www.microsoft.com Open in urlscan Pro
2a02:26f0:6c00:28b::356e Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:O97M/TrickBot.RT!MTB&threatid=2147762719&enterprise=1
Effective URL:
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!M...
Submission: On March 30 via manual (March 30th 2021, 4:35:22 pm UTC) from US

Summary HTTP 38 Redirects Links 39 Behaviour Indicators

Summary

This website contacted 14 IPs in 4 countries across 9 domains to perform 38 HTTP transactions. The main IP is 2a02:26f0:6c00:28b::356e, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is www.microsoft.com.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on August 28th 2020. Valid for: a year.

This is the only time www.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a02:26f0:6c0... 2a02:26f0:6c00:29c::2c1a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 6	2a02:26f0:6c0... 2a02:26f0:6c00:28b::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	23.96.1.109 23.96.1.109	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a02:26f0:6c0... 2a02:26f0:6c00:281::2957	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.32.238.226 23.32.238.226	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:710... 2a02:26f0:7100:2a5::37	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2620:1ec:46::19 2620:1ec:46::19	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba1b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a02:26f0:64:... 2a02:26f0:64::210:6a70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a02:26f0:6c0... 2a02:26f0:6c00:292::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	40.77.226.250 40.77.226.250	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	20.190.160.75 20.190.160.75	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	192.229.221.185 192.229.221.185	15133 (EDGECAST) (EDGECAST)
38	14

1 2a02:26f0:6c00:29c::2c1a (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

go.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:6c00:28b::356e (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

www.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.96.1.109 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

securityintelligencecenter-eastus.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:281::2957 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.onestore.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.32.238.226 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-32-238-226.deploy.static.akamaitechnologies.com

statics-marketingsites-eus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:7100:2a5::37 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

mem.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:46::19 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

wcpstatic.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

az725175.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba1b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

img-prod-cms-rt-microsoft-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:64::210:6a70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

statics-mwf-wcus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:292::356e (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

web.vortex.data.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.190.160.75 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.221.185 (United States)

ASN15133 (EDGECAST, US)

logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	microsoft.com 2 redirects go.microsoft.com www.microsoft.com wcpstatic.microsoft.com web.vortex.data.microsoft.com	184 KB
10	azurewebsites.net securityintelligencecenter-eastus.azurewebsites.net	285 KB
5	akamaized.net statics-marketingsites-eus-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net statics-mwf-wcus-ms-com.akamaized.net	8 KB
4	gfx.ms mem.gfx.ms	67 KB
3	s-microsoft.com c.s-microsoft.com	89 KB
3	onestore.ms assets.onestore.ms	151 KB
1	msauth.net logincdn.msauth.net	6 KB
1	live.com login.live.com	5 KB
1	msecnd.net az725175.vo.msecnd.net	18 KB
38	9

	Domain	Requested by
10	securityintelligencecenter-eastus.azurewebsites.net	www.microsoft.com
6	www.microsoft.com	1 redirects www.microsoft.com
4	web.vortex.data.microsoft.com	az725175.vo.msecnd.net
4	mem.gfx.ms	www.microsoft.com mem.gfx.ms
3	c.s-microsoft.com	assets.onestore.ms
3	statics-mwf-wcus-ms-com.akamaized.net	www.microsoft.com
3	assets.onestore.ms	www.microsoft.com
1	logincdn.msauth.net	login.live.com
1	login.live.com	mem.gfx.ms
1	img-prod-cms-rt-microsoft-com.akamaized.net	www.microsoft.com
1	az725175.vo.msecnd.net	www.microsoft.com
1	wcpstatic.microsoft.com	www.microsoft.com
1	statics-marketingsites-eus-ms-com.akamaized.net	www.microsoft.com
1	go.microsoft.com	1 redirects
38	14

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
cloudblogs.microsoft.com
support.microsoft.com
azure.microsoft.com
products.office.com
dynamics.microsoft.com
powerplatform.microsoft.com
powerbi.microsoft.com
visualstudio.microsoft.com
docs.microsoft.com
developer.microsoft.com
fasttrack.microsoft.com
partner.microsoft.com
partnercenter.microsoft.com
appsource.microsoft.com
azuremarketplace.microsoft.com
events.microsoft.com
windows.microsoft.com
www.facebook.com
twitter.com
account.microsoft.com
channel9.msdn.com
careers.microsoft.com
news.microsoft.com
privacy.microsoft.com
choice.microsoft.com

Subject Issuer	Validity	Valid
www.microsoft.com Microsoft RSA TLS CA 01	`2020-08-28` - `2021-08-28`	a year	crt.sh
*.azurewebsites.net Microsoft RSA TLS CA 01	`2020-09-28` - `2021-09-28`	a year	crt.sh
wildcard.onestore.ms Microsoft RSA TLS CA 01	`2021-01-19` - `2022-01-19`	a year	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
mem.gfx.ms Microsoft RSA TLS CA 02	`2020-11-11` - `2021-11-11`	a year	crt.sh
wcpstatic.microsoft.com DigiCert SHA2 Secure Server CA	`2020-09-15` - `2021-09-15`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2020-11-16` - `2021-11-10`	a year	crt.sh
*.vortex.data.microsoft.com Microsoft RSA TLS CA 02	`2020-10-05` - `2021-10-05`	a year	crt.sh
graph.windows.net DigiCert SHA2 Secure Server CA	`2021-02-24` - `2022-02-23`	a year	crt.sh
identitycdn.msauth.net DigiCert SHA2 Secure Server CA	`2020-07-20` - `2021-07-20`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
Frame ID: ED074C8B1C146757587934E9B8A2AC7F
Requests: 36 HTTP requests in this frame

