.46 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.esentire.com/style.js Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.162.46 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89341264b13866dd5f3546ed87a7bc9838ece80bb1aff0f36e08635e61b4da56 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=15552000 cf-cache-status HIT age 356238 content-length 1119 x-xss-protection 1; mode=block last-modified Fri, 06 Sep 2024 01:11:35 GMT server cloudflare etag "f1b-62169169dffc0-gzip" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=2592000, public permissions-policy geolocation=(), midi=(),sync-xhr=(),accelerometer=(), gyroscope=(), magnetometer=(), camera=(), fullscreen=(self) accept-ranges bytes cf-ray 8c10b2afdda6bc5a-ZRH
GET H2	200	aos.js Show response unpkg.com/aos@2.3.1/dist/	14 KB 6 KB	39ms 38ms	Script application/javascript	2606:4700::6811:f6cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/aos@2.3.1/dist/aos.js Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:f6cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f268612ba59ead1b24353bb77d66783bcc435aff1c22be5f93c40bac3869968e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip via 1.1 fly.io cf-cache-status HIT x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 16397337 last-modified Thu, 17 May 2018 22:11:13 GMT fly-request-id 01HR5NJSGPR3870C2MM2TRAHQH-fra server cloudflare etag "379f-cNv9OKDx/DsafZ+tq1h4ZITDTxc" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 8c10b2afd9b30f52-MXP
GET H2	200	p.css p.typekit.net/	5 B 173 B	42ms 42ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=evh1ctd&ht=tk&f=139.171.173.175.5474.32231&a=4193844&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/evh1ctd.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers Referer https://use.typekit.net/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT last-modified Sun, 19 May 2024 12:57:48 GMT server nginx etag "6649f74c-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	p.css p.typekit.net/	5 B 173 B	41ms 41ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=amm2djb&ht=tk&f=39884.39885.39886.39887.39888.39889.39890.39891.39893.39900.39901.39906.39907.39909&a=87474164&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers Referer https://use.typekit.net/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT last-modified Sun, 19 May 2024 12:57:48 GMT server nginx etag "6649f74c-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	17 KB 6 KB	103ms 39ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=780243&u=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&vn=2 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra2 / Resource Hash 35f28197f9d96e5bbcf25d038073169bb2d1467a422ba84628247fdb17b12385 Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:08 GMT content-encoding gzip via 1.1 google server gfra2 vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0, no-cache, must-revalidate timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H/1.1	200 OK	2pz6mw Show response mdr.esentire.com/l/651833/2023-08-01/ Frame 5661	27 KB 6 KB	983ms 391ms	Document text/html	18.208.125.13 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-125-13.compute-1.amazonaws.com Software / Resource Hash 330c47e7ebe6607060f82766dbe9f4781412a77c9c843b71ca42dfcf5fb254b3 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Length 5782 Content-Type text/html; charset=utf-8 Date Tue, 10 Sep 2024 16:12:10 GMT X-Pardot-Route e8229a0ff18ebffc83a98010d2521dd5 cache-control no-store, no-cache, must-revalidate content-encoding gzip expires Thu, 19 Nov 1981 08:52:00 GMT p3p CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" pragma no-cache vary Accept-Encoding,User-Agent x-pardot-rsp 0/0/1
GET H/1.1	200 OK	404_container_bg.jpg esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/404/	688 KB 688 KB	334ms 160ms	Image image/jpeg	16.12.4.116 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/404/404_container_bg.jpg Requested by Host: www.esentire.com URL: https://www.esentire.com/style.css?v=4.10.27 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 16.12.4.116 Montreal, Canada, ASN16509 (AMAZON-02, US), Reverse DNS s3-w.ca-central-1.amazonaws.com Software AmazonS3 / Resource Hash e13dbbf7ffc35e18f4f3a875c401afe8d051b20aff801ade03aae8034b867852 Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:10 GMT x-amz-version-id FAoRQgfQs2gCesw8X_9IT8_McVA1vOaq Last-Modified Tue, 04 Jun 2024 18:27:58 GMT Server AmazonS3 x-amz-request-id F3Y92D848FZ2HGKQ ETag "1bb2e90e0f2a8217f4a343a5cc89a054" x-amz-server-side-encryption AES256 Content-Type image/jpeg Accept-Ranges bytes Content-Length 704466 x-amz-id-2 RG1LpSScYEsLpVW4tpGfVSFVwfdXTP0Z+ThEErOd8XkDbQfwIZadwzsz7DdltJHqI6l+O+a3Baw=
GET H/1.1	200 OK	Search-Icon.svg esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/404/	426 B 876 B	419ms 182ms	Image image/svg+xml	16.12.4.116 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/404/Search-Icon.svg Requested by Host: www.esentire.com URL: https://www.esentire.com/style.css?v=4.10.27 Protocol HTTP/1.1 Security TLS 1.3, , CHACHA20_POLY1305 Server 16.12.4.116 Montreal, Canada, ASN16509 (AMAZON-02, US), Reverse DNS s3-w.ca-central-1.amazonaws.com Software AmazonS3 / Resource Hash 01bed7c6f926a95a88d1b003ba04320c32821c1f2d92f6fb5859546b77de63d0 Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:10 GMT x-amz-version-id nXOhAcNrKDpIDzRNArZHi7ZN.0hNnQWm Last-Modified Wed, 05 Jun 2024 14:28:56 GMT Server AmazonS3 x-amz-request-id F3Y68H2BNAJDY5W7 ETag "f6c09a2f8d5f2ae7b32c1dd3753de5c1" x-amz-server-side-encryption AES256 Content-Type image/svg+xml Accept-Ranges bytes Content-Length 426 x-amz-id-2 7oimmKGgfghjsU/nJJvgH6WNdbWo7KROy5rX8fwfAdTvBnYPakwH1RZgGDPSd8Mdex93yhr12+U=
GET H/1.1	200 OK	Get-Started-Short-Background.png esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/Real-Vs-Fake/Competitor/	4 MB 4 MB	403ms 157ms	Image image/png	16.12.4.116 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://esentire-dot-com-assets.s3.amazonaws.com/assetsV4/Common/Real-Vs-Fake/Competitor/Get-Started-Short-Background.png Requested by Host: www.esentire.com URL: https://www.esentire.com/style.css?v=4.10.27 Protocol HTTP/1.1 Security TLS 1.3, , CHACHA20_POLY1305 Server 16.12.4.116 Montreal, Canada, ASN16509 (AMAZON-02, US), Reverse DNS s3-w.ca-central-1.amazonaws.com Software AmazonS3 / Resource Hash 5decda558c1c4d9def627773ee93fa357534b053413e011f36304092664149e7 Request headers Referer https://www.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:10 GMT x-amz-version-id znKUgq1aoAkfTNzt2TWCDTYKos1C3ScK Last-Modified Wed, 15 May 2024 03:06:12 GMT Server AmazonS3 x-amz-request-id F3Y9NPZT7YWDMC46 ETag "949fc2a686b7df5fd85370f21fd26323" x-amz-server-side-encryption AES256 Content-Type image/png Accept-Ranges bytes Content-Length 4050524 x-amz-id-2 3iCSOwkNi4q6jag7NweV1Krj8c/VuaSbyhr3nRasgovp+ht2KSuBGFqGp+Gv4JYh88QPbKXmAMg=
GET H2	200	l use.typekit.net/af/0626f2/000000000000000077359441/30/	23 KB 24 KB	169ms 41ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/0626f2/000000000000000077359441/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash c72dec0cf8cadba7af0e75dab5638b76af4cb53e02c171c2ff68f45318caaae9 Request headers Referer https://use.typekit.net/amm2djb.css Origin https://www.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT server nginx etag "dd7ba2fabd12b224f191c0f337ced807f714d3d6" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24060
GET H2	200	l use.typekit.net/af/f1c6f0/00000000000000007735945d/30/	24 KB 24 KB	179ms 52ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/f1c6f0/00000000000000007735945d/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash c646c4f54d3d04ac4f7736f4d73811b55fdf8ce9c23fc2dab6ccad3e57263a67 Request headers Referer https://use.typekit.net/amm2djb.css Origin https://www.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT server nginx etag "13e17f614cf73490e08d945927ed77a5dceaba2a" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24388
GET H2	200	l use.typekit.net/af/2c6c03/000000000000000077359463/30/	24 KB 25 KB	173ms 46ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/2c6c03/000000000000000077359463/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f9737651c97ca4327dd9d755ab8fd813bd504e8b7c975b7e1c63dcb154c1bc19 Request headers Referer https://use.typekit.net/amm2djb.css Origin https://www.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT server nginx etag "e3ec062323e4590b4b7846ed4c41ccffee56a2aa" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24908
