URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Submission Tags: falconsandbox
Submission: On August 07 via api from US

Summary

This website contacted 39 IPs in 6 countries across 29 domains to perform 107 HTTP transactions. The main IP is 104.111.231.15, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on July 15th 2021. Valid for: a year.
This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
20 104.111.231.15 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
11 104.109.77.38 16625 (AKAMAI-AS)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
6 104.75.88.126 16625 (AKAMAI-AS)
7 34.96.102.137 15169 (GOOGLE)
1 35.201.125.192 15169 (GOOGLE)
1 34.102.193.142 15169 (GOOGLE)
1 8 2600:9000:215... 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
1 35.190.5.192 15169 (GOOGLE)
1 2.18.235.40 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
2 104.111.234.67 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
2 142.250.184.226 15169 (GOOGLE)
1 104.17.70.206 13335 (CLOUDFLAR...)
1 1 167.172.136.187 14061 (DIGITALOC...)
1 2 208.68.39.149 14061 (DIGITALOC...)
1 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 34.95.105.148 15169 (GOOGLE)
1 3 142.250.186.70 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
1 13.224.100.124 16509 (AMAZON-02)
1 1 35.201.70.94 15169 (GOOGLE)
2 2 68.67.153.60 29990 (ASN-APPNEX)
3 3 185.33.220.145 29990 (ASN-APPNEX)
2 2600:9000:219... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 35.245.208.72 15169 (GOOGLE)
1 52.31.175.99 16509 (AMAZON-02)
2 161.35.15.77 14061 (DIGITALOC...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2.23.6.217 20940 (AKAMAI-ASN1)
1 1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a02:26f0:5c:... 20940 (AKAMAI-ASN1)
107 39
Apex Domain
Subdomains
Transfer
21 trendmicro.com
www.trendmicro.com
resources.trendmicro.com
422 KB
11 bc0a.com
cdn.bc0a.com
ixfd1-api.bc0a.com
marvel-b1-cdn.bc0a.com
marvel-processor.bc0a.com
146 KB
11 tiqcdn.com
tags.tiqcdn.com
44 KB
9 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com
r1.visualwebsiteoptimizer.com
175 KB
8 google-analytics.com
ssl.google-analytics.com
www.google-analytics.com
58 KB
6 doubleclick.net
5427711.fls.doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
3 KB
5 addthis.com
s7.addthis.com
api-public.addthis.com
191 KB
4 akamaihd.net
trial-eum-clientnsv4-s.akamaihd.net
lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net
1 KB
4 acsbapp.com
acsbapp.com
cdn.acsbapp.com
157 KB
4 gstatic.com
fonts.gstatic.com
57 KB
3 google.com
www.google.com
adservice.google.com
688 B
3 adnxs.com
secure.adnxs.com
3 KB
3 bing.com
bat.bing.com
9 KB
2 google.de
www.google.de
172 B
2 ml-api.io
attr.ml-api.io
485 B
2 ml-attr.com
s.ml-attr.com
566 B
2 adsrvr.org
js.adsrvr.org
insight.adsrvr.org
3 KB
2 googleadservices.com
www.googleadservices.com
15 KB
2 marketo.net
munchkin.marketo.net
6 KB
2 googletagmanager.com
www.googletagmanager.com
92 KB
2 b0e8.com
cdn.b0e8.com
a.b0e8.com
22 KB
2 youtube.com
www.youtube.com
43 KB
2 go-mpulse.net
s.go-mpulse.net
c.go-mpulse.net
51 KB
2 cludo.com
customer.cludo.com
51 KB
1 akstat.io
1737ad5b.akstat.io
204 B
1 acsbap.com
acsbap.com
85 B
1 addthisedge.com
v1.addthisedge.com
1 KB
1 moatads.com
z.moatads.com
1 KB
1 googleapis.com
fonts.googleapis.com
930 B
107 29
Domain Requested by
20 www.trendmicro.com www.trendmicro.com
11 tags.tiqcdn.com www.trendmicro.com
tags.tiqcdn.com
8 marvel-b1-cdn.bc0a.com 1 redirects www.trendmicro.com
7 dev.visualwebsiteoptimizer.com tags.tiqcdn.com
dev.visualwebsiteoptimizer.com
www.trendmicro.com
6 www.google-analytics.com tags.tiqcdn.com
www.google-analytics.com
s.go-mpulse.net
www.googletagmanager.com
4 fonts.gstatic.com fonts.googleapis.com
3 api-public.addthis.com s.go-mpulse.net
s7.addthis.com
3 secure.adnxs.com 3 redirects
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.trendmicro.com
3 5427711.fls.doubleclick.net 1 redirects www.googletagmanager.com
www.trendmicro.com
2 cdn.acsbapp.com acsbap.com
2 r1.visualwebsiteoptimizer.com s.go-mpulse.net
2 www.google.de www.trendmicro.com
2 www.google.com 1 redirects www.trendmicro.com
2 googleads.g.doubleclick.net 1 redirects www.googleadservices.com
2 attr.ml-api.io www.trendmicro.com
2 s.ml-attr.com 2 redirects
2 acsbapp.com 1 redirects www.trendmicro.com
2 www.googleadservices.com tags.tiqcdn.com
www.googleadservices.com
2 ssl.google-analytics.com tags.tiqcdn.com
www.trendmicro.com
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 www.googletagmanager.com tags.tiqcdn.com
2 s7.addthis.com www.trendmicro.com
s7.addthis.com
2 www.youtube.com www.trendmicro.com
www.youtube.com
2 customer.cludo.com www.trendmicro.com
1 1737ad5b.akstat.io s.go-mpulse.net
1 fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net
1 trial-eum-clienttons-s.akamaihd.net 1 redirects
1 lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net
1 trial-eum-clientnsv4-s.akamaihd.net 1 redirects
1 stats.g.doubleclick.net s.go-mpulse.net
1 insight.adsrvr.org js.adsrvr.org
1 adservice.google.com 5427711.fls.doubleclick.net
1 c.go-mpulse.net s.go-mpulse.net
1 marvel-processor.bc0a.com 1 redirects
1 js.adsrvr.org www.googletagmanager.com
1 a.b0e8.com www.trendmicro.com
1 acsbap.com 1 redirects
1 resources.trendmicro.com tags.tiqcdn.com
1 v1.addthisedge.com s7.addthis.com
1 z.moatads.com s7.addthis.com
1 cdn.b0e8.com www.trendmicro.com
1 ixfd1-api.bc0a.com cdn.bc0a.com
1 cdn.bc0a.com tags.tiqcdn.com
1 s.go-mpulse.net www.trendmicro.com
1 fonts.googleapis.com www.trendmicro.com
107 46
Subject Issuer Validity Valid
www.trendmicro.com
Entrust Certification Authority - L1M
2021-07-15 -
2022-08-13
a year crt.sh
upload.video.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.cludo.com
AlphaSSL CA - SHA256 - G2
2021-04-06 -
2022-05-08
a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2021-04-19 -
2022-04-27
a year crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2021-06-08 -
2022-06-13
a year crt.sh
*.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2021-04-25 -
2022-04-27
a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2
2020-06-19 -
2022-07-06
2 years crt.sh
cdn.bc0a.com
GTS CA 1D4
2021-06-30 -
2021-09-28
3 months crt.sh
ixfd-api.bc0a.com
GTS CA 1D4
2021-07-01 -
2021-09-29
3 months crt.sh
marvel-cdn.bc0a.com
Amazon
2021-03-10 -
2022-04-08
a year crt.sh
*.gstatic.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
cdn.b0e8.com
GTS CA 1D4
2021-06-27 -
2021-09-25
3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2021-01-21 -
2022-01-25
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2021-03-29 -
2022-04-06
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
resources.trendmicro.com
Cloudflare Inc ECC CA-3
2021-06-24 -
2022-06-23
a year crt.sh
*.acsbapp.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2020-10-05 -
2021-10-05
a year crt.sh
*.googleadservices.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
b0e8.com
GTS CA 1D4
2021-06-29 -
2021-09-27
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2021-07-06 -
2022-01-06
6 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2021-03-18 -
2022-04-19
a year crt.sh
*.ml-api.io
Amazon
2021-01-20 -
2022-02-17
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.google.de
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
www.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
www.google.de
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2020-07-15 -
2021-09-13
a year crt.sh

This page contains 4 frames:

Primary Page: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Frame ID: E50D5DBBF6FC09EA0EFE1A9310945A1B
Requests: 100 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Frame ID: AD44AFA8B6F418B3558C04CB5C5061D6
Requests: 4 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Frame ID: 332B540F058C591E1E11C45C5D41C40A
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&upid=803df29&upv=1.1.0
Frame ID: EFA62286A4A204680C17C808F4C27503
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/etc.clientlibs\//i

Overall confidence: 100%
Detected patterns
  • script /\/etc.clientlibs\//i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • script /munchkin\.marketo\.net\/munchkin\.js/i

Overall confidence: 100%
Detected patterns
  • script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i

Overall confidence: 100%
Detected patterns
  • script /dev\.visualwebsiteoptimizer\.com/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