Frame: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=599a4d50-25de-410e-77fd-8f89f6e629bc&partnerId=mssecurityportal
Frame ID: 08DDDB3452D4E3DEE6078D95D2E839EC
Requests: 2 HTTP requests in this frame

Frame: https://www.microsoft.com/store/buy/cartcount
Frame ID: 051BD538F170FB48D1F3BFD18836AEA1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:O97M/TrickBot.RT!MTB&threatid=214... HTTP 302
https://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=TrojanDownloader%3aO97M%... HTTP 301
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3a... Page URL

Page Statistics

38
Requests

100 %
HTTPS

57 %
IPv6

9
Domains

14
Subdomains

14
IPs

4
Countries

814 kB
Transfer

2919 kB
Size

3
Cookies

39 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?LinkId=521839
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://cloudblogs.microsoft.com/microsoftsecure/?product=windows,windows-defender-advanced-threat-protection
Title: Blogs

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/help/17466/windows-defender-offline-help-protect-my-pc
Title: Microsoft Defender Offline

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/
Title: Azure

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/business/office
Title: Office 365

Search URL Search Domain Scan URL

URL: https://dynamics.microsoft.com/en-us/
Title: Dynamics 365

Search URL Search Domain Scan URL

URL: https://powerplatform.microsoft.com/en-us
Title: Power Platform

Search URL Search Domain Scan URL

URL: https://powerbi.microsoft.com/en-us/
Title: Power BI

Search URL Search Domain Scan URL

URL: https://visualstudio.microsoft.com/
Title: Visual Studio

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2026462
Title: Microsoft Advertising

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/services/cognitive-services/
Title: Azure Cognitive Services

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/
Title: Docs

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/
Title: Developer Center

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/windows
Title: Windows Dev Center

Search URL Search Domain Scan URL

URL: https://fasttrack.microsoft.com/office
Title: FastTrack

Search URL Search Domain Scan URL

URL: https://partner.microsoft.com/
Title: Partner Network

Search URL Search Domain Scan URL

URL: https://partnercenter.microsoft.com/partner/home
Title: Partner Center

Search URL Search Domain Scan URL

URL: https://appsource.microsoft.com/
Title: AppSource

Search URL Search Domain Scan URL

URL: https://azuremarketplace.microsoft.com/marketplace/
Title: Azure Marketplace

Search URL Search Domain Scan URL

URL: https://events.microsoft.com/
Title: Events

Search URL Search Domain Scan URL

URL: http://windows.microsoft.com/en-us/windows/using-defender#1TC=windows-10
Title: Windows Defender Antivirus

Search URL Search Domain Scan URL

URL: https://www.facebook.com/MsftWDSI/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/WDSecurity
Title:

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/
Title: Account profile

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2139749
Title: Microsoft Store support

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824764&clcid=0x409
Title: Returns

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/orders
Title: Order tracking

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/academic/compare-office-365-education-plans
Title: Office 365 for schools

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/community/education/
Title: Microsoft Azure in education

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=808093
Title: AppSource

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/store/register
Title: Microsoft developer program

Search URL Search Domain Scan URL

URL: https://channel9.msdn.com/
Title: Channel 9

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/office
Title: Office Dev Center

Search URL Search Domain Scan URL

URL: https://careers.microsoft.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://news.microsoft.com/
Title: Company news

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-us
Title: Privacy at Microsoft

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/contactus
Title: Contact Microsoft

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=206977
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://choice.microsoft.com/
Title: About our ads

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:O97M/TrickBot.RT!MTB&threatid=2147762719&enterprise=1 HTTP 302
https://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1 HTTP 301
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

38 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request malware-encyclopedia-description Show response
www.microsoft.com/en-us/wdsi/threats/
Redirect Chain

https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:O97M/TrickBot.RT!MTB&threatid=2147762719&enterprise=1
https://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

103 KB
24 KB

11887ms
11887ms

Document
text/html

2a02:26f0:6c00:28b::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:28b::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

61f1ba12ac808df1516908d10c91edac0dfe14dd28024593abd6d26c18624010

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control: private
content-length: 23764
content-type: text/html; charset=utf-8
content-encoding: gzip
request-context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
x-content-type-options: NOSNIFF
x-frame-options: SAMEORIGIN
date: Tue, 30 Mar 2021 16:35:05 GMT
vary: Accept-Encoding
set-cookie: ARRAffinity=c3e33b9df30e714aacd68c50dff532070930266474e33bc51a4214f0dd78dbc3;Path=/;HttpOnly;Secure;Domain=wdsi-filesubmission.trafficmanager.net ARRAffinitySameSite=c3e33b9df30e714aacd68c50dff532070930266474e33bc51a4214f0dd78dbc3;Path=/;HttpOnly;SameSite=None;Secure;Domain=wdsi-filesubmission.trafficmanager.net
tls_version: tls1.3
strict-transport-security: max-age=31536000
x-rtag: RT