GET H2	200	l use.typekit.net/af/89996a/000000000000000077359445/30/	22 KB 23 KB	212ms 85ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/89996a/000000000000000077359445/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 95a026ca9deb402ba2f984f169cab087ee00d5064f9d7554f946fe0807e662be Request headers Referer https://use.typekit.net/amm2djb.css Origin https://www.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT server nginx etag "d3de06ff3edf13d0a437cfac23873ccf84d0f4b1" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 22892
GET H3	200	ce788296-8259-4e39-bcae-56ddd5b7e767.js Show response cdn.mouseflow.com/projects/	88 KB 26 KB	78ms 40ms	Script application/javascript	104.18.26.50 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.mouseflow.com/projects/ce788296-8259-4e39-bcae-56ddd5b7e767.js Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.26.50 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc757accd72c081c680cc9c4b1381b6dee48edde66ec64a87a9963d4bdfa5a88 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip x-mf-continent EU age 541 x-cache-status MISS alt-svc h3=":443"; ma=86400 x-mf-script-region enforced-privacy x-mf-country IT last-modified Tue, 10 Sep 2024 15:23:35 GMT server cloudflare etag W/"b58a6067953db1:0" vary Accept-Encoding, Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=86400 cf-ray 8c10b2b09d7783ac-MXP expires Wed, 11 Sep 2024 16:12:09 GMT
GET		034b8bab-158e-43d5-b4c8-a4d145403452 https://www.esentire.com/ Frame	0 0
GET H3	200	va_gq-0a08443947c1f6ca7bd95a09049a2740br.js Show response dev.visualwebsiteoptimizer.com/edrv/	273 KB 71 KB	90ms 64ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/va_gq-0a08443947c1f6ca7bd95a09049a2740br.js Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/j.php?a=780243&u=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&vn=2 Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra2 / Resource Hash b7d649c15dbbf23ef5d2c8a141852a9595e6a66aba59e04c52aef6e26ef5bda4 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Origin https://www.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding br via 1.1 google last-modified Tue, 10 Sep 2024 13:41:06 GMT server gfra2 etag "66e04c72-11b5b" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 72539
GET H3	200	nc-b6842bb3c0bf4b8c73a0a28eafe9016abr.js Show response dev.visualwebsiteoptimizer.com/edrv/	10 KB 4 KB	62ms 37ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/nc-b6842bb3c0bf4b8c73a0a28eafe9016abr.js Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/j.php?a=780243&u=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&vn=2 Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra2 / Resource Hash 3605e9b335fb1f8bb26e98fd182f257e3a3cfae7de81669f04c42a04154f2d3a Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Origin https://www.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding br via 1.1 google last-modified Tue, 10 Sep 2024 13:41:06 GMT server gfra2 etag "66e04c72-e29" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3625
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 144 B	122ms 121ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=780243&d=esentire.com&u=DF7E6E3F34E9FEAA2494A5F3DEE4F7545&h=bab8d4563a71830aa7af86530964c89e&t=false Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT via 1.1 google x-content-type-options nosniff server gnv01c content-type image/gif access-control-allow-origin * cache-control public, max-age=43200 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	122ms 122ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=780243&u=DF7E6E3F34E9FEAA2494A5F3DEE4F7545&s=1725984728&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22it-it%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1725984729824%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FRome%22%7D&cu=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1725984728832&v=d1a51aaaf Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:09 GMT via 1.1 google x-content-type-options nosniff server gnv01c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H2	200	92169fb0-0d98-4c23-b691-2da2893257b1.js Show response j.6sc.co/j/	885 B 837 B	548ms 455ms	Script application/javascript	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/92169fb0-0d98-4c23-b691-2da2893257b1.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash be5c1b590974d405894200d9807154391fca4bc7d0db1dcf4994252f69db403c Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-amz-version-id xNg_FfBioe8BWBlPwLso62mH1YwsX1SZ content-encoding gzip date Tue, 10 Sep 2024 16:12:10 GMT x-amz-cf-pop FRA60-P8 x-amz-server-side-encryption AES256 x-amz-meta-content-type application/json content-length 457 last-modified Mon, 15 Jan 2024 03:43:54 GMT server AmazonS3 etag "1a802ea224537febfdd14a71f0d37293" vary Accept-Encoding content-type application/javascript cache-control private, max-age=1800 accept-ranges bytes x-amz-cf-id Rin4UbVnJ0L6hsvuCMQTNOejXOOCmOjF6wrN715TcMH5jL2dpDb9Xg== expires Tue, 10 Sep 2024 16:42:10 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	335 KB 108 KB	55ms 55ms	Script application/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-2XXPJCPHB7&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8b4a5f9827502533db01bd8f33e7aaac3f002ca37e6fd1c1a532cd99993acde0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 110544 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 10 Sep 2024 16:12:09 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	138ms 45ms	Script application/javascript	2a02:26f0:480:15::213:7e63 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:15::213:7e63 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 22 Aug 2024 10:43:55 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=75444 accept-ranges bytes content-length 14628
GET H2	200	destination Show response www.googletagmanager.com/gtag/	270 KB 93 KB	64ms 64ms	Script application/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-478097890&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 88af420a3107b83861b98b4faac93126f54a2f89be7a3588f9a56cb5c5c8fa30 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 94853 x-xss-protection 0 last-modified Tue, 10 Sep 2024 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 10 Sep 2024 16:12:09 GMT
GET H2	200	bat.js Show response bat.bing.com/	49 KB 14 KB	278ms 109ms	Script application/javascript	2620:1ec:33::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 60ed45fe20ede817f77c4e774e77fd9a9a4f4046c67456f1442eac2095918438 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Tue, 10 Sep 2024 16:12:09 GMT last-modified Fri, 06 Sep 2024 21:17:16 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 1B30449DE4D34317BB012D01D2C02CFA Ref B: MIL30EDGE0706 Ref C: 2024-09-10T16:12:10Z etag "016326a20db1:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 14305
GET H2	200	ys3mr8d6dw69.js Show response js.driftt.com/include/1725984900000/	221 KB 62 KB	245ms 163ms	Script application/javascript	18.245.86.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1725984900000/ys3mr8d6dw69.js Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.87 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-87.fra60.r.cloudfront.net Software istio-envoy / Resource Hash a9c06804242819b18af434dfa96d939ba88510b3982da0e1691a23c48db42a7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-amz-version-id a4k69WVWquQ1jW2_kBtTfxPdsnon1ibv strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Tue, 10 Sep 2024 16:12:10 GMT via 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 38 last-modified Tue, 10 Sep 2024 16:08:07 GMT server istio-envoy etag W/"7cbd84669081c065085f24294606507a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-cache access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id R3gbD-I4F-iI4alBNTr8Xzkx92lPPOVak3mNwTPLfTsK8sLS0ccCAQ==
GET H3	200	api.js Show response www.google.com/recaptcha/	1 KB 968 B	112ms 44ms	Script text/javascript	142.250.185.228 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.228 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f4.1e100.net Software ESF / Resource Hash adcc83fd890fe936a5df3a16a909ddf2c466863a2422b1b811d675080cd56b02 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip x-content-type-options nosniff server ESF x-frame-options SAMEORIGIN report-to {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} content-type text/javascript; charset=utf-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" expires Tue, 10 Sep 2024 16:12:09 GMT