107
Requests

98 %
HTTPS

49 %
IPv6

29
Domains

46
Subdomains

39
IPs

6
Countries

1549 kB
Transfer

5829 kB
Size

23
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64
  • https://acsbap.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/dist/js/app.js
Request Chain 76
  • https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html HTTP 302
  • https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Request Chain 80
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
Request Chain 83
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=4QUOYdeRFJSegQfptKDoAQ&sscte=1&crd= HTTP 302
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=4QUOYdeRFJSegQfptKDoAQ&cid=CAQSKQCNIrLM1Z5CCwC6ALrF_6NNHDWXXKAf8p4ZHELGQqwdR1geynHdvs13&random=1499066771&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=4QUOYdeRFJSegQfptKDoAQ&cid=CAQSKQCNIrLM1Z5CCwC6ALrF_6NNHDWXXKAf8p4ZHELGQqwdR1geynHdvs13&random=1499066771&resp=GooglemKTybQhCsO&ipr=y
Request Chain 95
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
Request Chain 101
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=puo2gxobv HTTP 302
  • https://lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net/eum/results.txt
Request Chain 102
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=puo2gxobv HTTP 302
  • https://fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net/eum/results.txt

107 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
www.trendmicro.com/en_us/research/20/b/
83 KB
16 KB
Document
General
Full URL
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
afd03396cfa6975864faa35da2d3b8def12704ace7264eb9d8e8882b8dff79f8
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:method
GET
:authority
www.trendmicro.com
:scheme
https
:path
/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server
nginx
content-type
text/html;charset=utf-8
x-prod-a-01
Yes
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1;mode=block
x-prod-n-01
Yes
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
content-encoding
gzip
content-length
15967
vary
Accept-Encoding
date
Sat, 07 Aug 2021 04:02:40 GMT
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
111 KB
38 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/jquery.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 04 May 2021 00:44:02 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Sat, 07 Aug 2021 04:02:40 GMT
x-prod-a-02
Yes
content-type
application/javascript;charset=utf-8
x-xss-protection
1;mode=block
vary
Accept-Encoding
content-length
38507
x-prod-n-02
Yes
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
10 KB
4 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/utils.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 21 Jun 2019 19:39:05 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Sat, 07 Aug 2021 04:02:40 GMT
x-prod-a-02
Yes
content-type
application/javascript;charset=utf-8
x-xss-protection
1;mode=block
vary
Accept-Encoding
content-length
3706
x-prod-n-02
Yes
css
fonts.googleapis.com/
10 KB
930 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c818151c60b68e169ca56407386064745a6c3734b02f669071385fd2d33df2c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 07 Aug 2021 03:14:16 GMT
server
ESF
date
Sat, 07 Aug 2021 04:02:40 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 07 Aug 2021 04:02:40 GMT
cludo-search.min.css
customer.cludo.com/css/296/1798/
16 KB
3 KB
Stylesheet
General
Full URL
https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 05 Aug 2021 13:55:46 GMT
server
cloudflare
age
77580
etag
W/"0ddc79618ad71:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
67ad9c5c6e9a18e5-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-lb
2
clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
260 KB
36 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b0cfa85c43af17ebe716def3e1956375423714d57e02ead5a4a3e5bc5283ea61
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 29 Jul 2021 17:10:17 GMT
server
nginx
date
Sat, 07 Aug 2021 04:02:40 GMT
x-frame-options
SAMEORIGIN
content-type
text/css;charset=utf-8
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
36967
x-xss-protection
1;mode=block
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c0fc4bbfbd6132a9d6b86ada7a9b9bd11f680f4cba3c004e5c04728ec4910aa4

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Fri, 06 Aug 2021 15:21:41 GMT
server
AkamaiNetStorage
etag
"53ce4a565a4e83bf793b1075bcefdb88:1628263301.619837"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
953
expires
Sat, 07 Aug 2021 04:07:40 GMT
logo-desktop.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/
0
0

search-script.js
customer.cludo.com/scripts/bundles/
253 KB
48 KB
Script
General
Full URL
https://customer.cludo.com/scripts/bundles/search-script.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::ac43:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73c975e8b47383bfc9220a1463ee6ecaead359a2e967587fde9c5ebec8548b94

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 04 Aug 2021 17:44:42 GMT
server
cloudflare
age
158
etag
W/"061a9675889d71:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
67ad9c5c9bc1dfe7-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-lb
4
TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
s.go-mpulse.net/boomerang/ Frame AD44
205 KB
49 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:2b9::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
br
last-modified
Fri, 23 Jul 2021 15:07:22 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
timing-allow-origin
*
content-length
50393
share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
648 B
913 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Sat, 07 Aug 2021 04:02:40 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=1276
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
648
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:23:56 GMT
printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
409 B
674 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Sat, 07 Aug 2021 04:02:40 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=1271
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
409
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:23:51 GMT
Fig1-.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
16 KB
16 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig1-.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
94a3438f1f3623e8987a691ad311f0e64c8750c56f5a6cd7ebf5ebb8960ce4fc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig1-.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Fri, 06 Aug 2021 23:32:39 GMT
server
nginx
etag
"3e9b-5c8ec7388280f"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1641
date
Sat, 07 Aug 2021 04:02:40 GMT
x-content-type-options
nosniff
accept-ranges
bytes
x-prod-n-01
Yes
content-length
16027
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:30:01 GMT
Fig2.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
64 KB
0
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig2.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig2.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Fri, 06 Aug 2021 23:32:39 GMT
server
nginx
etag
"13ced-5c8ec738881e9"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1640
date
Sat, 07 Aug 2021 04:02:40 GMT
x-content-type-options
nosniff
x-prod-n-02
Yes
accept-ranges
bytes
content-length
81133
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:30:00 GMT
Fig3.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
64 KB
0
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig3.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig3.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Fri, 06 Aug 2021 23:32:39 GMT
server
nginx
etag
"11f4f-5c8ec7387d21d"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1586
date
Sat, 07 Aug 2021 04:02:40 GMT
x-content-type-options
nosniff
accept-ranges
bytes
x-prod-n-01
Yes
content-length
73551
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:29:06 GMT
Fig4.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
64 KB
0
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig4.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig4.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Fri, 06 Aug 2021 23:32:39 GMT
server
nginx
etag
"1b7a8-5c8ec73883f7f"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1563
date
Sat, 07 Aug 2021 04:02:40 GMT
x-content-type-options
nosniff
x-prod-n-02
Yes
accept-ranges
bytes
content-length
112552
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:28:43 GMT
Fig5.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
64 KB
0
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig5.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig5.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
last-modified
Sat, 07 Aug 2021 04:00:37 GMT
server
nginx
x-prod-a-02
Yes
etag
W/"188e0-5c8f031d52682"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1677
date
Sat, 07 Aug 2021 04:02:40 GMT
accept-ranges
bytes
x-prod-n-01
Yes
content-length
100576
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:30:37 GMT
Fig6.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
59 KB
59 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig6.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e0b4c38bd2fb084adf862b493f95ff5d1200908c839fff6f738820c1d318bef4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig6.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Sat, 07 Aug 2021 00:19:49 GMT
server
nginx
etag
"eb4b-5c8ed1c2e7824"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1677
date
Sat, 07 Aug 2021 04:02:40 GMT
x-content-type-options
nosniff
x-prod-n-02
Yes
accept-ranges
bytes
content-length
60235
x-xss-protection
1;mode=block
expires
Sat, 07 Aug 2021 04:30:37 GMT
sly.min.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
18 KB
7 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/core-library/sly.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
content-length
7185
x-prod-n-02
Yes
x-prod-a-04
Yes
last-modified
Fri, 06 Aug 2021 22:35:57 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Sat, 07 Aug 2021 04:02:40 GMT
vary
Accept-Encoding
content-type
application/javascript
x-xss-protection
1;mode=block
cache-control
max-age=541
etag
"48de-5c8eba8b90181"
accept-ranges
bytes
expires
Sat, 07 Aug 2021 04:11:41 GMT
jwplayer.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
81 KB
26 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/content/dam/trendmicro/global/core-library/jwplayer.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
content-length
26353
x-prod-n-02
Yes
x-prod-a-02
Yes
last-modified
Fri, 06 Aug 2021 21:21:32 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Sat, 07 Aug 2021 04:02:40 GMT
vary
Accept-Encoding
content-type
application/javascript
x-xss-protection
1;mode=block
cache-control
max-age=1097
etag
"1457a-5c8ea9e9ee12d"
accept-ranges
bytes
expires
Sat, 07 Aug 2021 04:20:57 GMT
iframe_api
www.youtube.com/
980 B
1 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
33d28d9afb2e45cf17c816d20f4c9c786c0da2adddaaad3feed8da1689f772c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
server
ESF
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
accept-ch-lifetime
2592000
content-type
text/javascript; charset=utf-8
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, DPR
cache-control
private, max-age=0
permissions-policy
ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
expires
Sat, 07 Aug 2021 04:02:40 GMT
clientlib-trendresearch.min.js
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
390 KB
115 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b673977fcdb2807366efbf1eadd298f68320235eb7dffa5943420579cd7fb8a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 29 Jul 2021 17:10:17 GMT
server
nginx
date
Sat, 07 Aug 2021 04:02:40 GMT
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
117575
x-xss-protection
1;mode=block
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Sat, 07 Aug 2021 04:02:40 GMT
x-host
s7.addthis.com
content-length
116325
j.php
dev.visualwebsiteoptimizer.com/
7 KB
3 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&f=1&r=0.09841434950049233
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
e08cca412d6468bba3462805c5b6312fa60593aab57acf3bf4579f25c6e80ae4