Redirect headers

content-length: 0
location: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
x-edgeconnect-midmile-rtt: 102
x-edgeconnect-origin-mex-latency: 20
expires: Tue, 30 Mar 2021 16:34:53 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Tue, 30 Mar 2021 16:34:53 GMT
tls_version: tls1.3
strict-transport-security: max-age=31536000
x-rtag: RT

GET
H/1.1 200
OK bootstrap
securityintelligencecenter-eastus.azurewebsites.net/Content/ 118 KB
28 KB 517ms
116ms Stylesheet
text/css 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/Content/bootstrap

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

37c5214d97f0425f87d35cbf2b38808b13d473378c422509573ed4ef2b6d5a95

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 27455
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H/1.1 200
OK jqueryui
securityintelligencecenter-eastus.azurewebsites.net/Content/ 28 KB
9 KB 515ms
114ms Stylesheet
text/css 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/Content/jqueryui

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7e9abff7ebb4effe42b7afde7bb35b7c0cfef2a9941d69650808500cbdd742fd

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 8795
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H2 200 mwf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/ 554 KB
67 KB 34ms
7ms Stylesheet
text/css 2a02:26f0:6c00:281::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:281::2957 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

5d597f619952c5c0413857824efe8c368707f3e67d68ae2044e4a5eb72b76d3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff, nosniff, nosniff, nosniff

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff, nosniff, nosniff, nosniff, nosniff
last-modified: Wed, 04 Oct 2017 00:06:20 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5: BtXM7uiDrg7XbNbyPzPyqA==
etag: "0x8D50ABBBE258E40"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 68034
x-ms-lease-state: available

GET
H2 200 uhf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/ 121 KB
15 KB 42ms
15ms Stylesheet
text/css 2a02:26f0:6c00:281::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/uhf-west-european-default.min.css

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:281::2957 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

45ad5e774a5d9645fff24da7a9dba40d1ac6923519d07914be0cf215cc425e2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff
last-modified: Wed, 04 Oct 2017 00:06:30 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5: s/sGZtUhhPqlwI8iRy1vYA==
etag: "0x8D50ABBC4313109"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15057
x-ms-lease-state: available

GET
H/1.1 200
OK site
securityintelligencecenter-eastus.azurewebsites.net/Content/ 2 KB
2 KB 514ms
114ms Stylesheet
text/css 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/Content/site

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

16e6e27a9f4a796339c310a7eb93c36084a9ef6471f0abf7af515be97da323b8

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 768
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H2 200 ee-51d4e0
www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/da-ca92fa/c1-fdfb75/18-f85c57/94-fde08a/1c-c5c0a3/f1-6eb97f/3b-e19f1c/ 165 KB
22 KB 44ms
40ms Stylesheet
text/css 2a02:26f0:6c00:28b::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/da-ca92fa/c1-fdfb75/18-f85c57/94-fde08a/1c-c5c0a3/f1-6eb97f/3b-e19f1c/ee-51d4e0?ver=2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:28b::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4b5da91ccc0a5063f5096201b50587b3f8ec68ae799f13cef8571ba936f2ca39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ms-operation-id: 327a99a6d2f5294ebc0edc53a71114d6
date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2021-03-26T10:24:34
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: 802f961b-0a7b-4387-9321-fd80a7001493
tls_version: tls1.3
x-s1: 2021-03-26T10:24:34
ms-cv: UgniNRaePkCsqulv.0
vary: Accept-Encoding
content-length: 22297
x-xss-protection: 1; mode=block
last-modified: Fri, 26 Mar 2021 10:24:34 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2021-03-12T04:01:36.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31168169
timing-allow-origin: *
x-appversion: 1.0.7740.34248
expires: Sat, 26 Mar 2022 10:24:34 GMT

GET
H/1.1 200
OK override.css
statics-marketingsites-eus-ms-com.akamaized.net/statics/ 1 KB
907 B 100ms
29ms Stylesheet
text/css 23.32.238.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css?c=7
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 23.32.238.226 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-32-238-226.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 30 Mar 2021 16:35:05 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jun 2019 23:22:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D6EEC3A2D67C35
Vary: Accept-Encoding
Content-Type: text/css
x-ms-request-id: 90e832bc-f01e-0037-0c67-9ca6a5000000
x-ms-version: 2009-09-19
Connection: keep-alive
Content-Length: 473

GET
H/1.1 200
OK jquery Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 584 KB
220 KB 518ms
117ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/jquery

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

68eb1b68ce12ddf4e3aec1ce64cf031a94daf13a90df876eba94ca6ce36a28eb

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Transfer-Encoding: chunked
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H/1.1 200
OK jqueryui Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 0
729 B 522ms
116ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/jqueryui