GET H2	200	1985.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	2 KB 2 KB	190ms 133ms	Script text/javascript	2606:4700::6812:1eb0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1985.js?p=https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e&e= Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a9b49f5ffd04cb238754401e926646bbd7f52abcf9cdc527efa80f9a27b29a5 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:10 GMT strict-transport-security max-age=15552000; includeSubDomains x-content-type-options nosniff content-encoding br x-permitted-cross-domain-policies none x-dns-prefetch-control off cross-origin-resource-policy cross-origin content-disposition inline x-xss-protection 0 referrer-policy no-referrer server cloudflare cross-origin-opener-policy same-origin x-download-options noopen vary Origin, Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript;charset=UTF-8 access-control-allow-origin * origin-agent-cluster ?1 cf-ray 8c10b2b209684bee-MXP
GET H2	200	Bootstrap.js Show response nexus.ensighten.com/choozle/17616/	29 KB 10 KB	177ms 47ms	Script application/javascript	2600:9000:2449:d000:2:8f43:5780:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/choozle/17616/Bootstrap.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2449:d000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 6f411aac2d2328d466581151e547f217f1fdd692964a65bb677e4977a476d786 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sun, 17 Dec 2023 01:08:44 GMT x-amz-version-id Q0b8fDJRoal0UPtaJzego52wLAwbGO1Z content-encoding br via 1.1 ed8a64af6e81621f0f4bbf3ca72f2da4.cloudfront.net (CloudFront) x-amz-cf-pop AMS58-P6 age 23209407 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED alt-svc h3=":443"; ma=86400 last-modified Sun, 29 Oct 2023 16:53:04 GMT server CloudFront etag W/"1685a4748ac201242013e1a28f1a8a2d" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=300 x-amz-cf-id 8QuhV5zFYLJd91LBGUqFIXrhOkaiiF2lLczrxJwz-46T4nZ349NT8Q==
GET H2	200	pixel.js Show response pixel.switchgrowth.com/	6 KB 3 KB	141ms 63ms	Script text/javascript	2606:4700:20::ac43:4aa3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pixel.switchgrowth.com/pixel.js?id=Zr9rdSD1lqp0WBiE Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-57Z6ZWR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:4aa3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 208a88dae2bf19735a047ef2615e4d67f918b61be07fb6c5b2cdadf4107d90f9 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT via 1.1 google content-encoding br strict-transport-security max-age=63072000; includeSubDomains cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3130 cf-polished origSize=6088 cf-bgj minify last-modified Mon, 09 Sep 2024 16:58:51 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S74MSqIcOeTR8LNBT6%2FQiwmuWTUlp7MLUN0HB8wpgkJ3HbXjl9rSQcFUGtugv6borWVEnvZefm5HmmDL2xAZu3oL6%2FJbmR2YhgYfeub67juslz23ntwwXN5IM7dv04vxJboiSX72bqg%2FtzIJdojj92pYEIM%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript x-cloud-trace-context 8f70c2385b0e8ddf486f79f9079db24f cache-control public, max-age=14400 cf-ray 8c10b2b22be8be61-ZRH
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/	25 KB 6 KB	42ms 42ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/settings.js?a=780243&settings_type=1&vn=&eventArch=1&uuid= Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/edrv/va_gq-0a08443947c1f6ca7bd95a09049a2740br.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra2 / Resource Hash cb4f30bc85d765141908f55161b040dfead616e4bc25a72af7f44cef4a0f3d25 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:08 GMT content-encoding gzip via 1.1 google server gfra2 etag W/"1725975686_EA" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H2	204	collect region1.analytics.google.com/g/	0 0	152ms 46ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-2XXPJCPHB7&gtm=45je4940v895821412z8813556160za200zb813556160&_p=1725984729350&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=1711787598.1725984730&ul=it-it&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=Ag&_s=1&sid=1725984729&sct=1&seg=0&dl=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&dt=eSentire&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1398 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-2XXPJCPHB7&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:10 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.esentire.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 255 B	173ms 46ms	Ping text/plain	2a00:1450:400c:c06::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-2XXPJCPHB7&cid=1711787598.1725984730&gtm=45je4940v895821412z8813556160za200zb813556160&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-2XXPJCPHB7&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:10 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.esentire.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.it/ads/	42 B 408 B	201ms 77ms	Image image/gif	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-2XXPJCPHB7&cid=1711787598.1725984730&gtm=45je4940v895821412z8813556160za200zb813556160&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=0&tag_exp=0&z=1393369627 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:10 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 724 B	294ms 188ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept * Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 10 Sep 2024 16:12:09 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: B84F8899A17942059A8CE3548C2C7CD3 Ref B: MIL30EDGE0922 Ref C: 2024-09-10T16:12:10Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 access-control-allow-origin https://www.esentire.com x-li-source-fabric prod-lva1 x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYhxiK7ScmCeoa+2n2/Ow==
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 1 KB	338ms 235ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1780050&time=1725984730043&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers Accept * Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-cache CONFIG_NOCACHE x-li-uuid AAYhxiK72vwWreDrC8A3IA== x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 27A46581A1394F3C9CA58866DE10F3F8 Ref B: MIL30EDGE1017 Ref C: 2024-09-10T16:12:10Z access-control-allow-methods GET, OPTIONS x-li-fabric prod-lor1 access-control-allow-origin * report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} content-type application/json x-li-proto http/2 x-restli-protocol-version 1.0.0 access-control-allow-headers * x-fs-uuid 000621c622bbdafc16ade0eb0bc03720
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1780050&time=1725984730043&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loadin... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1780050&time=1725984730043&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loadi...	0 266 B	252ms 181ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1780050&time=1725984730043&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&tm=gtmv2&e_ipv6=AQIBtsj2c917sQAAAZHctOyOaw2D8L3bfOlKJBzZKm6y0S_7wE-44opm-0wa_QuwLbqKow Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:10 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: E6EF190BD83F47BBA8D148B75AB5686F Ref B: MRS20EDGE0121 Ref C: 2024-09-10T16:12:10Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYhxiLFBbpp9q2uejjS4Q== Redirect headers date Tue, 10 Sep 2024 16:12:09 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: ABBD76F837D047DF91DD39FB7AD6178A Ref B: MIL30EDGE0922 Ref C: 2024-09-10T16:12:10Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1780050&time=1725984730043&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&tm=gtmv2&e_ipv6=AQIBtsj2c917sQAAAZHctOyOaw2D8L3bfOlKJBzZKm6y0S_7wE-44opm-0wa_QuwLbqKow x-li-proto http/2 content-length 0 x-li-uuid AAYhxiK7qbBZFhnJjOQAwA==
POST H2	200	assign tracking.g2crowd.com/attribution_tracking/conversions/	0 0	155ms 153ms	Ping text/html	2606:4700::6812:1eb0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/assign Requested by Host: tracking.g2crowd.com URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1985.js?p=https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e&e= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundary8UTgs7HjNGzhytBo Response headers
GET H2	200	134632430.js Show response bat.bing.com/p/action/	4 KB 2 KB	84ms 83ms	Script application/javascript	2620:1ec:33::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/134632430.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash fd982eee0254351a8a7584d1cd4d169603ce46331eb8c333629a8841f953f537 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br date Tue, 10 Sep 2024 16:12:09 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: CC59FD57CFAB4C9BA166FDF9636A9A32 Ref B: MIL30EDGE0706 Ref C: 2024-09-10T16:12:10Z vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript; charset=utf-8 cache-control private,max-age=60
