www.microsoft.com Open in urlscan Pro
2a02:26f0:6c00:183::356e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Submission: On March 06 via api (March 6th 2020, 7:45:25 pm UTC) from US

Summary HTTP 72 Redirects Links 67 Behaviour Indicators

Summary

This website contacted 18 IPs in 4 countries across 13 domains to perform 72 HTTP transactions. The main IP is 2a02:26f0:6c00:183::356e, located in Ascension Island and belongs to AKAMAI-ASN1, US. The main domain is www.microsoft.com.
TLS certificate: Issued by Microsoft IT TLS CA 5 on October 21st 2019. Valid for: 2 years.

This is the only time www.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
32	2a02:26f0:6c0... 2a02:26f0:6c00:183::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a02:26f0:10c... 2a02:26f0:10c:381::2957	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.111.237.104 104.111.237.104	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2.16.186.10 2.16.186.10	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2a02:26f0:10c... 2a02:26f0:10c:381::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba28	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	107.154.114.97 107.154.114.97	19551 (INCAPSULA) (INCAPSULA)
3	2a02:26f0:6c0... 2a02:26f0:6c00:19d::37	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	72.247.225.88 72.247.225.88	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a02:26f0:10c... 2a02:26f0:10c:383::2b57	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
5	40.77.226.250 40.77.226.250	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:10c... 2a02:26f0:10c:39e::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2a05:f500:10:... 2a05:f500:10:101::b93f:9101	14413 (LINKEDIN) (LINKEDIN)
1	72.247.226.64 72.247.226.64	16625 (AKAMAI-AS) (AKAMAI-AS)
1	40.90.22.188 40.90.22.188	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
72	18

32 2a02:26f0:6c00:183::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

www.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:10c:381::2957 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

assets.onestore.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.237.104 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-237-104.deploy.static.akamaitechnologies.com

query.prod.cms.rt.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.10 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-10.deploy.static.akamaitechnologies.com

statics-marketingsites-wcus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:10c:381::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba28 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

img-prod-cms-rt-microsoft-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 107.154.114.97 (United States)

ASN19551 (INCAPSULA, US)
PTR: 107.154.114.97.ip.incapdns.net

cloudblogs.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:19d::37 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

mem.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 72.247.225.88 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-88.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:383::2b57 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

uhf.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

az725175.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

web.vortex.data.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:39e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:10:101::b93f:9101 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.247.226.64 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-226-64.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.90.22.188 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	microsoft.com www.microsoft.com query.prod.cms.rt.microsoft.com cloudblogs.microsoft.com uhf.microsoft.com web.vortex.data.microsoft.com	2 MB
7	s-microsoft.com c.s-microsoft.com	151 KB
6	adobedtm.com assets.adobedtm.com	49 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	gfx.ms mem.gfx.ms	55 KB
3	onestore.ms assets.onestore.ms	211 KB
2	addthis.com s7.addthis.com	189 KB
2	akamaized.net statics-marketingsites-wcus-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net	5 KB
1	addthisedge.com v1.addthisedge.com	715 B
1	live.com login.live.com
1	moatads.com z.moatads.com	1 KB
1	licdn.com snap.licdn.com	2 KB
1	msecnd.net az725175.vo.msecnd.net	18 KB
72	13

	Domain	Requested by
32	www.microsoft.com	www.microsoft.com
7	c.s-microsoft.com	www.microsoft.com
6	assets.adobedtm.com	query.prod.cms.rt.microsoft.com assets.adobedtm.com
5	web.vortex.data.microsoft.com	az725175.vo.msecnd.net
4	cloudblogs.microsoft.com	www.microsoft.com
3	mem.gfx.ms	www.microsoft.com mem.gfx.ms
3	assets.onestore.ms	www.microsoft.com
2	px.ads.linkedin.com	1 redirects www.microsoft.com
2	s7.addthis.com	www.microsoft.com s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	login.live.com	mem.gfx.ms
1	z.moatads.com	s7.addthis.com
1	www.linkedin.com	1 redirects
1	snap.licdn.com	www.microsoft.com
1	az725175.vo.msecnd.net	www.microsoft.com
1	uhf.microsoft.com	www.microsoft.com
1	img-prod-cms-rt-microsoft-com.akamaized.net	www.microsoft.com
1	statics-marketingsites-wcus-ms-com.akamaized.net	www.microsoft.com
1	query.prod.cms.rt.microsoft.com	www.microsoft.com
72	19