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:04 GMT
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent
Content-Length: 0
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H/1.1 200
OK modernizr Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 11 KB
6 KB 531ms
120ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/modernizr

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 5229
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H/1.1 200
OK bootstrap Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 42 KB
16 KB 631ms
116ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/bootstrap

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b40200ca67f4c31d0e8b8ce914c9d2786a506a1c29e1a9cdeb841d555a1e79ee

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 16081
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H/1.1 200
OK site Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 2 KB
2 KB 630ms
114ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/site

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

389dbd8a2c1c1f70a9774b3cc353b2424e21d455aa2988c28d9139444790c1a5

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Tue, 30 Mar 2021 16:35:05 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 1392
Expires: Wed, 30 Mar 2022 16:35:05 GMT

GET
H2 200 mwf-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/scripts/ 295 KB
69 KB 42ms
17ms Script
application/x-javascript 2a02:26f0:6c00:281::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/scripts/mwf-main.var.min.js

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:281::2957 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

fdda94d6f04cee5097401cf9131ae9c2eb83f89f6f1def976799f161e862ee80

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff
last-modified: Wed, 04 Oct 2017 00:06:31 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5: QCHr9xF2/V6zxFFEEcCTqA==
etag: "0x8D50ABBC4B1D494"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 69465
x-ms-lease-state: available

GET
H/1.1 200
OK meversion Show response
mem.gfx.ms/ 27 KB
10 KB 36ms
7ms Script
application/javascript 2a02:26f0:7100:2a5::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/meversion?partner=webframework&market=en-us

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:7100:2a5::37 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

cd9da940067dc9fb41e9963fa2ecc1714b1ce9d5f15d8aa33b25bfbda739904f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Tue, 30 Mar 2021 16:35:05 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, no-transform, max-age=43200
X-UA-Compatible: IE=edge
Connection: keep-alive
Content-Length: 9532
Expires: Tue, 30 Mar 2021 19:43:06 GMT

GET
H2 200 wcp-consent.js Show response
wcpstatic.microsoft.com/mscc/lib/v2/ 249 KB
74 KB 39ms
10ms Script
application/javascript 2620:1ec:46::19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::19 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 30 Mar 2021 16:35:04 GMT
content-encoding: gzip
vary: Accept-Encoding
content-md5: OLdpUi3Q5MKZjJA0pU4XTg==
age: 3203
x-cache: HIT
content-length: 75124
x-ms-lease-status: unlocked
last-modified: Wed, 14 Oct 2020 22:31:12 GMT
etag: 0x8D87090DB39FE9E
x-azure-ref: 0OVNjYAAAAABzkNu4bqHQRZmk+HC2YmJYRlJBRURHRTEwMTAAMzliNDYxNTctY2I5ZS00OWI3LWE2NWEtODcyMmEzZjgyNGU0
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 1ea8a011-201e-0011-2f7b-25ac53000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 17-f90ef1 Show response
www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4... 131 KB
35 KB 66ms
63ms Script
text/javascript 2a02:26f0:6c00:28b::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/bb-d7480b/db-bc0148/dc-7e9864/6d-c07ea1/29-1ec5a9/f6-aa5278/cd-23d3b0/6d-1e7ed0/b7-cadaa7/c4-898cf2/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/69-13871c/b7-0ad59f/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/17-f90ef1?ver=2.0&iife=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:28b::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

de7fd966c03714fd1dc6eb4b17edd524a7d4872933c5db46806dcb480c5598d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ms-operation-id: 1a2dfcb83ec30846b084fca006c07cc1
date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2021-03-26T09:28:51
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: 2cf2f0fc-f101-4795-9499-1b4c567a545a
tls_version: tls1.3
x-s1: 2021-03-26T09:28:51
ms-cv: xhD++U33+E6/GdVr.0
vary: Accept-Encoding
content-length: 35232
x-xss-protection: 1; mode=block
last-modified: Fri, 26 Mar 2021 09:28:51 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2021-03-12T04:01:36.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31164826
timing-allow-origin: *
x-appversion: 1.0.7740.34248
expires: Sat, 26 Mar 2022 09:28:51 GMT

GET
H/1.1 200
OK meversion Show response
mem.gfx.ms/ 27 KB
10 KB 7ms
7ms Script
application/javascript 2a02:26f0:7100:2a5::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/meversion?partner=MSSecurityPortal&market=en-us&uhf=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:7100:2a5::37 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

dfa1c9a97a31f7a8dac645380ae147f39877389daf0663b15411a618b5f43cd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Tue, 30 Mar 2021 16:35:05 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, no-transform, max-age=43200
X-UA-Compatible: IE=edge
Connection: keep-alive
Content-Length: 9538
Expires: Tue, 30 Mar 2021 17:36:37 GMT

GET
H2 200 jsll-4.js Show response
az725175.vo.msecnd.net/scripts/ 55 KB
18 KB 124ms
32ms Script
text/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C7E) /
Resource Hash: e246eff2f6ae3e255a06eb561e6fc93ae3bef2cce22c5e0124d713c15f80567c