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 07 Aug 2021 04:02:40 GMT
via
1.1 google
server
gfra1
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type
application/javascript; charset=UTF-8
autopilot_sdk.js
cdn.bc0a.com/autopilot/f00000000017219/
45 KB
16 KB
Script
General
Full URL
https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.125.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
d41399db4aaff4debebdea57ef41573593d7735c911e06e42391dff7cd00e667

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-goog-meta-marvel_enabled
true
content-encoding
gzip
age
3129
x-guploader-uploadid
ADPycdtWvPhS-sPkwKaORGwbklV8NF5IV9yUz9gO0pLhQlMcfpw9WIKd2Df9rHOJxc8p05lBbEOFbePex7H4bUuM4_cd9Hoxdw
x-goog-meta-sdk_canonical_host
x-goog-meta-sdk_whitelist
x-goog-stored-content-encoding
gzip
x-goog-meta-publishingdate
2021-06-16 17:49:51
x-goog-meta-sdk_canonical_protocol
etag
"28e246b2997b009c4e4f10163af66f2f"
vary
Accept-Encoding
x-goog-generation
1623865791647402
content-language
en
access-control-allow-origin
*
x-goog-meta-custom
true
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-meta-spa
false
expires
Sat, 07 Aug 2021 04:10:31 GMT
x-goog-meta-sdk_version
1.5.0
date
Sat, 07 Aug 2021 03:10:31 GMT
x-goog-meta-sdk_account_id
f00000000017219
x-goog-meta-sdk_request_parameters_case_sensitive
false
x-goog-meta-marvel_config_consistency_custom
{"data-customerid":"f00000000017219"}
x-goog-storage-class
MULTI_REGIONAL
x-goog-meta-marvel_customer_id
x-goog-metageneration
3
alt-svc
clear
content-length
15450
x-goog-meta-content_only
false
x-goog-meta-sdk_log_level
2
last-modified
Wed, 16 Jun 2021 17:49:51 GMT
server
UploadServer
x-goog-hash
crc32c=O/yXsQ==, md5=KOJGspl7AJxOTxAWOvZvLw==
x-goog-stored-content-length
15450
accept-ranges
bytes
content-type
application/javascript
x-goog-meta-marvel_test_mode
false
1621690854
ixfd1-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/
6 KB
1 KB
XHR
General
Full URL
https://ixfd1-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/1621690854?client=js_sdk&client_version=1.5.0&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36
Requested by
Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.193.142 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
142.193.102.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
4a3779d547c50c9bfe22c5d6f0d9075f0a3c2536a32554a87204112d2bd5841d

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-be-pop
BRU-1-302
date
Sat, 07 Aug 2021 04:02:34 GMT
content-encoding
br
server
bws/1.0
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
alt-svc
clear
via
1.1 google
utag.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
120 KB
27 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b6218e8cce38478995e5dc45a1a52d434582e1df6fb809b3024641db5ed6f0fd

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Fri, 06 Aug 2021 15:21:42 GMT
server
AkamaiNetStorage
etag
"9c69592e54dac1a1ec62cdff06b5e22c:1628263302.061474"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
27264
expires
Sat, 07 Aug 2021 04:07:40 GMT
logo-desktop.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/
5 KB
6 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7200:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
.uO9R1UDQbX.a.ec1EBzTChqhFVbU71g
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
etag
"52561d918e54912574b9ed5bb5993edb"
x-amz-request-id
2BCC8508664NHZ0M
x-cache
Hit from cloudfront
content-length
5310
x-amz-id-2
VNTVOdjKd7/qUa+PETWwfZIzPdQlhZh+ZC+HcgiN44Z31EL4cam49X7w5PrkTeDlUPN0YQr1Uxg=
last-modified
Wed, 14 Jul 2021 16:32:28 GMT
server
AmazonS3
date
Sat, 07 Aug 2021 02:23:51 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
-qzD8e5q6qEparuxh0Sy0R-KIK7QW6U5v6gyww9iDRhKX1gHMaanVQ==
icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/
24 KB
14 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5551a75c064d136e9a4c7362cc7df65b712451ed176532dcdf42dda4fd31814a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf
pragma
no-cache
origin
https://www.trendmicro.com
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 29 Jul 2021 17:10:17 GMT
server
nginx
date
Sat, 07 Aug 2021 04:02:40 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-ttf
cache-control
public, max-age=770
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
14192
x-xss-protection
1;mode=block
mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v22/
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v22/mem8YaGs126MiZpBA-UFVZ0b.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 16:03:30 GMT
x-content-type-options
nosniff
age
43150
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14440
x-xss-protection
0
last-modified
Fri, 06 Aug 2021 15:53:19 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Aug 2022 16:03:30 GMT
mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v22/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v22/mem5YaGs126MiZpBA-UNirkOUuhp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 16:03:30 GMT
x-content-type-options
nosniff
age
43150
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14956
x-xss-protection
0
last-modified
Fri, 06 Aug 2021 15:53:15 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Aug 2022 16:03:30 GMT
Fig1-.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
4 KB
5 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig1-.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7200:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f6713a015b8859d9f8bd2c9f25e388d8bec3086d501793ea957af0e723f5ef72

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:00:38 GMT
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
x-amz-request-id
PQ9ZJQMB6TS4WZTJ
x-cache
Hit from cloudfront
content-length
4402
x-amz-id-2
i83k2SlXZJQO8pWm6n42mieh/1gBVt9Osq+gMZpaeQbf3yAXwrFU5WzL9nnNkd9Sx5phJLwBqMg=
last-modified
Thu, 15 Jul 2021 20:39:46 GMT
server
AmazonS3
etag
"dd4c3484712259c8aa2380a9bdb1d930"
x-amz-version-id
fDTsiC5MxE3nOSXbveyNfcVI48oZ1wTl
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
image/webp
x-amz-cf-id
7ULpOBqtv1wFA8axufxM5eQ5IajiOhsqNcupo-Dc_hfZlnWHdvePfw==
Fig2.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
28 KB
28 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig2.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7200:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
16db8973c330e8561090b2ac69a0413b9c34bdaf1a396e0b163254d325219557

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:00:38 GMT
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
x-amz-request-id
PQ9YNF1TJSRCM1VS
x-cache
Hit from cloudfront
content-length
28226
x-amz-id-2
axAUScTUHJ/zYFYHl4YzjAcpTQNMRksMByNIvN6Fgee90ZLHG6d6NSz1Upn0zYHFLi2mypZa8uQ=
last-modified
Thu, 15 Jul 2021 20:39:47 GMT
server
AmazonS3
etag
"d17d49c2351894d46749220e43457148"
x-amz-version-id
vP2veCvZl9lDBvJ3eKcsXVtHuQJJAlYK
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
image/webp
x-amz-cf-id
lIg-PrBLGiWPDUjkw6lLK_mBpiOEVHN1pOgrg_SYyatTnuso4Klu3w==
Fig3.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
18 KB
18 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig3.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7200:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
739f7dd643f9348b0c5eba4a04a5fbd0eb75aea2b27626236233cd2b9141fd77

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:00:38 GMT
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
x-amz-request-id
PQ9X6032H1GBREN3
x-cache
Hit from cloudfront
content-length
17966
x-amz-id-2
dl+ot+5W5YD0i0m+xRcB/BD9JHPiCuI+945Xqwb7GvV+yXac3vcY6omp48KO6/5MyMO02/ef3rY=
last-modified
Thu, 15 Jul 2021 20:39:45 GMT
server
AmazonS3
etag
"7476b4e278e502753f158ee4306918ae"
x-amz-version-id
ouKBagmNgqRErywSPQrYskGb13SzIv.s
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
image/webp
x-amz-cf-id
AlVFmlWBTKCY6qlqZa96c4ADch7FLyEN6dSjH7zuIr_QCQhobG5eyQ==
Fig4.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
29 KB
30 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig4.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7200:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8884c8be84303ada213797a61542a5d3eb737f38acf0b0db399cb2fd5086fe2d

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:42 GMT
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
x-amz-request-id
6DSA4GZN08KFPCXD
x-cache
Miss from cloudfront
content-length
29664
x-amz-id-2
gcgO7kEIOIbEN0M/TNcFvPp1O8QNwMiJhpMlNXbKg292YQQ9lxtPOI9+vOlxS7tASMp062DGWrM=
last-modified
Thu, 15 Jul 2021 20:39:46 GMT
server
AmazonS3
etag
"f5ff0a4796b8478ad08242c283a56e97"
x-amz-version-id
I1Mc5Ff9CBJZwTYADH.C3hTqmO2SOeBQ
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
image/webp
x-amz-cf-id
bacDyC1CQWJI_QDAuRqWGacHpD0E3YzrvgOWwi3VTTqbVUcpK0AejA==
Fig5.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
25 KB
26 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig5.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7200:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5109aaebe7722e95d2109e29e8efd631e7d259105f0ec487a72ff2df55fb6497