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
azure.microsoft.com
products.office.com
servicetrust.microsoft.com
dynamics.microsoft.com
powerbi.microsoft.com
visualstudio.microsoft.com
docs.microsoft.com
technet.microsoft.com
msdn.microsoft.com
developer.microsoft.com
fasttrack.microsoft.com
partner.microsoft.com
partnercenter.microsoft.com
appsource.microsoft.com
azuremarketplace.microsoft.com
events.microsoft.com
blogs.technet.microsoft.com
access.redhat.com
windows.microsoft.com
download.microsoft.com
blogs.windows.com
answers.microsoft.com
twitter.com
www.facebook.com
store.office.com
account.microsoft.com
channel9.msdn.com
careers.microsoft.com
news.microsoft.com
privacy.microsoft.com
support.microsoft.com
choice.microsoft.com

Subject Issuer	Validity	Valid
www.microsoft.com Microsoft IT TLS CA 5	`2019-10-21` - `2021-10-21`	2 years	crt.sh
wildcard.onestore.ms Microsoft IT TLS CA 4	`2019-11-19` - `2021-11-19`	2 years	crt.sh
*.prod.cms.rt.microsoft.com Microsoft IT TLS CA 2	`2019-10-09` - `2021-10-09`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
cloudblogs.microsoft.com Microsoft IT TLS CA 5	`2020-01-14` - `2022-01-14`	2 years	crt.sh
mem.gfx.ms Microsoft IT TLS CA 2	`2020-01-06` - `2022-01-06`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
unistore.www.microsoft.com Microsoft IT TLS CA 5	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.vo.msecnd.net Microsoft IT TLS CA 2	`2018-03-30` - `2020-03-30`	2 years	crt.sh
*.vortex.data.microsoft.com Microsoft IT TLS CA 4	`2020-01-21` - `2022-01-21`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2020-09-04`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
login.live.com Microsoft IT TLS CA 1	`2019-11-05` - `2021-11-05`	2 years	crt.sh

This page contains 2 frames:

Primary Page: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Frame ID: 463212BB3200CA1663B259A68B459BF1
Requests: 72 HTTP requests in this frame

Frame: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=817d50b5-a6a7-409a-88ab-00c9dd20b334&partnerId=mssecurity
Frame ID: 095BCDF21E017BCC8DA6C83502BA163D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Page Statistics

72
Requests

100 %
HTTPS

50 %
IPv6

13
Domains

19
Subdomains

18
IPs

4
Countries

2435 kB
Transfer

4798 kB
Size

2
Cookies

67 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?linkid=845480
Title: Learn more

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/active-directory/
Title: Azure Active Directory

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/iot-central/
Title: Azure IoT Central

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/azure-sphere/
Title: Azure Sphere

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-dedicated-hsm/
Title: Azure Dedicated HSM Gateway

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/information-protection/
Title: Azure Information Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/key-vault/
Title: Azure Key Vault

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/features/azure-advanced-threat-protection/
Title: Azure Advanced Threat Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-sentinel/
Title: Azure Sentinel

Search URL Search Domain Scan URL

URL: https://products.office.com/en/exchange/advance-threat-protection
Title: Office 365 Advanced Threat Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/application-gateway/
Title: Azure Application Gateway

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/ddos-protection/
Title: Azure DDoS Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/security-center/
Title: Azure Security Center

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/application-gateway/
Title: Azure VPN Gateway

Search URL Search Domain Scan URL

URL: https://servicetrust.microsoft.com/ViewPage/HomePage
Title: Service Trust Portal

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/
Title: Azure

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/business/office
Title: Office 365

Search URL Search Domain Scan URL

URL: https://dynamics.microsoft.com/en-us/
Title: Dynamics 365

Search URL Search Domain Scan URL

URL: https://powerbi.microsoft.com/en-us/
Title: Power BI

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/microsoft-teams/group-chat-software
Title: Teams

Search URL Search Domain Scan URL

URL: https://visualstudio.microsoft.com/
Title: Visual Studio

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2026462
Title: Microsoft Advertising

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/services/cognitive-services/
Title: Azure Cognitive Services

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/
Title: Docs

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/ms376608.aspx
Title: TechNet

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us
Title: Developer Network

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/windows
Title: Windows Dev Center