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
content-md5: yvXHFTB8uAvUsw4tqOlcNw==
age: 1578
x-cache: HIT
content-length: 18421
x-ms-lease-status: unlocked
last-modified: Mon, 22 Feb 2021 22:33:25 GMT
server: ECAcc (mil/6C7E)
etag: 0x8D8D781DE4DEC32
vary: Accept-Encoding
content-type: text/javascript; charset="utf-8"
access-control-allow-origin: *
x-ms-request-id: fe6494fe-c01e-0055-657e-25245c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800, immutable
x-ms-version: 2009-09-19

GET
H2 200 RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 4 KB
4 KB 34ms
6ms Image
image/png 2a02:26f0:6c00::210:ba1b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:6c00::210:ba1b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960

Security Headers

Name	Value
X-Frame-Options	deny

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-cms-cdninvalkey: am:RE1Mu3b
date: Tue, 30 Mar 2021 16:35:05 GMT
last-modified: Sun, 28 Mar 2021 14:38:39 GMT
timing-allow-origin: *
x-datacenter: NorthEU
x-source-length: 4054
x-frame-options: deny
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=252211
x-activityid: 6457deac-82cc-4056-acab-b5e330f45979
x-deployment: a89a5014e89c41b7b60a64d7ee950637
content-location: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
content-length: 4054
expires: Fri, 02 Apr 2021 14:38:36 GMT

GET
H/1.1 200
OK 30x30_happy.png
securityintelligencecenter-eastus.azurewebsites.net/content/ 480 B
766 B 112ms
111ms Image
image/png 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/content/30x30_happy.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

e46ec8fe0d90eda8729be2a1e6d56cd65da4ee9e4851ee49d02cd0b141b9a65d

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:05 GMT
X-Content-Type-Options: NOSNIFF
Last-Modified: Thu, 04 Feb 2021 00:05:50 GMT
Server: Microsoft-IIS/10.0
ETag: "0c3de7e89fad61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 480

GET
H/1.1 200
OK 30x30_sad.png
securityintelligencecenter-eastus.azurewebsites.net/content/ 483 B
769 B 112ms
112ms Image
image/png 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/content/30x30_sad.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

ab427284fbe1ae77c2895c78d9da9ebcfa5eb211173c7ef9be705c4dedbc413a

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 30 Mar 2021 16:35:05 GMT
X-Content-Type-Options: NOSNIFF
Last-Modified: Thu, 04 Feb 2021 00:05:50 GMT
Server: Microsoft-IIS/10.0
ETag: "0c3de7e89fad61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 483

GET
H2 200 facebook.svg
statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/ 461 B
874 B 43ms
22ms Image
image/svg+xml 2a02:26f0:64::210:6a70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/facebook.svg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:64::210:6a70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

1b90d623aded4efa4ac6470083fa721dee7d5619141175c7ca914d71a05da460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ms-operation-id: 1ea360cfc6becd4bb5085315df6d246e
date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: 0aefb0f4-2519-4dbb-a1c2-dd3f951c56b6
ms-cv: nz7aMU3Ke0SPzP2r.0
content-length: 331
x-xss-protection: 1; mode=block
last-modified: Fri, 18 Oct 2019 19:27:10 GMT
server: Microsoft-IIS/10.0
x-az: {did:465c2693b8cc432da90e2d8e62cdf5bc, rid: 5, sn: mwf-wcus-prod, dt: 2020-03-20T00:30:42.0320188Z, bt: 2020-01-22T22:13:28.0000000Z}
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=12141397
x-appversion: 1.0.7326.40004
expires: Wed, 18 Aug 2021 05:11:42 GMT

GET
H2 200 twitter.svg
statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/ 831 B
1011 B 17ms
17ms Image
image/svg+xml 2a02:26f0:64::210:6a70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/twitter.svg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:64::210:6a70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

f4d21dc6a3bc75e851bccd0b7faab2f09930184e3b112a6feba5cecb0c6c13c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ms-operation-id: 327419dae133bb4d857606c8a61e12f8
date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: 44edc60a-dbff-44d0-b69a-8e3bd2b3a5a3
ms-cv: XhmhfIDFq0qGwAtU.0
content-length: 468
x-xss-protection: 1; mode=block
last-modified: Fri, 18 Oct 2019 16:45:46 GMT
server: Microsoft-IIS/10.0
x-az: {did:465c2693b8cc432da90e2d8e62cdf5bc, rid: 4, sn: mwf-wcus-prod, dt: 2020-02-27T19:46:51.8737813Z, bt: 2020-02-19T00:12:08.0000000Z}
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=12110349
x-appversion: 1.0.7354.364
expires: Tue, 17 Aug 2021 20:34:14 GMT

GET
H2 200 rss.svg
statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/ 554 B
871 B 16ms
16ms Image
image/svg+xml 2a02:26f0:64::210:6a70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/rss.svg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:64::210:6a70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