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:00:38 GMT
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
x-amz-request-id
PQ9VGZ2RDDD06S1W
x-cache
Hit from cloudfront
content-length
25938
x-amz-id-2
bJ7039G1BPIZpge46uBj6cvSPVMLlfgyu+c4WAf05VIkUkasic6tWnML4wcOhl3d293iKqyvSUo=
last-modified
Thu, 15 Jul 2021 20:39:46 GMT
server
AmazonS3
etag
"cbaef5cc52cc579c553eebc6ad7cf1dd"
x-amz-version-id
DmvSJfYlpfwwH0B6YQMVVYco3qzSm8Rg
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
image/webp
x-amz-cf-id
uLua85C-aPoICQGbjOtfXTSa2kMiTibNs43J8oTZyX9ldIk5Y2xWDQ==
Fig6.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/
16 KB
16 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2020/02/Fig6.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7200:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d8212177aa1c438a763c952907b0705874975791064101bedfd2d5a7d787139a

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:00:38 GMT
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
x-amz-request-id
PQ9R51N5JAPQH5XF
x-cache
Hit from cloudfront
content-length
16196
x-amz-id-2
n5MFJfL5Ls6xAVjP1vYzT0UWR+w+eOk+Sucu7GyW5IR8Uks93xkGV92z7I/LXmmmCUB77VIR5/U=
last-modified
Thu, 15 Jul 2021 20:39:46 GMT
server
AmazonS3
etag
"4ca049914b00662f95a082ddd6933ea2"
x-amz-version-id
QQJ9worQK_.wzOPX3X4eSe1bCLqKcLtE
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
image/webp
x-amz-cf-id
s8ICVX7NuTg3k5cli3eM4zJ6WwxiLd7uKDadtwmSFoTTTCWAV23-3w==
conv_v3.js
cdn.b0e8.com/
67 KB
22 KB
Script
General
Full URL
https://cdn.b0e8.com/conv_v3.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.5.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.5.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
afdd29778a35ecf1638fc1c8bee1d4f7843d437d01b5db08cdf364da6b0edeaf

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:01:24 GMT
content-encoding
gzip
age
76
x-guploader-uploadid
ADPycdvZg_pgeoJVUI50lzNXdWGNrJky248qXUxNNPZKjENfSScMpPz-ZESLWm-ehySoqbSlKEM_ma2l3faZ9_xeoD3v5Eut_A
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
21570
last-modified
Fri, 07 Aug 2020 06:51:36 GMT
server
UploadServer
etag
"befb3eb28cd6dd99609966faf9c239e0"
vary
Accept-Encoding
x-goog-hash
crc32c=kqf0jw==, md5=vvs+sozW3ZlgmWb6+cI54A==
content-language
en
access-control-allow-origin
*
x-goog-generation
1596783096708452
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
21570
accept-ranges
bytes
content-type
application/javascript
expires
Sat, 07 Aug 2021 05:01:24 GMT
422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/
72 KB
72 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
pragma
no-cache
origin
https://www.trendmicro.com
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Sat, 07 Aug 2021 04:02:40 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
cache-control
public, max-age=664
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
73259
x-xss-protection
1;mode=block
mem5YaGs126MiZpBA-UN_r8OUuhp.woff2
fonts.gstatic.com/s/opensans/v22/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v22/mem5YaGs126MiZpBA-UN_r8OUuhp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9f7216d2f53a731d9749077c22e15cfb38bcdc40806511ccf736f440c7569d64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 16:03:30 GMT
x-content-type-options
nosniff
age
43150
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14992
x-xss-protection
0
last-modified
Fri, 06 Aug 2021 15:52:37 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Aug 2022 16:03:30 GMT
memnYaGs126MiZpBA-UFUKWyV9hrIqM.woff2
fonts.gstatic.com/s/opensans/v22/
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v22/memnYaGs126MiZpBA-UFUKWyV9hrIqM.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c9e72fed9f647684a0437f185bf4ed620de7b49f236453256716b639ac56f04
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 16:16:33 GMT
x-content-type-options
nosniff
age
42367
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13916
x-xss-protection
0
last-modified
Fri, 06 Aug 2021 15:52:40 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Aug 2022 16:16:33 GMT
www-widgetapi.js
www.youtube.com/s/player/be9c9f3b/www-widgetapi.vflset/
126 KB
42 KB
Script
General
Full URL
https://www.youtube.com/s/player/be9c9f3b/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b4522695aeea16458299e979a71eaa29dff35b74807467acb9ef34fc86f355d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 22:59:23 GMT
content-encoding
br
x-content-type-options
nosniff
age
18197
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42958
x-xss-protection
0
last-modified
Thu, 05 Aug 2021 00:19:06 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 06 Aug 2022 22:59:23 GMT
utag.69.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.42.202006041752
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e77bdb0ba7dd329aaa6c33250e5ce3cc287f47a04de1f6006ecf43202769df0d

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:03 GMT
server
AkamaiNetStorage
etag
"96165357acc3d7253ab0fc2f07c66ff9:1486318443"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1007
expires
Sun, 22 Aug 2021 04:02:40 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=40855
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
dict.en_us.json
www.trendmicro.com/libs/cq/i18n/
13 KB
14 KB
XHR
General
Full URL
https://www.trendmicro.com/libs/cq/i18n/dict.en_us.json
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/libs/cq/i18n/dict.en_us.json
pragma
no-cache
cookie
utag_main=v_id:017b1ec6f692000a53754549650700072007d06a00b08$_sn:1$_ss:1$_st:1628310760914$ses_id:1628308960914%3Bexp-session$_pn:1%3Bexp-session; _c1Ref=/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
empty
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
server
nginx
etag
"def5866d2a6bd1b5e1123ce5b1a6217e"
x-frame-options
SAMEORIGIN
content-type
application/json;charset=utf-8
cache-control
public, max-age=1
date
Sat, 07 Aug 2021 04:02:40 GMT
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
13552
x-xss-protection
1;mode=block
lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.disruptor.html
www.trendmicro.com/en_us/research/20/b/
0
418 B
XHR
General
Full URL
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.disruptor.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
x-requested-with
XMLHttpRequest
sec-fetch-dest
empty
cookie
utag_main=v_id:017b1ec6f692000a53754549650700072007d06a00b08$_sn:1$_ss:1$_st:1628310760914$ses_id:1628308960914%3Bexp-session$_pn:1%3Bexp-session; _c1Ref=/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:path
/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.disruptor.html
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html, */*; q=0.01
cache-control
no-cache
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
x-content-type-options
nosniff
server
nginx
x-prod-a-02
Yes
date
Sat, 07 Aug 2021 04:02:41 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
x-prod-n-01
Yes
x-xss-protection
1;mode=block
lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.notifications.html
www.trendmicro.com/en_us/research/20/b/
715 B
856 B
XHR
General
Full URL
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.notifications.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.231.15 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-231-15.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
64828cb71ab5d401d3907b88b2da383ce376e22271a691afbcfff11651ea70bf
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
x-requested-with
XMLHttpRequest
sec-fetch-dest
empty
cookie
utag_main=v_id:017b1ec6f692000a53754549650700072007d06a00b08$_sn:1$_ss:1$_st:1628310760914$ses_id:1628308960914%3Bexp-session$_pn:1%3Bexp-session; _c1Ref=/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:path
/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.notifications.html
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html, */*; q=0.01
cache-control
no-cache
:authority
www.trendmicro.com
referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
date
Sat, 07 Aug 2021 04:02:41 GMT
x-prod-n-01
Yes
x-frame-options
SAMEORIGIN
content-type
text/html;charset=utf-8
vary
Accept-Encoding
content-length
404
x-xss-protection
1;mode=block
x-prod-a-04
Yes
utag.138.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.138.js?utv=ut4.42.202010201643
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
7d84c6695ba2aafd203a7ca7b9d443ea1b09db97e4c6cfd15e985ce9e6aef7f6

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Tue, 20 Oct 2020 16:43:45 GMT
server
AkamaiNetStorage
etag
"6b9877101e245c4432759617c7353f98:1603212225.37801"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1006
expires
Sun, 22 Aug 2021 04:02:40 GMT
utag.81.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
24 KB
6 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.42.202106161605
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a5279c6531a32a985181ed015e1a27a078018296ec37ebcf5651a6f5e1885b97

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Wed, 16 Jun 2021 16:05:37 GMT
server
AkamaiNetStorage
etag
"3283f9e55383c0b5794cf6a5b7335dcb:1623859537.598502"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
5882
expires
Sun, 22 Aug 2021 04:02:40 GMT
utag.29.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:02 GMT
server
AkamaiNetStorage
etag
"7b0575b394704ec7f76bef0f68cfc059:1486318442"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1706
expires
Sun, 22 Aug 2021 04:02:40 GMT
utag.18.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.42.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:01 GMT
server
AkamaiNetStorage
etag
"15598bba639efba2403d00ec82947e93:1486318441"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1024
expires
Sun, 22 Aug 2021 04:02:40 GMT
utag.9.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.42.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
540c6406140b9c4e6e32aa84fbab230a5c756456d9563903c0856eea77b68b60

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Tue, 07 Jul 2020 20:29:43 GMT
server
AkamaiNetStorage
etag
"9751bf6877a19200475422195b7c3174:1594153783.485339"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1390
expires
Sun, 22 Aug 2021 04:02:40 GMT
utag.75.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.42.201608171750
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:03 GMT
server
AkamaiNetStorage
etag
"afbbd577745f63042227302506a07e1a:1486318443"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1454
expires
Sun, 22 Aug 2021 04:02:40 GMT
utag.124.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.124.js?utv=ut4.42.202009171637
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
596d9525c639fc53fbc787d74c10127fce8f011a0d056d3e9f1cd0a795030261