GET H2	200	134632430 Show response www.clarity.ms/tag/uet/	1 KB 2 KB	381ms 225ms	Script application/x-javascript	2620:1ec:29:1::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.clarity.ms/tag/uet/134632430 Requested by Host: bat.bing.com URL: https://bat.bing.com/p/action/134632430.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 723185beb0360605e6cd4cbb86a1d506add32ae928d1c078f59d2b59b3bdce3e Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers request-context appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111 date Tue, 10 Sep 2024 16:12:10 GMT x-azure-ref 20240910T161210Z-158f467467fnqnr4rpden1h2h40000000t600000000032q0 x-cache CONFIG_NOCACHE content-type application/x-javascript cache-control no-cache, no-store accept-ranges bytes content-length 1183 expires -1
GET H2	204	0 bat.bing.com/action/	0 286 B	83ms 83ms	Image text/plain	2620:1ec:33::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=134632430&tm=gtm002&Ver=2&mid=c9eea0cf-08fd-4b04-b87e-c6a4e0e9d494&sid=6ed6f7306f8f11efa28895adb5b76355&vid=6ed721d06f8f11efab67cbfede1dce15&vids=1&msclkid=N&gtm_tag_source=1&pi=918639831&lg=it-IT&sw=1600&sh=1200&sc=24&tl=eSentire&p=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&r=&lt=1056&evt=pageLoad&sv=1&cdb=AQAQ&rn=944544 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 10 Sep 2024 16:12:09 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: BB2B7E4182F14CE89D356A1C76B3502B Ref B: MIL30EDGE0706 Ref C: 2024-09-10T16:12:10Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 19 KB	35ms 34ms	Script application/javascript	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/92169fb0-0d98-4c23-b691-2da2893257b1.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash aea136527ca962a15eea8eb338c7667b5a44d98bff65dc09a36f5493ddbacb99 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:10 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Sep 2024 16:37:55 GMT server nginx/1.14.0 (Ubuntu) etag "66d9de63-10fec" vary Accept-Encoding content-type application/javascript cache-control private, proxy-revalidate, max-age=10800 accept-ranges bytes content-length 18709 expires Tue, 10 Sep 2024 19:12:10 GMT
GET H2	200	recaptcha__it.js Show response www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/	539 KB 214 KB	112ms 37ms	Script text/javascript	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__it.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d9b4a7ce18dc79741988e67e0f310d54e8762ac112ee22ffc8041c86e4819cf3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Origin https://www.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 11:51:42 GMT content-encoding gzip x-content-type-options nosniff age 15628 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 218345 x-xss-protection 0 last-modified Tue, 03 Sep 2024 02:00:38 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 10 Sep 2025 11:51:42 GMT
GET H2	200	/ Show response checkip.amazonaws.com/	16 B 196 B	222ms 55ms	Fetch text/plain	63.35.249.238 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://checkip.amazonaws.com/ Requested by Host: pixel.switchgrowth.com URL: https://pixel.switchgrowth.com/pixel.js?id=Zr9rdSD1lqp0WBiE Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.35.249.238 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-63-35-249-238.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b8ceaa23b4cb9872de5755fe64ed6640d7eaf82d0e01963d74b6af7d0b8ab543 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-origin * date Tue, 10 Sep 2024 16:12:10 GMT server nginx content-length 16 vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers content-type text/plain;charset=UTF-8
GET H2	200	serverComponent.php Show response nexus.ensighten.com/choozle/17616/	391 B 723 B	93ms 93ms	Script text/javascript	2600:9000:2449:d000:2:8f43:5780:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/choozle/17616/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/17616/code/&publishedOn=Sun%20Oct%2029%2016:52:55%20GMT%202023&ClientID=923&PageID=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/choozle/17616/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2449:d000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 07fe440bff5a5027d7d172aa6085c66e51bd55bd02efe095c20a549a2e38cf99 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:10 GMT via 1.1 ed8a64af6e81621f0f4bbf3ca72f2da4.cloudfront.net (CloudFront) server CloudFront x-amz-cf-pop AMS58-P6 x-cache Miss from cloudfront content-type text/javascript cache-control no-cache, no-store alt-svc h3=":443"; ma=86400 content-length 391 x-amz-cf-id eJX-5iKsvfrCMxsbriu77IymubO5AX3rVdGj5dbq1ZHwApoXCYELig== expires Tue, 10 Sep 2024 16:12:09 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	62ms 33ms	XHR text/html	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:10 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.esentire.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	18 B 309 B	159ms 38ms	XHR text/html	2a02:26f0:ab00::214:8e41 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e41 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 7c1a5f682648a72bbb85e721f07412653b9c0c71413f677d224e3f06cd2d22fd Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:10 GMT vary Origin content-type text/html access-control-allow-origin https://www.esentire.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:ac8:24:44::17 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1725984730528_34901612_1186749163_22_1045_37_50_219";dur=1 content-length 18 expires Tue, 10 Sep 2024 16:12:10 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	156ms 147ms	Image image/gif	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&v=1.1.24 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:10 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 10 Sep 2024 16:12:10 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	168ms 160ms	Image image/gif	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%229521f388917852d4872d30f86ea1a41c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2292169fb0-0d98-4c23-b691-2da2893257b1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&v=1.1.24 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:10 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 10 Sep 2024 16:12:10 GMT
GET H3	200	f32640d2533198ecbf42d71590d80394.js Show response nexus.ensighten.com/choozle/17616/code/	673 B 1 KB	41ms 41ms	Script application/javascript	65.9.66.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/choozle/17616/code/f32640d2533198ecbf42d71590d80394.js?conditionId0=4945953 Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/choozle/17616/Bootstrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 65.9.66.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-66-72.fra56.r.cloudfront.net Software CloudFront / Resource Hash a7f1e6984ac0287cf5b1ec86891b63ec3b0d9f9c65668a17eb67681cf19bf603 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 10 Jan 2024 05:02:54 GMT x-amz-version-id buFIYeCFS7wrqnTG.CeF4hp.GpCiOxPl via 1.1 c888f786e25e6e3c7dbb7e9da462d714.cloudfront.net (CloudFront) age 21121757 x-amz-cf-pop FRA56-C1 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED alt-svc h3=":443"; ma=86400 content-length 673 last-modified Sun, 29 Oct 2023 16:53:06 GMT server CloudFront etag "52da2691ab5005d39c0b1be0bf0cf01a" content-type application/javascript; charset=utf-8 cache-control max-age=315360000 accept-ranges bytes x-amz-cf-id JoxjiEBdd98jsUqgbw6HYb5GYIrk2lPxbEqC77NhosH7ldUPaqVv2Q==
GET H3	200	d3d14424fac71699bdbff068d9b1184b.js Show response nexus.ensighten.com/choozle/17616/code/	2 KB 806 B	42ms 41ms	Script application/javascript	65.9.66.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/choozle/17616/code/d3d14424fac71699bdbff068d9b1184b.js?conditionId0=421905 Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/choozle/17616/Bootstrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 65.9.66.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-66-72.fra56.r.cloudfront.net Software CloudFront / Resource Hash e80cfc6df2f882813f88dcf1175bc0c47e13c0cd8517bc240a65ee6cc758b0f2 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sun, 17 Dec 2023 01:08:45 GMT x-amz-version-id d.aon4EQnln_gHxylT_5DcIMBZE80ZbS content-encoding br via 1.1 c888f786e25e6e3c7dbb7e9da462d714.cloudfront.net (CloudFront) age 23209406 x-amz-cf-pop FRA56-C1 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED alt-svc h3=":443"; ma=86400 last-modified Sun, 29 Oct 2023 16:53:06 GMT server CloudFront etag W/"e8e93310d35a9462151b8fdab5b436ce" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 x-amz-cf-id eehuO_5VznaRDXgCQdg2IgHEABLJ6IAK7pOXZvsuHBw5_TWcmuU4Xg==