1046d9a67d0b1c6dbfa1debafd073d74e8a6f16fa20bdb4b71008d4484f880d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 16:35:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: c46d9f9f-0fa4-4b69-bd88-42de84d594c0
ms-cv: ga842xJ8JkeF5WAw.0
content-length: 350
x-xss-protection: 1
last-modified: Fri, 18 Oct 2019 15:51:54 GMT
server: Microsoft-IIS/10.0
x-az: {did:465c2693b8cc432da90e2d8e62cdf5bc, rid: 3, sn: mwf-wcus-prod, dt: 2019-10-18T15:35:00.6353017Z, bt: 2018-12-01T00:33:22.0000000Z}
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=12097688
access-control-allow-headers: *
x-appversion: 1.0.6909.1001
expires: Tue, 17 Aug 2021 17:03:13 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 33 KB
34 KB 34ms
15ms Font
font/woff2 2a02:26f0:6c00:292::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:292::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 16:35:05 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "588d483e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=295340
accept-ranges: bytes
content-length: 34052
expires: Sat, 03 Apr 2021 02:37:25 GMT

GET
H/1.1 200
OK t.js Show response
web.vortex.data.microsoft.com/collect/v1/ 281 B
966 B 199ms
48ms Script
application/javascript 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272021-03-30T16%3A35%3A05.945Z%27&os=%27Windows%27&appId=%27JS%3AWDSI-Prod%27&-ver=%271.0%27&-impressionGuid=%27a81997c7-ea44-4f78-a6e8-1a452cb00ce4%27&-pageName=%27malware-encyclopedia-description%27&-uri=%27https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fwdsi%2Fthreats%2Fmalware-encyclopedia-description%3Fname%3DTrojanDownloader%253aO97M%252fTrickBot.RT!MTB%26threatid%3D2147762719%26enterprise%3D1%27&-market=%27en-us%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22metaTags%22%3A%7B%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27TrojanDownloader%3AO97M%2FTrickBot.RT!MTB%20threat%20description%20-%20Microsoft%20Security%20Intelligence%27&*isLoggedIn=false&*flashInstalled=false&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.3.5%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false

Requested by

Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

fe883d142e29e21a3308c3075cdd3f41587a4e061c1e0eac6d7b3a945cff50d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 Mar 2021 16:35:06 GMT
X-Content-Type-Options: nosniff
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control: no-cache, no-store
MS-CV: tnTEWjr10U2rCMg3DKwLBA.0
Content-Type: application/javascript
Content-Length: 281
Expires: 0

GET
H2 200 mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 26 KB
26 KB 16ms
16ms Font
application/font-woff 2a02:26f0:6c00:28b::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/da-ca92fa/c1-fdfb75/18-f85c57/94-fde08a/1c-c5c0a3/f1-6eb97f/3b-e19f1c/ee-51d4e0?ver=2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:28b::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/da-ca92fa/c1-fdfb75/18-f85c57/94-fde08a/1c-c5c0a3/f1-6eb97f/3b-e19f1c/ee-51d4e0?ver=2.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ms-operation-id: e6b51ced5b6013429355f1a4cef5f3d1
date: Tue, 30 Mar 2021 16:35:05 GMT
x-content-type-options: nosniff
x-rtag: RT
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: 650b6fb8-d135-40f3-8738-c004529b92a0
tls_version: tls1.3
ms-cv: vU3H3Vlo5kSgwBUg.0
content-length: 26288
x-xss-protection: 1; mode=block
last-modified: Fri, 26 Mar 2021 10:24:40 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2021-03-12T04:01:36.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31168175
x-appversion: 1.0.7740.34248
expires: Sat, 26 Mar 2022 10:24:40 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ 29 KB
29 KB 8ms
8ms Font
font/woff2 2a02:26f0:6c00:292::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:292::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 16:35:05 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "5b68d583e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=95046
accept-ranges: bytes
content-length: 29388
expires: Wed, 31 Mar 2021 18:59:11 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/ 27 KB
27 KB 6ms
6ms Font
font/woff2 2a02:26f0:6c00:292::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:292::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 16:35:06 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "1282d283e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=338669
accept-ranges: bytes
content-length: 27168
expires: Sat, 03 Apr 2021 14:39:35 GMT

GET
H/1.1 200
OK meBoot.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.21035.1/en-US/ 154 KB
30 KB 24ms
7ms Script
application/javascript 2a02:26f0:7100:2a5::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.21035.1/en-US/meBoot.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurityPortal&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:7100:2a5::37 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

c047474df4c9824f23e7f41cf51babb803a65d09036aff8cfeb8bff308d8be87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 04 Feb 2021 19:48:30 GMT
ETag: "1d6fb71c474dcd8"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Date: Tue, 30 Mar 2021 16:35:06 GMT
Connection: keep-alive
Content-Length: 30804
X-UA-Compatible: IE=edge

GET
DATA 200
OK truncated
/ 358 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 49ms
48ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D73ca325da4ca4c81a3d958d25a9cf80e%26HASH%3D73ca%26LV%3D202103%26V%3D4%26LU%3D1617122106125%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H/1.1 200
OK Cookie set me.srf Show response
login.live.com/ Frame 08DD 10 KB
5 KB 293ms
185ms Document
text/html 20.190.160.75
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=599a4d50-25de-410e-77fd-8f89f6e629bc&partnerId=mssecurityportal

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.21035.1/en-US/meBoot.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