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 17:52:13 GMT
server
AkamaiNetStorage
etag
"9d323f92c46f9880077c1b57db99e5f7:1591293133.081481"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1216
expires
Sun, 22 Aug 2021 04:02:40 GMT
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/
5 KB
1 KB
Script
General
Full URL
https://v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
gzip
etag
1901189993--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=60, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
1129
tag-7103f502cc16305418acc51edde63268.js
dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/
159 KB
45 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-7103f502cc16305418acc51edde63268.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&f=1&r=0.09841434950049233
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
543124399f956d9d15fb786ad84ab2860cbc640e1be3329ad1cfb24d2eb391c9

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
br
last-modified
Fri, 06 Aug 2021 11:52:54 GMT
server
gfra1
etag
"610d2296-b43d"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46141
via
1.1 google
tag-a425029213f5b486443374ca21087e92.js
dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/
90 KB
23 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/tag-a425029213f5b486443374ca21087e92.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&f=1&r=0.09841434950049233
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
14f87fb2dffc1b6940ced0923f3c39199a669e8a9ea7d65363b92137c6b0fc70

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
br
last-modified
Fri, 06 Aug 2021 11:52:54 GMT
server
gfra1
etag
"610d2296-5c13"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23571
via
1.1 google
v.gif
dev.visualwebsiteoptimizer.com/
35 B
52 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=215154&d=trendmicro.com&u=D6D4A5FD943F8CBF55575D89A41B90987&h=d42e1f95704cc88b29856f48013e79fb&t=false&r=0.9030098645030984
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv1c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv1c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
gtm.js
www.googletagmanager.com/
255 KB
53 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e0d0fce2404734cc7dcd0cf20880c64f65d2d76ab5743d16b590d5d31ec17968
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54471
x-xss-protection
0
last-modified
Sat, 07 Aug 2021 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 07 Aug 2021 04:02:41 GMT
gtm.js
www.googletagmanager.com/
99 KB
39 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8a9e2cac18485539cfc4c9603e6e4cc48d1071918734923b5a59d0b48c5c0451
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39716
x-xss-protection
0
last-modified
Sat, 07 Aug 2021 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 07 Aug 2021 04:02:41 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 07 Aug 2021 04:02:41 GMT
Content-Encoding
gzip
Last-Modified
Fri, 28 May 2021 01:40:41 GMT
Server
AkamaiNetStorage
ETag
"5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
4186
date
Sat, 07 Aug 2021 02:52:55 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Sat, 07 Aug 2021 04:52:55 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
2940
date
Sat, 07 Aug 2021 03:13:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19672
expires
Sat, 07 Aug 2021 05:13:41 GMT
conversion_async.js
www.googleadservices.com/pagead/
36 KB
14 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.42.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13910
x-xss-protection
0
server
cafe
etag
8154934153164151798
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sat, 07 Aug 2021 04:02:41 GMT
revenuepulse-lib-v3.js
resources.trendmicro.com/rs/945-CXD-062/images/
2 KB
1 KB
Script
General
Full URL
https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
last-modified
Sat, 26 Jun 2021 02:22:09 GMT
server
cloudflare
etag
"34229b-6f3-5c5a1ec585c8d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
67ad9c5f3c0308ab-CDG
content-length
695
expires
Sat, 07 Aug 2021 04:03:41 GMT
app.js
acsbapp.com/apps/app/dist/js/
Redirect Chain
  • https://acsbap.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/dist/js/app.js
415 KB
137 KB
Script
General
Full URL
https://acsbapp.com/apps/app/dist/js/app.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
208.68.39.149 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
cdn100.acsbapp.com
Software
/
Resource Hash
caa027c143dd7aa7a836c2796c8cc507fe730e1069fdab2edbd431b7f9b46e11

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
br
last-modified
Tue, 03 Aug 2021 11:35:18 GMT
etag
"67cee-610929f6-ddef53256cfbca9b;br"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
139579
expires
Sun, 08 Aug 2021 04:02:41 GMT

Redirect headers

location
https://acsbapp.com/apps/app/dist/js/app.js
date
Sat, 07 Aug 2021 04:02:41 GMT
content-length
707
content-type
text/html
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
202 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202108061521&cb=1628308961105
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-77-38.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Sat, 07 Aug 2021 04:12:41 GMT
settings.js
dev.visualwebsiteoptimizer.com/
1 MB
90 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/settings.js?a=215154&settings_type=1&vn=7.0&r=0.5552451078452687&exc=69|95
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-7103f502cc16305418acc51edde63268.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
330909ff5e49857df55a2dc12b35e2d629bfd7e286047277aca521b04477e359

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
via
1.1 google
server
gfra1
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type
application/javascript; charset=UTF-8
__utm.gif
ssl.google-analytics.com/r/
35 B
54 B
Image
General
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=824969193&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=LokiBot%20Impersonates%20Popular%20Game%20Launcher&utmhid=725063667&utmr=-&utmp=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&utmht=1628308961260&utmac=UA-29051577-12&utmcc=__utma%3D44797537.1582688439.1628308961.1628308961.1628308961.1%3B%2B__utmz%3D44797537.1628308961.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1858453539&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 03:54:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
472
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1306
x-xss-protection
0
expires
Sat, 07 Aug 2021 04:54:49 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
882 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 03:38:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
1479
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Sat, 07 Aug 2021 04:38:02 GMT
munchkin.js
munchkin.marketo.net/160/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/160/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 07 Aug 2021 04:02:41 GMT
Content-Encoding
gzip
Last-Modified
Fri, 19 Feb 2021 02:54:38 GMT
Server
AkamaiNetStorage
ETag
"19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4811
Expires
Mon, 15 Nov 2021 04:02:41 GMT
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/
263 KB
76 KB
Script
General
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Sat, 07 Aug 2021 04:02:41 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77617
/
www.googleadservices.com/pagead/conversion/1015287688/
2 KB
1 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/1015287688/?random=1628308961300&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
2fdc4337649e4f93be7994b8f90c6b5c6432e27022ba5b39bb238633fcd459c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1186
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
brightedge3.php
a.b0e8.com/
35 B
194 B
Image
General
Full URL
https://a.b0e8.com/brightedge3.php?id=f00000000017219&p_id=P8PR4J2AP284R8JJ8ANJR8LRAAAAAAAAAH&bf=aac6be469faa34d034400f3633921376&url=https%3A//www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&ref=&bn=1&bv=3.43&title=LokiBot%20Impersonates%20Popular%20Game%20Launcher&metadesc=We%20discovered%20a%20LokiBot%20variant%20impersonating%20a%20popular%20game%20launcher%20to%20trick%20users%20into%20executing%20it%20on%20their%20machines.%20Further%20analysis%20revealed%20it%20employs%20a%20quirky%2C%20installation%20routine%20that%20involves%20dropping%20a%20compiled%20C%23%20code%20file.&metakeywords=malware%2Cendpoints%2Cresearch&s_id=P8PR4J2AP284R6262J2JR8LRAAAAAAAAAH
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.105.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
148.105.95.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-be-pop
BRU-1-301
date
Sat, 07 Aug 2021 04:02:38 GMT
via
1.1 google
last-modified
Wed, 23 Jun 2021 22:46:15 GMT
server
bws/1.0
etag
"60d3b9b7-23"
content-type
image/gif
access-control-allow-origin
*
accept-ranges
bytes
alt-svc
clear
content-length
35
worker-70faafffa0475802f5ee03ca5ff74179.js
dev.visualwebsiteoptimizer.com/analysis/
47 KB
13 KB
XHR
General
Full URL
https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-7103f502cc16305418acc51edde63268.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
br
last-modified
Fri, 06 Aug 2021 11:52:53 GMT
server
gfra1
etag
"610d2295-351f"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13599
via
1.1 google
s.gif
dev.visualwebsiteoptimizer.com/
35 B
52 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/s.gif?account_id=215154&u=D6D4A5FD943F8CBF55575D89A41B90987&s=1628308960&p=1&ed=%7B%22tO%22%3A%22-2%22%2C%22lt%22%3A%221628308961348%22%2C%22r%22%3A%22%22%2C%22ul%22%3A%22en-us%22%2C%22de%22%3A%22UTF-8%22%2C%22sc%22%3A%2224%22%2C%22sr%22%3A%221600x1200%22%7D&cu=https%253A%252F%252Fwww.trendmicro.com%252Fen_us%252Fresearch%252F20%252Fb%252Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&r=0&cq=1&vn=7.0.152&vns=undefined&vno=4.0.78&eTime=1628308960348&random=0.11080394488617462
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv1c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv1c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates...
5427711.fls.doubleclick.net/ Frame 332B
Redirect Chain
  • https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonat...
  • https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Frese...
624 B
439 B
Document
General
Full URL
https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.70 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f6.1e100.net
Software
cafe /
Resource Hash
0ce9302a68e5b2d74b828eb71342ee6103d26030f98295e9ceaeea3fb2970188
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
5427711.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trendmicro.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Sat, 07 Aug 2021 04:02:41 GMT
expires
Sat, 07 Aug 2021 04:02:41 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
414
x-xss-protection
0
set-cookie
IDE=AHWqTUltv9OHCFxxCQ3j61rqbezShbkp3teQP6ZRXSoCNw0wP30-teGLXitR1Nhkc40; expires=Thu, 01-Sep-2022 04:02:41 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Sat, 07 Aug 2021 04:02:41 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bat.js
bat.bing.com/
30 KB
9 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:40 GMT
content-encoding
gzip
last-modified
Wed, 28 Jul 2021 18:27:37 GMT
x-msedge-ref
Ref A: 59C9CD65C62446B0B0E586FB401B4E46 Ref B: FRAEDGE1516 Ref C: 2021-08-07T04:02:41Z
etag
"80f2963dde83d71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
9024
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
2 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.224.100.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-100-124.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 07 Aug 2021 03:41:11 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
Age
1291
ETag
W/"98d98b3499058b76d58073cf8ede2f10"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 c07945b00aad28e34fbfebb3d3907061.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
ZRH50-C1
X-Amz-Cf-Id
odxREINuE82kdwwu1NdkmUBXnAU29K6_NJbhgVw65Uvi9Oc0KIe6oA==
activityi;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-gam...
5427711.fls.doubleclick.net/
0
0
Image
General
Full URL
https://5427711.fls.doubleclick.net/activityi;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html?
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.70 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
attr.ml-api.io/
Redirect Chain
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
0
242 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2190:600:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:42 GMT
via
1.1 0c476b4e93e7b13a5f68b185a8e9753c.cloudfront.net (CloudFront)
apigw-requestid
DrXbbjyJIAMEJWA=
x-amz-cf-pop
ZRH50-C1
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
KwrvQilCOc_vVialfk_nSYeP2D4-_kaPrjeL0p-OsbqKnmQuSakv8Q==