GET H2	200	evh1ctd.css use.typekit.net/ Frame 5661	5 KB 0	1ms 0ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/evh1ctd.css Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f744aac8deccee35ee463043ea3290200814752b40315b995447bf21628bc8a4 Request headers Referer https://mdr.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 824
GET H2	200	amm2djb.css use.typekit.net/ Frame 5661	10 KB 0	2ms 2ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/amm2djb.css Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f4e9b4fbd7414d4edc46952b383c63b8ffee6f8ac0570e437878b25096501019 Request headers Referer https://mdr.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 1141
GET H/1.1	200 OK	piUtils.js Show response mdr.esentire.com/js/ Frame 5661	343 KB 100 KB	236ms 234ms	Script application/javascript	18.208.125.13 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://mdr.esentire.com/js/piUtils.js?ver=2021-09-20 Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-125-13.compute-1.amazonaws.com Software / Resource Hash 87fbc6477d07c0b9eb56d8839da504fcaf1cdbb8bec3e7f6581cfe92f4abdfce Request headers Referer https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:10 GMT content-encoding gzip X-Pardot-Route e8229a0ff18ebffc83a98010d2521dd5 last-modified Sat, 07 Sep 2024 05:28:04 GMT etag "55cc5-gzip" Transfer-Encoding chunked vary Accept-Encoding,User-Agent Content-Type application/javascript cache-control max-age=63072000 Connection keep-alive accept-ranges bytes expires Thu, 10 Sep 2026 16:12:10 GMT
GET H3	200	api.js Show response www.google.com/recaptcha/ Frame 5661	1 KB 0	3ms 3ms	Script text/javascript	142.250.185.228 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.228 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f4.1e100.net Software ESF / Resource Hash adcc83fd890fe936a5df3a16a909ddf2c466863a2422b1b811d675080cd56b02 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://mdr.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip x-content-type-options nosniff server ESF x-frame-options SAMEORIGIN report-to {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} content-type text/javascript; charset=utf-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" expires Tue, 10 Sep 2024 16:12:09 GMT
GET H2	200	p.css p.typekit.net/ Frame 5661	5 B 0	2ms 2ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=evh1ctd&ht=tk&f=139.171.173.175.5474.32231&a=4193844&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/evh1ctd.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers Referer https://use.typekit.net/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT last-modified Sun, 19 May 2024 12:57:48 GMT server nginx etag "6649f74c-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	p.css p.typekit.net/ Frame 5661	5 B 0	1ms 1ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=amm2djb&ht=tk&f=39884.39885.39886.39887.39888.39889.39890.39891.39893.39900.39901.39906.39907.39909&a=87474164&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers Referer https://use.typekit.net/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT last-modified Sun, 19 May 2024 12:57:48 GMT server nginx etag "6649f74c-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	179ms 179ms	Image image/gif	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A24%3A44%3A%3A17%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.24 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:10 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 10 Sep 2024 16:12:10 GMT
GET H2	200	clarity.js Show response www.clarity.ms/s/0.7.45/	64 KB 27 KB	102ms 102ms	Script application/javascript	2620:1ec:29:1::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.clarity.ms/s/0.7.45/clarity.js Requested by Host: www.clarity.ms URL: https://www.clarity.ms/tag/uet/134632430 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 264532af47b2cfb6620970592478c442a0cd429beccead9d062ff5a91284dc15 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:10 GMT content-encoding br last-modified Wed, 04 Sep 2024 20:13:15 GMT etag W/"0x8DCCD1E024BB9EF" vary Accept-Encoding x-azure-ref 20240910T161210Z-158f467467fnqnr4rpden1h2h40000000t600000000032q3 content-type application/javascript;charset=utf-8 access-control-allow-origin * x-ms-request-id 9acf7dfc-701e-0073-1075-ff7648000000 cache-control public, max-age=86400 x-cache TCP_HIT x-ms-version 2018-03-28 x-fd-int-roxy-purgeid 51562430
GET H/1.1	200 OK	iframe d1eoo1tco6rr5e.cloudfront.net/zy90xae/11yjcw6/ Frame 6C96 Redirect Chain https://insight.adsrvr.org/tags/zy90xae/11yjcw6/iframe https://d1eoo1tco6rr5e.cloudfront.net/zy90xae/11yjcw6/iframe	0 0	130ms 36ms	Document text/html	13.225.83.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d1eoo1tco6rr5e.cloudfront.net/zy90xae/11yjcw6/iframe Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/choozle/17616/code/f32640d2533198ecbf42d71590d80394.js?conditionId0=4945953 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.225.83.200 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-83-200.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Age 37569 Cache-Control max-age=86400 Connection keep-alive Content-Length 138 Content-Type text/html Date Tue, 10 Sep 2024 06:51:59 GMT ETag "622775a53db7f6c768484781afbe7098" Last-Modified Wed, 18 Jan 2023 19:24:08 GMT Server AmazonS3 Via 1.1 cc0ab20766d57035422a2c4c69fe0620.cloudfront.net (CloudFront) X-Amz-Cf-Id ufKi49QdX2THfyTAnyiprkeewrj3bKYdsxR8om52ve86VkemCaphjg== X-Amz-Cf-Pop FRA2-C2 X-Cache Hit from cloudfront x-amz-server-side-encryption AES256 Redirect headers content-length 0 date Tue, 10 Sep 2024 16:12:10 GMT location https://d1eoo1tco6rr5e.cloudfront.net/zy90xae/11yjcw6/iframe
POST H/1.1	204 No Content	collect Show response b.clarity.ms/	0 280 B	553ms 280ms	XHR text/plain	4.153.129.168 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://b.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.45/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 4.153.129.168 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.esentire.com Date Tue, 10 Sep 2024 16:12:11 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Vary Origin Request-Context appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
GET H2	200	recaptcha__it.js Show response www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/ Frame 5661	539 KB 0	0ms 0ms	Script text/javascript	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__it.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d9b4a7ce18dc79741988e67e0f310d54e8762ac112ee22ffc8041c86e4819cf3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://mdr.esentire.com/ Origin https://mdr.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 11:51:42 GMT content-encoding gzip x-content-type-options nosniff age 15628 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 218345 x-xss-protection 0 last-modified Tue, 03 Sep 2024 02:00:38 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 10 Sep 2025 11:51:42 GMT
GET H3	200	ce788296-8259-4e39-bcae-56ddd5b7e767.js Show response cdn.mouseflow.com/projects/ Frame 5661	88 KB 0	0ms 0ms	Script application/javascript	104.18.26.50 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.mouseflow.com/projects/ce788296-8259-4e39-bcae-56ddd5b7e767.js Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.26.50 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc757accd72c081c680cc9c4b1381b6dee48edde66ec64a87a9963d4bdfa5a88 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://mdr.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT x-mf-continent EU age 541 x-cache-status MISS alt-svc h3=":443"; ma=86400 x-mf-script-region enforced-privacy x-mf-country IT last-modified Tue, 10 Sep 2024 15:23:35 GMT server cloudflare etag W/"b58a6067953db1:0" vary Accept-Encoding, Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=86400 cf-ray 8c10b2b09d7783ac-MXP expires Wed, 11 Sep 2024 16:12:09 GMT
GET H2	200	l use.typekit.net/af/89996a/000000000000000077359445/30/ Frame 5661	22 KB 0	1ms 1ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/89996a/000000000000000077359445/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 95a026ca9deb402ba2f984f169cab087ee00d5064f9d7554f946fe0807e662be Request headers Referer https://use.typekit.net/amm2djb.css Origin https://mdr.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT server nginx etag "d3de06ff3edf13d0a437cfac23873ccf84d0f4b1" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 22892