20.190.160.75 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

eb2624abf95e3388ee3a51d149a07200e03196ece33d0ca6cc8549f70f8d4bd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: login.live.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.microsoft.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.microsoft.com/

Response headers

Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: deflate
Expires: Tue, 30 Mar 2021 16:34:06 GMT
Vary: Accept-Encoding
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Set-Cookie: uaid=599a4d5025de410e77fd8f89f6e629bc; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly MSPRequ=id=N&lt=1617122106&co=1; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly
Referrer-Policy: strict-origin-when-cross-origin
x-ms-route-info: R3_BAY
x-ms-request-id: ff2c31e7-1ba2-4ee6-a298-fcab0920720d
PPServer: PPV: 30 H: BY1PPF45552B53E V: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
Date: Tue, 30 Mar 2021 16:35:05 GMT
Content-Length: 4323

GET
H/1.1 200
OK meCore.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.21035.1/en-US/ 99 KB
17 KB 8ms
7ms Script
application/javascript 2a02:26f0:7100:2a5::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.21035.1/en-US/meCore.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurityPortal&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:7100:2a5::37 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

c965f854e2429f283ac9ca2f8f7641b10e6f43f7ef1f0ad6482f1f7b6b5a21f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 04 Feb 2021 19:48:34 GMT
ETag: "1d6fb71c6d898ea"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Date: Tue, 30 Mar 2021 16:35:06 GMT
Connection: keep-alive
Content-Length: 17045
X-UA-Compatible: IE=edge

GET
H2 200 cartcount Show response
www.microsoft.com/store/buy/ Frame 051B 1 KB
1 KB 17ms
16ms Document
text/html 2a02:26f0:6c00:28b::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/store/buy/cartcount

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/bb-d7480b/db-bc0148/dc-7e9864/6d-c07ea1/29-1ec5a9/f6-aa5278/cd-23d3b0/6d-1e7ed0/b7-cadaa7/c4-898cf2/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/69-13871c/b7-0ad59f/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/17-f90ef1?ver=2.0&iife=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:28b::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

68d929a10c3cd609b936b50a541533994b044b38558a33530ff45d1b420cc07e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /store/buy/cartcount
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: MC1=GUID=73ca325da4ca4c81a3d958d25a9cf80e&HASH=73ca&LV=202103&V=4&LU=1617122106125; MS0=9714dc7b8d0b4a7fa2e111f976850804; MSFPC=GUID=73ca325da4ca4c81a3d958d25a9cf80e&HASH=73ca&LV=202103&V=4&LU=1617122106125
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3aO97M%2fTrickBot.RT!MTB&threatid=2147762719&enterprise=1

Response headers

pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
x-activity-id: 2212afcb-aba5-49ce-8076-b8f434880b1e
ms-cv: acJROM7WnkWdGtxz.0
x-appversion: 1.0.7740.9825
x-az: {did:9a8cd53207774949b337f7edab013e9f, rid: 31, sn: storeexp-neu-prod, dt: 2021-03-25T10:13:12.0926244Z, bt: 2021-03-11T05:27:30.0000000Z}
ms-operation-id: 8c5192dfb3f03b438a9a6333d5520504
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-content-type-options: nosniff
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
x-xss-protection: 1; mode=block
content-length: 489
cache-control: max-age=29511
expires: Wed, 31 Mar 2021 00:46:57 GMT
date: Tue, 30 Mar 2021 16:35:06 GMT
vary: Accept-Encoding
tls_version: tls1.3
strict-transport-security: max-age=31536000
x-rtag: Str

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 193ms
48ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D73ca325da4ca4c81a3d958d25a9cf80e%26HASH%3D73ca%26LV%3D202103%26V%3D4%26LU%3D1617122106125%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 185ms
46ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D73ca325da4ca4c81a3d958d25a9cf80e%26HASH%3D73ca%26LV%3D202103%26V%3D4%26LU%3D1617122106125%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H2 200 MeControl_8fmFau_zfDGioPAajB3ICg2.js Show response
logincdn.msauth.net/16.000/content/js/ Frame 08DD 17 KB
6 KB 121ms
32ms Script
application/x-javascript 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://logincdn.msauth.net/16.000/content/js/MeControl_8fmFau_zfDGioPAajB3ICg2.js
Requested by: Host: login.live.com
URL: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=599a4d50-25de-410e-77fd-8f89f6e629bc&partnerId=mssecurityportal
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6C76) /
Resource Hash: dc4b052939ce6598013dbf112e45b91d25919dbc4da3755dcf17a436b9d8b145

Request headers

Origin: https://login.live.com
Referer: https://login.live.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 30 Mar 2021 16:35:06 GMT
content-encoding: gzip
content-md5: T9vZI/WScQuEhQvMQH7MOA==
age: 2024431
x-cache: HIT
content-length: 5985
x-ms-lease-status: unlocked
last-modified: Fri, 05 Mar 2021 08:26:24 GMT
server: ECAcc (mil/6C76)
etag: 0x8D8DFB05D278832
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: db7801ed-301e-0034-1419-13f450000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.microsoft.com/	1970-01-20 01:57:38	Name: MSFPC Value: GUID=73ca325da4ca4c81a3d958d25a9cf80e&HASH=73ca&LV=202103&V=4&LU=1617122106125
.microsoft.com/	1970-01-19 17:12:03	Name: MS0 Value: 9714dc7b8d0b4a7fa2e111f976850804
.microsoft.com/	1970-01-20 01:57:38	Name: MC1 Value: GUID=73ca325da4ca4c81a3d958d25a9cf80e&HASH=73ca&LV=202103&V=4&LU=1617122106125