Redirect headers

Pragma
no-cache
Date
Sat, 07 Aug 2021 04:02:42 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 623.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
435f2d84-b5f5-4b2a-b39d-5b5076bdd5cd
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j92&a=725063667&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&ul=en-us&de=UTF-8&dt=LokiBot%20Impersonates%20Popular%20Game%20Launcher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=44797537.1582688439.1628308961.1628308961.1628308961.1&_utmz=44797537.1628308961.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1628308961383&_u=aSBCCAIrBAAAAC~&cid=1582688439.1628308961&tid=UA-44592531-1&_gid=822017128.1628308961&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&cd2=Augusto%20Remillano%20II%7CThreats%20Analyst%2CMohammed%20Malubay%7CThreats%20Analyst%2CArvin%20Roi%20Macaraeg%7CThreats%20Analyst&cd3=2020-02-14&z=308797413
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1628308961387&cv=9&fst=1628308961387&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg840&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a93ab7c213aa1e9a7a950bae7e7ba11a740ce4d8775bf2891569771132e15257
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1074
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQ...
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=160...
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600...
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=4QUOYdeRFJSegQfptKDoAQ&cid=CAQSKQCNIrLM1Z5CCwC6ALrF_6NNHDWXXKAf8p4ZHELGQqwdR1geynHdvs13&random=1499066771&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/gif
location
https://www.google.de/pagead/1p-conversion/1015287688/?random=55193839&cv=9&fst=1628308961300&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=4QUOYdeRFJSegQfptKDoAQ&cid=CAQSKQCNIrLM1Z5CCwC6ALrF_6NNHDWXXKAf8p4ZHELGQqwdR1geynHdvs13&random=1499066771&resp=GooglemKTybQhCsO&ipr=y
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/929919117/
42 B
149 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/929919117/?random=1628308961387&cv=9&fst=1628308800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg840&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&async=1&fmt=3&is_vtc=1&random=2531458206&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/929919117/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/929919117/?random=1628308961387&cv=9&fst=1628308800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg840&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&tiba=LokiBot%20Impersonates%20Popular%20Game%20Launcher&async=1&fmt=3&is_vtc=1&random=2531458206&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
26044208.js
bat.bing.com/p/action/
0
110 B
Script
General
Full URL
https://bat.bing.com/p/action/26044208.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 07 Aug 2021 04:02:41 GMT
cache-control
private,max-age=86400
x-msedge-ref
Ref A: 9609D0B1F9CC4B33BFA9DCDA29FFA21F Ref B: FRAEDGE1516 Ref C: 2021-08-07T04:02:41Z
x-powered-by
ARR/3.0
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/
0
117 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=26044208&tm=gtm001&Ver=2&mid=2304439c-4d97-48a1-b52b-aba2546928ee&sid=4fd2f170f73411ebb2c6397f3c0cc30b&vid=4fd2e800f73411ebbc4e0357c985db42&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=LokiBot%20Impersonates%20Popular%20Game%20Launcher&kw=malware,endpoints,research&p=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&r=&lt=416&evt=pageLoad&msclkid=N&sv=1&rn=861560
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 137A9F1B78374970A9EB56D288993E68 Ref B: FRAEDGE1516 Ref C: 2021-08-07T04:02:41Z
x-cache
CONFIG_NOCACHE
expires
Fri, 01 Jan 1990 00:00:00 GMT
config.json
c.go-mpulse.net/api/ Frame AD44
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=TU3LW-WPX5W-YK52N-GNWRK-Z5B9X&d=www.trendmicro.com&t=5427697&v=1.720.0&if=&sl=0&si=70cd71ef-026d-4160-8646-98207a5c19b4-qxgb8h&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:1b8::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
71261ff0e58b69367001e4c6ae087b0f49bfd6ccef1716cded622d58911ac7a3

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 07 Aug 2021 04:02:41 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
1007
dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=*;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-dro...
adservice.google.com/ddm/fls/z/ Frame 332B
42 B
515 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=*;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Requested by
Host: 5427711.fls.doubleclick.net
URL: https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPb6smDnvICFRqD3godWs8LzA;src=5427711;type=remar0;cat=allsi0;ord=1;num=8242011842437;gtm=2wg840;auiddc=1719822905.1628308961;u1=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://5427711.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcd2a3ad-08d6-46c1-b1de-69d933bb84d2
https://www.trendmicro.com/
47 KB
0
Other
General
Full URL
blob:https://www.trendmicro.com/dcd2a3ad-08d6-46c1-b1de-69d933bb84d2
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
47679
Content-Type
text/javascript
shares-post.json
api-public.addthis.com/url/serviceapi/
2 B
328 B
XHR
General
Full URL
https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
text/plain

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
surrogate-key
sFbt=https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
last-modified
Sat, 07 Aug 2021 04:00:00 GMT
server
nginx/1.15.8
date
Sat, 07 Aug 2021 04:02:42 GMT
content-type
application/json
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials
true
content-length
2
shares.json
api-public.addthis.com/url/
33 B
353 B
Script
General
Full URL
https://api-public.addthis.com/url/shares.json?url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&callback=_ate.cbs.rcb_72xp0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
91d064593cb7008809034b1a246c484a1f2a70085b3a920f1fc234944a3fca6c
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
last-modified
Sat, 07 Aug 2021 04:02:42 GMT
server
nginx/1.15.8
date
Sat, 07 Aug 2021 04:02:42 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
shares.json
api-public.addthis.com/url/
33 B
353 B
Script
General
Full URL
https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&callback=_ate.cbs.rcb_hyvw0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
0eed5d612288b39fd0f5133b93d09d4d2d51c572606ac09d231c32ae0b6e7559
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
last-modified
Sat, 07 Aug 2021 04:02:42 GMT
server
nginx/1.15.8
date
Sat, 07 Aug 2021 04:02:42 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
analyze
r1.visualwebsiteoptimizer.com/
0
143 B
XHR
General
Full URL
https://r1.visualwebsiteoptimizer.com/analyze?_a=215154&_u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.245.208.72 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
72.208.245.35.bc.googleusercontent.com
Software
r1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundary9lqgOV33tI0vo03p

Response headers

access-control-allow-origin
*
date
Sat, 07 Aug 2021 04:02:41 GMT
content-encoding
gzip
server
r1
content-type
application/javascript; charset=UTF-8
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
0
243 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2190:600:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:43 GMT
via
1.1 0c476b4e93e7b13a5f68b185a8e9753c.cloudfront.net (CloudFront)
apigw-requestid
DrXbhgQPIAMEJiA=
x-amz-cf-pop
ZRH50-C1
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
iaWMsNNIvDqYhvU8DSZovIusXtAk0LraQ6vZL69qlr53twvyxHTr7Q==

Redirect headers

Pragma
no-cache
Date
Sat, 07 Aug 2021 04:02:42 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 623.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
3d3d2134-8a9b-4118-b4ef-1dabc886a781
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4995170409891746187
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
up
insight.adsrvr.org/track/ Frame EFA6
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&upid=803df29&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.175.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-175-99.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
insight.adsrvr.org
:scheme
https
:path
/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&upid=803df29&upv=1.1.0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trendmicro.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.trendmicro.com/

Response headers

date
Sat, 07 Aug 2021 04:02:43 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
config.json
cdn.acsbapp.com/cache/app/trendmicro.com/
136 B
322 B
Fetch
General
Full URL
https://cdn.acsbapp.com/cache/app/trendmicro.com/config.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
161.35.15.77 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
cdn101.acsbapp.com
Software
/
Resource Hash
41b62bfcf93cf26d4206bf677c2a0ca5984f8b859a082824a8688d1774e3ece1