GET H2	200	l use.typekit.net/af/2c6c03/000000000000000077359463/30/ Frame 5661	24 KB 0	3ms 2ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/2c6c03/000000000000000077359463/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f9737651c97ca4327dd9d755ab8fd813bd504e8b7c975b7e1c63dcb154c1bc19 Request headers Referer https://use.typekit.net/amm2djb.css Origin https://mdr.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT server nginx etag "e3ec062323e4590b4b7846ed4c41ccffee56a2aa" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24908
GET H2	200	l use.typekit.net/af/0626f2/000000000000000077359441/30/ Frame 5661	23 KB 0	3ms 3ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/0626f2/000000000000000077359441/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/amm2djb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash c72dec0cf8cadba7af0e75dab5638b76af4cb53e02c171c2ff68f45318caaae9 Request headers Referer https://use.typekit.net/amm2djb.css Origin https://mdr.esentire.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:09 GMT server nginx etag "dd7ba2fabd12b224f191c0f337ced807f714d3d6" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24060
GET H3	200	anchor www.google.com/recaptcha/api2/ Frame 2A66	0 0	122ms 59ms	Document text/html	142.250.185.228 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly9tZHIuZXNlbnRpcmUuY29tOjQ0Mw..&hl=it&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=viun6hpkxn0o Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__it.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.228 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f4.1e100.net Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-z-P1znUNXiqts_8_KxN8pQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://mdr.esentire.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-z-P1znUNXiqts_8_KxN8pQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy-report-only same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" cross-origin-resource-policy cross-origin date Tue, 10 Sep 2024 16:12:11 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} server ESF x-content-type-options nosniff x-xss-protection 0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	311ms 310ms	Image image/gif	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A10%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.24 Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:11 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 10 Sep 2024 16:12:11 GMT
GET H3	200	zi-tag.js Show response js.zi-scripts.com/ Frame 5661	9 KB 3 KB	111ms 76ms	Script application/javascript	172.64.150.44 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/zi-tag.js Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Protocol H3 Security QUIC, , AES_128_GCM Server 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407 Request headers Referer https://mdr.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:11 GMT x-amz-version-id PTl7rnF_EEhUwyN5J882FhdYw1E0brGf content-encoding gzip cf-cache-status DYNAMIC via 1.1 488566c6c2cd3108c8176e63cecbf9e0.cloudfront.net (CloudFront) x-amz-cf-pop MXP63-P4 age 56715 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Thu, 18 Jul 2024 08:13:46 GMT server cloudflare etag W/"b2877da906a3216c4f3fc4030b205e54" vary Accept-Encoding content-type application/javascript cf-ray 8c10b2bd0f4bbb19-MXP x-amz-cf-id VkSz26bXW2ijzua2RI4DH8xnd2VAE2eSH5vfZ_k9aKffA2JTnrBgbA==
GET H/1.1	200 OK	pd.js Show response mdr.esentire.com/ Frame 5661	5 KB 2 KB	121ms 121ms	Script application/javascript	18.208.125.13 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://mdr.esentire.com/pd.js Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-125-13.compute-1.amazonaws.com Software / Resource Hash 41402adfc915ad6dfd6328c06c8038763d25fe603e63beba4a2638a2bbc03136 Request headers Referer https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:11 GMT content-encoding gzip X-Pardot-Route e8229a0ff18ebffc83a98010d2521dd5 last-modified Sat, 07 Sep 2024 05:28:04 GMT etag "15f4-gzip" vary Accept-Encoding,User-Agent Content-Type application/javascript cache-control max-age=63072000 Connection keep-alive accept-ranges bytes Content-Length 1988 expires Thu, 10 Sep 2026 16:12:11 GMT
GET H3	200	bframe www.google.com/recaptcha/api2/ Frame D1D6	0 0	48ms 45ms	Document text/html	142.250.185.228 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/bframe?hl=it&v=EGbODne6buzpTnWrrBprcfAY&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__it.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.228 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f4.1e100.net Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-XaVWpU0_mNRHLDpyyx6UKw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://mdr.esentire.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-XaVWpU0_mNRHLDpyyx6UKw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy-report-only same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" cross-origin-resource-policy cross-origin date Tue, 10 Sep 2024 16:12:11 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} server ESF x-content-type-options nosniff x-xss-protection 0
GET H3	200	getSubscriptions Show response js.zi-scripts.com/unified/v1/master/ Frame 5661	199 B 583 B	199ms 198ms	Fetch application/json	172.64.150.44 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash a9f139304e3a796255ab103f6cef04f9db07f8122828ac03d6f49b6707f72402 Request headers Content-Type application/json Referer https://mdr.esentire.com/ Authorization Bearer 9617e6db401669836307 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 visited_url https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Response headers date Tue, 10 Sep 2024 16:12:12 GMT via 1.1 c205f74aa99b4a794fa57396e24414b6.cloudfront.net (CloudFront) content-encoding gzip cf-cache-status DYNAMIC x-amz-cf-pop MXP63-P4 x-powered-by Express x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 apigw-requestid d5ZqcgV4PHcEPIw= server cloudflare etag W/"c7-tdV8DkxVXDWM9s27Oyi6/51fTZA" vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://mdr.esentire.com cf-ray 8c10b2bf5a6b3760-MXP x-amz-cf-id 0CW0uQtB9GF-03o-_9ygAOsIl3ldMeQmkxzRmJ9nx1bYXssx29iBvw==
OPTIONS H3	204	getSubscriptions js.zi-scripts.com/unified/v1/master/ Frame	0 0	284ms 249ms	Preflight	172.64.150.44 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Protocol H3 Security QUIC, , AES_128_GCM Server 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,content-type,visited_url Access-Control-Request-Method GET Origin https://mdr.esentire.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-headers Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken access-control-allow-methods POST, GET, OPTIONS, PATCH, DELETE, PUT access-control-allow-origin https://mdr.esentire.com alt-svc h3=":443"; ma=86400 apigw-requestid d5ZqaiavvHcESgg= cf-cache-status DYNAMIC cf-ray 8c10b2bdcf433760-MXP date Tue, 10 Sep 2024 16:12:12 GMT server cloudflare vary Origin via 1.1 29373b9bd21dbfdb73f410724bfb6328.cloudfront.net (CloudFront) x-amz-cf-id nXbaelL2Yj0OlynhhgIHwrYCJYmWcq2xePS5LL_HePl0b97N8YMR0w== x-amz-cf-pop MXP63-P4 x-cache Miss from cloudfront x-powered-by Express
GET H/1.1	200 OK	analytics Show response mdr.esentire.com/ Frame 5661	0 499 B	250ms 249ms	Script text/javascript	18.208.125.13 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://mdr.esentire.com/analytics?ver=3&pi_form=true&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=92316&account_id=652833&title=&url=https%3A%2F%2Fmdr.esentire.com%2Fl%2F651833%2F2023-08-01%2F2pz6mw&referrer=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/pd.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-125-13.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache Date Tue, 10 Sep 2024 16:12:11 GMT X-Pardot-Route 9b06e8e2308c32c7bf9ba8adfb7be2e1 x-pardot-rsp 0/0/1 vary User-Agent Content-Type text/javascript; charset=utf-8 p3p CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml" cache-control no-store, no-cache, must-revalidate Connection keep-alive x-pardot-canary true Content-Length 0 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	core js.driftt.com/ Frame 3538	0 0	228ms 162ms	Document text/html	18.245.86.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?d=1&embedId=ys3mr8d6dw69&eId=ys3mr8d6dw69&region=US&forceShow=false&skipCampaigns=false&sessionId=10e770e2-ac68-48fe-b1ed-04e03f340ffa&sessionStarted=1725984732.023&campaignRefreshToken=85e6ad77-a573-4918-b709-acebba36aaef&hideController=false&pageLoadStartTime=1725984729509&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1725984900000/ys3mr8d6dw69.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.14 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-14.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 10 Sep 2024 16:12:12 GMT etag W/"7fa6273776a10e1cff36c7df5a64a35b" last-modified Tue, 10 Sep 2024 16:07:57 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary accept-encoding via 1.1 75102a66d781b0fa0df5617ce2738546.cloudfront.net (CloudFront) x-amz-cf-id NgDVCUOszN_8W4W5hOD4Fx5YzuLVi_flxxuNC_0xedlKJHS7EIBGTw== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id Y5ufFSgiGhxIMl_WU.GqRDbmBkzut3.t x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 26