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.onestore.ms
az725175.vo.msecnd.net
c.s-microsoft.com
go.microsoft.com
img-prod-cms-rt-microsoft-com.akamaized.net
login.live.com
logincdn.msauth.net
mem.gfx.ms
securityintelligencecenter-eastus.azurewebsites.net
statics-marketingsites-eus-ms-com.akamaized.net
statics-mwf-wcus-ms-com.akamaized.net
wcpstatic.microsoft.com
web.vortex.data.microsoft.com
www.microsoft.com
152.199.19.160
192.229.221.185
20.190.160.75
23.32.238.226
23.96.1.109
2620:1ec:46::19
2a02:26f0:64::210:6a70
2a02:26f0:6c00:281::2957
2a02:26f0:6c00:28b::356e
2a02:26f0:6c00:292::356e
2a02:26f0:6c00:29c::2c1a
2a02:26f0:6c00::210:ba1b
2a02:26f0:7100:2a5::37
40.77.226.250
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba
1046d9a67d0b1c6dbfa1debafd073d74e8a6f16fa20bdb4b71008d4484f880d3
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
16e6e27a9f4a796339c310a7eb93c36084a9ef6471f0abf7af515be97da323b8
1b90d623aded4efa4ac6470083fa721dee7d5619141175c7ca914d71a05da460
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
37c5214d97f0425f87d35cbf2b38808b13d473378c422509573ed4ef2b6d5a95
389dbd8a2c1c1f70a9774b3cc353b2424e21d455aa2988c28d9139444790c1a5
45ad5e774a5d9645fff24da7a9dba40d1ac6923519d07914be0cf215cc425e2f
4b5da91ccc0a5063f5096201b50587b3f8ec68ae799f13cef8571ba936f2ca39
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
5d597f619952c5c0413857824efe8c368707f3e67d68ae2044e4a5eb72b76d3d
61f1ba12ac808df1516908d10c91edac0dfe14dd28024593abd6d26c18624010
68d929a10c3cd609b936b50a541533994b044b38558a33530ff45d1b420cc07e
68eb1b68ce12ddf4e3aec1ce64cf031a94daf13a90df876eba94ca6ce36a28eb
7e9abff7ebb4effe42b7afde7bb35b7c0cfef2a9941d69650808500cbdd742fd
ab427284fbe1ae77c2895c78d9da9ebcfa5eb211173c7ef9be705c4dedbc413a
b40200ca67f4c31d0e8b8ce914c9d2786a506a1c29e1a9cdeb841d555a1e79ee
c047474df4c9824f23e7f41cf51babb803a65d09036aff8cfeb8bff308d8be87
c965f854e2429f283ac9ca2f8f7641b10e6f43f7ef1f0ad6482f1f7b6b5a21f6
cd9da940067dc9fb41e9963fa2ecc1714b1ce9d5f15d8aa33b25bfbda739904f
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
dc4b052939ce6598013dbf112e45b91d25919dbc4da3755dcf17a436b9d8b145
de7fd966c03714fd1dc6eb4b17edd524a7d4872933c5db46806dcb480c5598d9
dfa1c9a97a31f7a8dac645380ae147f39877389daf0663b15411a618b5f43cd4
e246eff2f6ae3e255a06eb561e6fc93ae3bef2cce22c5e0124d713c15f80567c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e46ec8fe0d90eda8729be2a1e6d56cd65da4ee9e4851ee49d02cd0b141b9a65d
eb2624abf95e3388ee3a51d149a07200e03196ece33d0ca6cc8549f70f8d4bd5
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b
f4d21dc6a3bc75e851bccd0b7faab2f09930184e3b112a6feba5cecb0c6c13c0
fdda94d6f04cee5097401cf9131ae9c2eb83f89f6f1def976799f161e862ee80
fe883d142e29e21a3308c3075cdd3f41587a4e061c1e0eac6d7b3a945cff50d9
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

www.microsoft.com Open in urlscan Pro 2a02:26f0:6c00:28b::356e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

38 Requests

100 %HTTPS

57 %IPv6

9 Domains

14 Subdomains

14 IPs

4 Countries

814 kBTransfer

2919 kBSize

3 Cookies

39 Outgoing links

Page URL History

Redirected requests

38 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.microsoft.com Open in urlscan Pro
2a02:26f0:6c00:28b::356e Public Scan

Screenshot
Live screenshot

Full Image

38
Requests

100 %
HTTPS

57 %
IPv6

9
Domains

14
Subdomains

14
IPs

4
Countries

814 kB
Transfer

2919 kB
Size

3
Cookies

38 HTTP transactions
1 data transactions