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:43 GMT
last-modified
Sat, 07 Aug 2021 00:14:04 GMT
etag
"88-610dd04c-8ad415edcd2ec6a0;;;"
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
136
expires
Sun, 08 Aug 2021 04:02:43 GMT
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j92&a=725063667&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&ul=en-us&de=UTF-8&dt=LokiBot%20Impersonates%20Popular%20Game%20Launcher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html&el=10%25%20Scroll&ev=0&_utma=44797537.1582688439.1628308961.1628308961.1628308961.1&_utmz=44797537.1628308961.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1628308963286&_u=aSDCCEIrBAAAAC~&jid=295825799&gjid=2128622087&cid=1582688439.1628308961&tid=UA-15678759-2&_gid=822017128.1628308961&_r=1&gtm=2wg840MT6DHL8&z=1641725913
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:43 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
2942
date
Sat, 07 Aug 2021 03:13:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19672
expires
Sat, 07 Aug 2021 05:13:41 GMT
collect
stats.g.doubleclick.net/j/
1 B
87 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-15678759-2&cid=1582688439.1628308961&jid=295825799&gjid=2128622087&_gid=822017128.1628308961&_u=aSDCCEIrBAAAAC~&z=2104876533
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 07 Aug 2021 04:02:43 GMT
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
results.txt
lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net/eum/ Frame AD44
Redirect Chain
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=puo2gxobv
  • https://lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net/eum/results.txt
8 B
312 B
XHR
General
Full URL
https://lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2.23.6.217 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-23-6-217.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 07 Aug 2021 04:02:43 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
AkamaiNetStorage
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8

Redirect headers

Location
https://lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net/eum/results.txt
Date
Sat, 07 Aug 2021 04:02:43 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0
results.txt
fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net/eum/ Frame AD44
Redirect Chain
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=puo2gxobv
  • https://fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net/eum/results.txt
8 B
312 B
XHR
General
Full URL
https://fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:26f0:5c::173e:259 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 07 Aug 2021 04:02:43 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
AkamaiNetStorage
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8

Redirect headers

Location
https://fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net/eum/results.txt
Date
Sat, 07 Aug 2021 04:02:43 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0
en.build.json
cdn.acsbapp.com/cache/app/
202 KB
20 KB
Fetch
General
Full URL
https://cdn.acsbapp.com/cache/app/en.build.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
161.35.15.77 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
cdn101.acsbapp.com
Software
/
Resource Hash
9fedf1ba6d44ff9123283b78c4f3a1d8253da41f6075085909de9cd9530cbdd5

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 07 Aug 2021 04:02:43 GMT
content-encoding
br
last-modified
Tue, 03 Aug 2021 11:39:03 GMT
etag
"32667-61092ad7-baf236b37bca042a;br"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
20141
expires
Sun, 08 Aug 2021 04:02:43 GMT
/
1737ad5b.akstat.io/
0
204 B
Ping
General
Full URL
https://1737ad5b.akstat.io/
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:2b9::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Sat, 07 Aug 2021 04:02:43 GMT
content-type
image/gif
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
expires
Sat, 07 Aug 2021 04:02:43 GMT
analyze
r1.visualwebsiteoptimizer.com/
0
142 B
XHR
General
Full URL
https://r1.visualwebsiteoptimizer.com/analyze?_a=215154&_u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F20%2Fb%2Flokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.245.208.72 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
72.208.245.35.bc.googleusercontent.com
Software
r1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryTgA44YOSFVr0zqhe

Response headers

access-control-allow-origin
*
date
Sat, 07 Aug 2021 04:02:47 GMT
content-encoding
gzip
server
r1
content-type
application/javascript; charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png

Verdicts & Comments Add Verdict or Comment

293 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| BOOMR number| BOOMR_lstart function| $ function| jQuery object| matched object| browser object| Granite object| maxy_pathnames number| settings_timer number| _vwo_settings_timer object| _vwo_code object| BOOMR_mq object| BEJSSDKObserver function| jsElementReady object| BEJSSDK object| BEIXF object| utag_data object| base64 function| Cludo object| CludoSearch string| cludo_language function| Sly function| webpackJsonpjwplayer function| jwplayer object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady function| id function| hasClass function| addClass function| removeClass function| closest function| debounce function| getStringDifference function| dropDecimal function| getPriceWithCommas function| allArrayElementsEqual function| isMobileDevice function| isLandscapeMode function| isIE function| isIE10orOlder function| superscriptSpecialSymbols function| matchSectionHeights object| TrendResearch object| articleFolioObject object| disruptorPanel object| folioMessage number| globalBodyScroll function| toggleFilterListNav function| hideSearchBar function| setFocus object| searchButton object| utilityAlerts object| filterListObject object| accordion function| getCheckedCheckboxesFor function| bindDocumentClickEvent function| matchJWHeight object| overview function| jumpScroll object| promotionalContent object| savedArticles object| alertsCookie function| isArticleComponentEmpty object| favoritedArticlesCookie function| Hammer function| Sifter object| MicroPlugin function| Selectize function| UAParser object| Handlebars object| researchUtilityMenu object| bsModal object| utag_err boolean| utag_condload string| pathString object| path undefined| anchorsArr undefined| anchor undefined| href number| len undefined| linkName object| mileStones object| ytapi object| scriptref undefined| playerCheckInterval object| utag object| _gaq object| pageTracker function| setMileStones function| _tealium_old_error boolean| __tealium_twc_switch object| teal object| utag_cfg_ovrd undefined| iframe_container string| iframe_url object| players function| onYouTubeIframeAPIReady object| start function| onPlayerReady function| onPlayerStateChange function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| CludoSearchInstances object| $navSticky object| addthis_share object| addthis_config number| _vwo_acc_id object| vwoCode object| _vwo_style string| _vwo_css string| _vwo_cookieDomain string| _vwo_uuid number| _vwo_library_timer string| _vis_opt_file string| _vis_opt_lib undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| VWO object| vwo_iehack_queue object| _vwo_exp_ids object| _vwo_exp object| _vwo_pa string| _vwo_worker_cb number| _vwo_clicks function| initializeFPJSLibrary function| detectIE object| _bright3 function| beLinkBlockCallback boolean| ie_version undefined| style undefined| select object| scriptTag string| org_id object| betrack object| showLogs string| domain object| domainPath object| timeout string| sessionTmeout boolean| bf_e_org object| bf_e_org_list number| bf_i object| bf object| goal object| goalvalue number| maximum_custom_variables number| maximum_custom_metrics object| customdimension_value object| custommetric_value number| maximum_conversions object| conversion_count_value object| conversion_value_value boolean| disableTrack object| deferCallback object| useCustomLinkBlockStyles object| showLinkBlock object| JSON3 function| isSameSiteNoneCompatible function| shouldSendSameSiteNone number| c_begin function| Fingerprint2 object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| dataLayer string| GoogleAnalyticsObject function| ga boolean| __@@##MUH function| vwo_$ string| _vwo_server_url object| _vis_opt_queue object| _vis_opt_check_segment object| _vwo_evq function| _vwo_ev boolean| DISABLE_NATIVE_CONSTANTS object| _vwo_t object| _vwo_editorOperationTracker function| _vwo_handleMutations object| _vwo_api_section_callback object| _vis_opt_comb_name function| _vwo_s object| _vwo_campaignData function| _vis_opt_top_initialize function| _vis_opt_bottom_initialize function| _vis_opt_goal_conversion function| _vis_opt_revenue_conversion function| _vis_opt_pause function| _vis_opt_readCookie function| _vis_opt_createCookie function| _vis_opt_element_loaded function| _vis_opt_GA_track function| _vis_opt_register_conversion function| _vis_opt_get_campaign_xPath number| _vis_opt_experiment_id boolean| _vwo_settings_timed_out object| _gat object| gaGlobal object| google_tag_data object| gaplugins object| gaData object| google_tag_manager function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| oattr function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO string| cookie_str number| s_expire string| cookie_set_string number| c_end object| __nls number| ___vwo object| uetq number| c_start object| MunchkinTracker object| _atw object| _vwo_geo function| UET function| UET_init function| UET_push function| ttd_dom_ready function| TTDUniversalPixelApi number| BOOMR_configt object| _bmrEvents string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks object| _0x3c80 function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray function| _0x3177 object| AJS object| AccessiBe object| acsb object| acsbJS number| BOOMR_onload object| whichUl object| EJSEventListeners function| EJSCustomEvent