GET H2	200	chat js.driftt.com/core/ Frame A214	0 0	210ms 147ms	Document text/html	18.245.86.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1725984729509 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1725984900000/ys3mr8d6dw69.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.14 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-14.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 10 Sep 2024 16:12:12 GMT etag W/"7fa6273776a10e1cff36c7df5a64a35b" last-modified Tue, 10 Sep 2024 16:07:57 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary accept-encoding via 1.1 75102a66d781b0fa0df5617ce2738546.cloudfront.net (CloudFront) x-amz-cf-id SqBWHCxh6e-QC3kGTs9QqUKUxJrxYy5s24zhAXsY0fmszDA_GU-e_g== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id Y5ufFSgiGhxIMl_WU.GqRDbmBkzut3.t x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 22
GET H/1.1	200 OK	pd.js Show response mdr.esentire.com/	5 KB 0	0ms 0ms	Script application/javascript	18.208.125.13 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://mdr.esentire.com/pd.js Requested by Host: www.esentire.com URL: https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-125-13.compute-1.amazonaws.com Software / Resource Hash 41402adfc915ad6dfd6328c06c8038763d25fe603e63beba4a2638a2bbc03136 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:11 GMT content-encoding gzip X-Pardot-Route e8229a0ff18ebffc83a98010d2521dd5 last-modified Sat, 07 Sep 2024 05:28:04 GMT etag "15f4-gzip" vary Accept-Encoding,User-Agent Content-Type application/javascript cache-control max-age=63072000 accept-ranges bytes Content-Length 1988 expires Thu, 10 Sep 2026 16:12:11 GMT
GET H2	200	c.gif c.clarity.ms/ Redirect Chain https://c.clarity.ms/c.gif https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=9F72197174CB41FCBEAD91569F114A7B&RedC=c.clarity.ms&MXFR=1DA85F7145D56D8209854B8741D56379 https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=9F72197174CB41FCBEAD91569F114A7B&MUID=20B0970D59B76B3E191E83FB586A6AC3	42 B 465 B	56ms 56ms	Image image/gif	13.74.129.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=9F72197174CB41FCBEAD91569F114A7B&MUID=20B0970D59B76B3E191E83FB586A6AC3 Protocol H2 Server 13.74.129.1 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:12 GMT last-modified Wed, 14 Aug 2024 17:35:32 GMT server Microsoft-IIS/10.0 etag "bb391b5d70eeda1:0" x-powered-by ASP.NET content-type image/gif p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" cache-control private, no-cache, proxy-revalidate, no-store accept-ranges bytes content-length 42 Redirect headers pragma no-cache date Tue, 10 Sep 2024 16:12:12 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 6F71F091DD814DB1805696730E367A6D Ref B: MIL30EDGE0915 Ref C: 2024-09-10T16:12:12Z x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" location https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=9F72197174CB41FCBEAD91569F114A7B&MUID=20B0970D59B76B3E191E83FB586A6AC3 cache-control private, no-cache, proxy-revalidate, no-store content-length 0
GET H/1.1	200 OK	analytics Show response mdr.esentire.com/	3 KB 3 KB	466ms 465ms	Script text/javascript	18.208.125.13 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://mdr.esentire.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=null&account_id=652833&title=eSentire&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&referrer= Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/pd.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-125-13.compute-1.amazonaws.com Software / Resource Hash 2803a1a0046b004654fca2cbbff0eb5f4b1cf5701611950f790d582df9576545 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache Date Tue, 10 Sep 2024 16:12:12 GMT content-encoding gzip X-Pardot-Route 9b06e8e2308c32c7bf9ba8adfb7be2e1 x-pardot-rsp 0/0/1 vary Accept-Encoding,User-Agent Content-Type text/javascript; charset=utf-8 p3p CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" cache-control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 1441 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	204 No Content	collect Show response b.clarity.ms/	0 280 B	131ms 129ms	XHR text/plain	4.153.129.168 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://b.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.45/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 4.153.129.168 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.esentire.com Date Tue, 10 Sep 2024 16:12:12 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Vary Origin Request-Context appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
GET H3	200	formcomplete.js Show response ws-assets.zoominfo.com/ Frame 5661	90 KB 27 KB	92ms 82ms	Script application/javascript	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws-assets.zoominfo.com/formcomplete.js Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4 Request headers Referer https://mdr.esentire.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:12 GMT content-encoding gzip cf-cache-status DYNAMIC age 1230 x-guploader-uploadid AD-8ljt7b8rxFd70qPqoGLD82GQ6pgQolORUjVwzPYVk9ULiF-2TZx8bjPIUTPqjhG3XikID1NWbFjCyyg x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400 last-modified Thu, 16 May 2024 10:14:37 GMT server cloudflare etag W/"006455bd44ed289ddcc403d0ecd96ab0" x-goog-hash crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA== x-goog-generation 1715854477710382 content-type application/javascript cache-control public, max-age=3600 x-goog-stored-content-length 91778 cf-ray 8c10b2c0bd785231-MXP expires Tue, 10 Sep 2024 16:51:42 GMT
GET H3	200	/ Show response ws.zoominfo.com/pixel/3k8XsFBkOniCq5dTRwpV/ Frame 5661	3 KB 2 KB	239ms 221ms	Fetch text/javascript	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/3k8XsFBkOniCq5dTRwpV/?iszitag=true Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 2350ef973ce6e4b939e80f68532a40b70a8c28f72c114fb499fe6bf5884b5dc7 Security Headers Name Value X-Content-Type-Options nosniff Request headers visited-url https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw Referer https://mdr.esentire.com/l/651833/2023-08-01/2pz6mw _vtok MTkyLjE0NS4xMjcuMjE1 _zitok f4998d0c623d8ce2bf801725984732 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Type text/javascript Response headers date Tue, 10 Sep 2024 16:12:12 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin https://mdr.esentire.com access-control-allow-credentials true x-robots-tag noindex, nofollow access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url alt-svc h3=":443"; ma=86400 cf-ray 8c10b2c22f6c5231-MXP
OPTIONS H3	200	/ ws.zoominfo.com/pixel/3k8XsFBkOniCq5dTRwpV/ Frame	0 0	214ms 182ms	Preflight text/html	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/3k8XsFBkOniCq5dTRwpV/?iszitag=true Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers _vtok,_zitok,content-type,visited-url Access-Control-Request-Method GET Origin https://mdr.esentire.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url access-control-allow-origin https://mdr.esentire.com allow GET,HEAD alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8c10b2c0db740e56-MXP content-encoding gzip content-type text/html; charset=utf-8 date Tue, 10 Sep 2024 16:12:12 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
POST H3	200	forms Show response ws.zoominfo.com/formcomplete-v2/ Frame 5661	329 B 617 B	185ms 184ms	Fetch application/json	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/forms Requested by Host: ws-assets.zoominfo.com URL: https://ws-assets.zoominfo.com/formcomplete.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 0d25b195a9e079199c4c40786692b703ae9ac12797e545739d54b59910e3626b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://mdr.esentire.com/ Authorization bearer 6c382de353510dfcf1473a0344d536 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Type application/json Response headers date Tue, 10 Sep 2024 16:12:12 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google x-powered-by Express alt-svc h3=":443"; ma=86400 server cloudflare etag W/"149-adATgqvQQDs1zrZjZ3hYKQ0pHxU" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin https://mdr.esentire.com access-control-allow-credentials true x-robots-tag noindex, nofollow access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok cf-ray 8c10b2c2c8595231-MXP
OPTIONS H3	200	forms ws.zoominfo.com/formcomplete-v2/ Frame	0 0	178ms 178ms	Preflight text/html	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/forms Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://mdr.esentire.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok access-control-allow-origin https://mdr.esentire.com allow POST alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8c10b2c1acec0e56-MXP content-encoding gzip content-type text/html; charset=utf-8 date Tue, 10 Sep 2024 16:12:12 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	130ms 129ms	Image image/gif	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A11%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.24 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:12 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 10 Sep 2024 16:12:12 GMT
GET H/1.1	200 OK	analytics Show response pi.pardot.com/	50 B 1 KB	470ms 234ms	Script text/javascript	3.215.172.219 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pi.pardot.com/analytics?conly=true&visitor_id=630071608&visitor_id_sign=1c4b7bc327794f3947667085a612502af5491f007d48f787f60a49df9b4165f2ab24d74199abc852ccc88f029226ec1d20af812b&pi_opt_in=&campaign_id=69698&account_id=652833&title=eSentire&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&referrer= Requested by Host: mdr.esentire.com URL: https://mdr.esentire.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=null&account_id=652833&title=eSentire&url=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&referrer= Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-215-172-219.compute-1.amazonaws.com Software / Resource Hash dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache Date Tue, 10 Sep 2024 16:12:12 GMT strict-transport-security max-age=31536000; includeSubDomains X-Pardot-Route 9b06e8e2308c32c7bf9ba8adfb7be2e1 x-pardot-rsp 0/0/1 vary User-Agent Content-Type text/javascript; charset=utf-8 p3p CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" cache-control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 50 expires Thu, 19 Nov 1981 08:52:00 GMT
GET BLOB	200 OK	0d416c70-8bbc-4948-958f-4f81d2977ab3 Show response https://mdr.esentire.com/ Frame 5661	3 KB 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://mdr.esentire.com/0d416c70-8bbc-4948-958f-4f81d2977ab3 Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 2350ef973ce6e4b939e80f68532a40b70a8c28f72c114fb499fe6bf5884b5dc7 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Length 3029 Content-Type text/javascript
GET H3	200	getMapping Show response ws.zoominfo.com/formcomplete-v2/ Frame 5661	4 KB 1 KB	174ms 173ms	XHR application/json	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/getMapping?formId=b63ff39c-eb2e-46f5-83d8-13b1a021ffc8 Requested by Host: ws-assets.zoominfo.com URL: https://ws-assets.zoominfo.com/formcomplete.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 9dc24edf14078c73494d82fe7b648fd8fd453d53fb7a21d4ede5bbf81fd49ef8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://mdr.esentire.com/ _zitok f4998d0c623d8ce2bf801725984732 visitorId User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 16:12:13 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google x-powered-by Express alt-svc h3=":443"; ma=86400 server cloudflare etag W/"e7a-b68QFHZaTQ9qaoGN4gLYg7+C/5E" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin https://mdr.esentire.com access-control-allow-credentials true x-robots-tag noindex, nofollow access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok cf-ray 8c10b2c50bd45231-MXP
OPTIONS H3	200	getMapping ws.zoominfo.com/formcomplete-v2/ Frame	0 0	174ms 174ms	Preflight text/html	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/getMapping?formId=b63ff39c-eb2e-46f5-83d8-13b1a021ffc8 Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers _zitok,visitorid Access-Control-Request-Method GET Origin https://mdr.esentire.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok access-control-allow-origin https://mdr.esentire.com allow GET,HEAD alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8c10b2c3f8fb0e56-MXP content-encoding gzip content-type text/html; charset=utf-8 date Tue, 10 Sep 2024 16:12:12 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
GET H/1.1	200 OK	blue_favicon_48x48.ico esentire-dot-com-assets.s3.ca-central-1.amazonaws.com/assetsV4/External/	9 KB 10 KB	468ms 160ms	Other image/x-icon	3.5.253.186 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://esentire-dot-com-assets.s3.ca-central-1.amazonaws.com/assetsV4/External/blue_favicon_48x48.ico?v=2024 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.5.253.186 Montreal, Canada, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.ca-central-1.amazonaws.com Software AmazonS3 / Resource Hash eb00669d8aee4822bdc78b66583e1e852fecc587f342f783ccde7c0647f06c10 Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Tue, 10 Sep 2024 16:12:14 GMT x-amz-version-id 9_Vk6vo_KVWwICAwTVugnQwOlBsZi5Aq Last-Modified Wed, 10 Jan 2024 16:02:23 GMT Server AmazonS3 x-amz-request-id VY0X5E3ZYP5K0P84 ETag "6a64c79bf17117dee28c50ddbb747e59" x-amz-server-side-encryption AES256 Content-Type image/x-icon Accept-Ranges bytes Content-Length 9662 x-amz-id-2 iNRDo7WV6k6/yj4GXnCep2xPfn2E+mXE10Ekem+oQc9xuV9ZAWLy4LWeFYQN8CJR/C2WkVd+OBWs36j/2iCM3sdP6pl450j6
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	137ms 137ms	Image image/gif	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A12%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.24 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:13 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 10 Sep 2024 16:12:13 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	146ms 145ms	Image image/gif	95.101.111.170 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.24 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 10 Sep 2024 16:12:14 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Tue, 10 Sep 2024 16:12:14 GMT
POST H/1.1	204 No Content	collect Show response b.clarity.ms/	0 280 B	123ms 122ms	XHR text/plain	4.153.129.168 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://b.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.45/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 4.153.129.168 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://www.esentire.com/blog/lummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading&e User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.esentire.com Date Tue, 10 Sep 2024 16:12:14 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Vary Origin Request-Context appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
POST		collect region1.analytics.google.com/g/	0 0
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.esentire.com

URL

blob:https://www.esentire.com/034b8bab-158e-43d5-b4c8-a4d145403452

Domain

region1.analytics.google.com

URL

https://region1.analytics.google.com/g/collect?v=2&tid=G-2XXPJCPHB7&gtm=45je4940v895821412za200zb813556160&_p=1725984729350&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=1711787598.1725984730&ul=it-it&sr=1600x1200&are=1&frm=0&pscdl=noapi&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAg&_s=2&sid=1725984729&sct=1&seg=0&dl=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&dt=eSentire&en=Blog_visit&_et=2&tfd=6419

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=9521f388917852d4872d30f86ea1a41c&svisitor=null&visitor=493b13f2-c7d4-49a1-8da2-e58397fe8fcb&session=1229cf55-2d55-4cdd-8fc4-f88bbe392cef&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2010%20Sep%202024%2016%3A12%3A14%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225005%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22eSentire%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.esentire.com%2Fblog%2Flummac2-malware-and-malicious-chrome-extensiondelivered-via-dll-side-loading%26e&pageViewId=83f1e247-2743-4b09-8430-138992420fb6&webTagId=92169fb0-0d98-4c23-b691-2da2893257b1&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.24