23 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUlwxz7bJZhE_YAXbRTgP3Z_rB1IIei33s7rs1oWILz8MPx2RYVnWvxvEnW0
.trendmicro.com/ Name: RT
Value: "z=1&dm=trendmicro.com&si=23ac8614-37fb-4b21-bc65-7365b336acc3&ss=ks19430e&sl=1&tt=22s&bcn=%2F%2F1737ad5b.akstat.io%2F&ld=22y"
.trendmicro.com/ Name: _uetsid
Value: 4fd2f170f73411ebb2c6397f3c0cc30b
.trendmicro.com/ Name: _gid
Value: GA1.2.822017128.1628308961
.trendmicro.com/ Name: __utmz
Value: 44797537.1628308961.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.trendmicro.com/ Name: _uetvid
Value: 4fd2e800f73411ebbc4e0357c985db42
.trendmicro.com/ Name: __utmc
Value: 44797537
.trendmicro.com/ Name: _gcl_au
Value: 1.1.1719822905.1628308961
.trendmicro.com/ Name: _vis_opt_test_cookie
Value: 1
.trendmicro.com/ Name: __utma
Value: 44797537.1582688439.1628308961.1628308961.1628308961.1
.trendmicro.com/ Name: _vis_opt_s
Value: 1%7C
.trendmicro.com/ Name: __utmt
Value: 1
.trendmicro.com/ Name: _vwo_uuid_v2
Value: D6D4A5FD943F8CBF55575D89A41B90987|d42e1f95704cc88b29856f48013e79fb
.trendmicro.com/ Name: _vwo_ds
Value: 3%3Aa_1%2Ct_0%3A0%241628308960%3A23.19082881%3A%3A%3A95_1%2C69_1%3A0
www.trendmicro.com/ Name: __atuvs
Value: 610e05e006b8d8c6000
.trendmicro.com/ Name: _c1Ref
Value: /en_us/research/20/b/lokibot-impersonates-popular-game-launcher-and-drops-compiled-c-code-file.html
.trendmicro.com/ Name: _vwo_uuid
Value: D6D4A5FD943F8CBF55575D89A41B90987
.trendmicro.com/ Name: BE_CLA3
Value: p_id%3DP8PR4J2AP284R8JJ8ANJR8LRAAAAAAAAAH%26bf%3Daac6be469faa34d034400f3633921376%26bn%3D1%26bv%3D3.43%26s_expire%3D1628395361323%26s_id%3DP8PR4J2AP284R6262J2JR8LRAAAAAAAAAH
www.trendmicro.com/ Name: __atuvc
Value: 1%7C31
.trendmicro.com/ Name: _vwo_sn
Value: 0%3A1%3Ar1.visualwebsiteoptimizer.com%3A1%3A1
.trendmicro.com/ Name: _ga
Value: GA1.2.1582688439.1628308961
.trendmicro.com/ Name: __utmb
Value: 44797537.1.10.1628308961
.trendmicro.com/ Name: utag_main
Value: v_id:017b1ec6f692000a53754549650700072007d06a00b08$_sn:1$_ss:1$_st:1628310760914$ses_id:1628308960914%3Bexp-session$_pn:1%3Bexp-session

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1737ad5b.akstat.io
5427711.fls.doubleclick.net
a.b0e8.com
acsbap.com
acsbapp.com
adservice.google.com
api-public.addthis.com
attr.ml-api.io
bat.bing.com
c.go-mpulse.net
cdn.acsbapp.com
cdn.b0e8.com
cdn.bc0a.com
customer.cludo.com
dev.visualwebsiteoptimizer.com
fiaqj6abeejrukqce3ygyaaaabqq4bpd-puo2gx-833eb82bc-clienttons-s.akamaihd.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
insight.adsrvr.org
ixfd1-api.bc0a.com
js.adsrvr.org
lh4ubkycc4dnsyioaxrq-puo2gx-cc51b407a-clientnsv4-s.akamaihd.net
marvel-b1-cdn.bc0a.com
marvel-processor.bc0a.com
munchkin.marketo.net
r1.visualwebsiteoptimizer.com
resources.trendmicro.com
s.go-mpulse.net
s.ml-attr.com
s7.addthis.com
secure.adnxs.com
ssl.google-analytics.com
stats.g.doubleclick.net
tags.tiqcdn.com
trial-eum-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
v1.addthisedge.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.trendmicro.com
www.youtube.com
z.moatads.com
www.trendmicro.com
104.109.77.38
104.111.231.15
104.111.234.67
104.17.70.206
104.75.88.126
13.224.100.124
142.250.184.226
142.250.186.70
161.35.15.77
167.172.136.187
185.33.220.145
2.18.235.40
2.23.6.217
208.68.39.149
2600:9000:2156:7200:0:f267:a5c0:93a1
2600:9000:2190:600:12:3734:2a40:93a1
2606:4700:10::ac43:1b98
2620:1ec:c11::200
2a00:1450:4001:800::2003
2a00:1450:4001:808::200e
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::2008
2a00:1450:4001:80f::2002
2a00:1450:4001:813::2004
2a00:1450:4001:827::2004
2a00:1450:4001:827::200e
2a00:1450:4001:828::2008
2a00:1450:4001:829::2002
2a00:1450:4001:82a::200e
2a00:1450:4001:831::200a
2a00:1450:400c:c07::9c
2a02:26f0:5c::173e:259
2a02:26f0:6c00:1b8::11a6
2a02:26f0:6c00:2b9::11a6
2a02:26f0:6c00::210:ba13
34.102.193.142
34.95.105.148
34.96.102.137
35.190.5.192
35.201.125.192
35.201.70.94
35.245.208.72
52.31.175.99
68.67.153.60
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0ce9302a68e5b2d74b828eb71342ee6103d26030f98295e9ceaeea3fb2970188
0eed5d612288b39fd0f5133b93d09d4d2d51c572606ac09d231c32ae0b6e7559
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
14f87fb2dffc1b6940ced0923f3c39199a669e8a9ea7d65363b92137c6b0fc70
16db8973c330e8561090b2ac69a0413b9c34bdaf1a396e0b163254d325219557
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
1b673977fcdb2807366efbf1eadd298f68320235eb7dffa5943420579cd7fb8a
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
2fdc4337649e4f93be7994b8f90c6b5c6432e27022ba5b39bb238633fcd459c7
330909ff5e49857df55a2dc12b35e2d629bfd7e286047277aca521b04477e359
33d28d9afb2e45cf17c816d20f4c9c786c0da2adddaaad3feed8da1689f772c2
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
41b62bfcf93cf26d4206bf677c2a0ca5984f8b859a082824a8688d1774e3ece1
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4a3779d547c50c9bfe22c5d6f0d9075f0a3c2536a32554a87204112d2bd5841d
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120
5109aaebe7722e95d2109e29e8efd631e7d259105f0ec487a72ff2df55fb6497
540c6406140b9c4e6e32aa84fbab230a5c756456d9563903c0856eea77b68b60
543124399f956d9d15fb786ad84ab2860cbc640e1be3329ad1cfb24d2eb391c9
54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f
5551a75c064d136e9a4c7362cc7df65b712451ed176532dcdf42dda4fd31814a
596d9525c639fc53fbc787d74c10127fce8f011a0d056d3e9f1cd0a795030261
5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
64828cb71ab5d401d3907b88b2da383ce376e22271a691afbcfff11651ea70bf
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
71261ff0e58b69367001e4c6ae087b0f49bfd6ccef1716cded622d58911ac7a3
739f7dd643f9348b0c5eba4a04a5fbd0eb75aea2b27626236233cd2b9141fd77
73c975e8b47383bfc9220a1463ee6ecaead359a2e967587fde9c5ebec8548b94
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
7c9e72fed9f647684a0437f185bf4ed620de7b49f236453256716b639ac56f04
7d84c6695ba2aafd203a7ca7b9d443ea1b09db97e4c6cfd15e985ce9e6aef7f6
8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8884c8be84303ada213797a61542a5d3eb737f38acf0b0db399cb2fd5086fe2d
8a9e2cac18485539cfc4c9603e6e4cc48d1071918734923b5a59d0b48c5c0451
91d064593cb7008809034b1a246c484a1f2a70085b3a920f1fc234944a3fca6c
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
94a3438f1f3623e8987a691ad311f0e64c8750c56f5a6cd7ebf5ebb8960ce4fc
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1
9f7216d2f53a731d9749077c22e15cfb38bcdc40806511ccf736f440c7569d64
9fedf1ba6d44ff9123283b78c4f3a1d8253da41f6075085909de9cd9530cbdd5
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a5279c6531a32a985181ed015e1a27a078018296ec37ebcf5651a6f5e1885b97
a93ab7c213aa1e9a7a950bae7e7ba11a740ce4d8775bf2891569771132e15257
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
afd03396cfa6975864faa35da2d3b8def12704ace7264eb9d8e8882b8dff79f8
afdd29778a35ecf1638fc1c8bee1d4f7843d437d01b5db08cdf364da6b0edeaf
b0cfa85c43af17ebe716def3e1956375423714d57e02ead5a4a3e5bc5283ea61
b4522695aeea16458299e979a71eaa29dff35b74807467acb9ef34fc86f355d0
b6218e8cce38478995e5dc45a1a52d434582e1df6fb809b3024641db5ed6f0fd
c0fc4bbfbd6132a9d6b86ada7a9b9bd11f680f4cba3c004e5c04728ec4910aa4
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c818151c60b68e169ca56407386064745a6c3734b02f669071385fd2d33df2c4
caa027c143dd7aa7a836c2796c8cc507fe730e1069fdab2edbd431b7f9b46e11
d41399db4aaff4debebdea57ef41573593d7735c911e06e42391dff7cd00e667
d8212177aa1c438a763c952907b0705874975791064101bedfd2d5a7d787139a
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e08cca412d6468bba3462805c5b6312fa60593aab57acf3bf4579f25c6e80ae4
e0b4c38bd2fb084adf862b493f95ff5d1200908c839fff6f738820c1d318bef4
e0d0fce2404734cc7dcd0cf20880c64f65d2d76ab5743d16b590d5d31ec17968
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
e77bdb0ba7dd329aaa6c33250e5ce3cc287f47a04de1f6006ecf43202769df0d
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
f6713a015b8859d9f8bd2c9f25e388d8bec3086d501793ea957af0e723f5ef72