Search URL Search Domain Scan URL

URL: https://fasttrack.microsoft.com/office
Title: FastTrack

Search URL Search Domain Scan URL

URL: https://partner.microsoft.com/
Title: Partner Network

Search URL Search Domain Scan URL

URL: https://partnercenter.microsoft.com/partner/home
Title: Partner Center

Search URL Search Domain Scan URL

URL: https://appsource.microsoft.com/
Title: AppSource

Search URL Search Domain Scan URL

URL: https://azuremarketplace.microsoft.com/marketplace/
Title: Azure Marketplace

Search URL Search Domain Scan URL

URL: https://events.microsoft.com/
Title: Events

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/mmpc/2017/09/06/ransomware-1h-2017-review-global-outbreaks-reinforce-the-value-of-security-hygiene/
Title: Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene

Search URL Search Domain Scan URL

URL: https://access.redhat.com/solutions/30744
Title: CVE-2010-0738

Search URL Search Domain Scan URL

URL: http://windows.microsoft.com/en-us/windows-8/join-maps-community
Title: ensure that MAPS has been enabled

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/cc770394%28v=ws.10%29.aspx
Title: password policy

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/mmpc/2016/02/24/locky-malware-lucky-to-avoid-it/
Title: Disable the loading of macros in Office programs

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/ee857085.aspx
Title: Disable macro loading through the Group Policy settings

Search URL Search Domain Scan URL

URL: https://access.redhat.com/solutions/2205341
Title: resolution

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/mt483740%28v=vs.85%29.aspx
Title: Credential Guard for Windows 10 Enterprise

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/dn986865%28v=vs.85%29.aspx
Title: Device Guard for Windows 10 Enterprise

Search URL Search Domain Scan URL

URL: http://download.microsoft.com/download/5/1/6/516F59A7-91EE-4463-8612-C85FD3BEBDC7/pop-securing-lateral-account-movement.pdf
Title: Secure the lateral account movement in your enterprise

Search URL Search Domain Scan URL

URL: https://blogs.windows.com/buildingapps/2016/01/26/convenient-two-factor-authentication-with-microsoft-passport-and-windows-hello/
Title: Microsoft Passport and Windows Hello

Search URL Search Domain Scan URL

URL: https://answers.microsoft.com/en-us/protect
Title: Microsoft community

Search URL Search Domain Scan URL

URL: https://twitter.com/WDSecurity
Title: @WDSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/MsftWDSI/
Title: Windows Defender Security Intelligence

Search URL Search Domain Scan URL

URL: https://twitter.com/@MSFTSecurity
Title: @MSFTSecurity

Search URL Search Domain Scan URL

URL: https://store.office.com/en-us/appshome.aspx
Title: Office apps

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/
Title: Account profile

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824761&clcid=0x409
Title: Microsoft Store support

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824764&clcid=0x409
Title: Returns

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/orders
Title: Order tracking

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/academic/compare-office-365-education-plans
Title: Office 365 for schools

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/community/education/
Title: Microsoft Azure in education

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=808093
Title: AppSource

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us
Title: TechNet

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/store/register
Title: Microsoft developer program

Search URL Search Domain Scan URL

URL: https://channel9.msdn.com/
Title: Channel 9

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/office
Title: Office Dev Center

Search URL Search Domain Scan URL

URL: https://careers.microsoft.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://news.microsoft.com/
Title: Company news

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-us
Title: Privacy at Microsoft

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/contactus
Title: Contact Microsoft

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkId=521839
Title: Privacy & cookies

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=206977
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://choice.microsoft.com/
Title: About our ads

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 61

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F&time=1583523908138 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fsecurity%252Fblog%252F2016%252F03%252F17%252Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%252F%26time%3D1583523908138%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F&time=1583523908138&liSync=true

72 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/ 115 KB
24 KB 616ms
601ms Document
text/html 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b313c30f1624ccb2ead023a02c157a7a44233be2bf12c99928b82400b885a360

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
nr-enabled: 1 1
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
content-type: text/html; charset=UTF-8
x-cache-group: normal
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
x-pingback
link: <https://mssecurity.wpengine.com/wp-json/>; rel="https://api.w.org/" <https://mssecurity.wpengine.com/?p=75989>; rel=shortlink
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-pass-why
x-frame-options: SAMEORIGIN
wpe-backend: apache apache
content-length: 23614
x-edgeconnect-origin-mex-latency: 97
date: Fri, 06 Mar 2020 19:45:05 GMT
vary: Accept-Encoding
set-cookie: X-Mapping-fjhppofk=93D06DBE5987EE64E12CE66A638A6CF5; path=/ ak_bmsc=0B4E1AC5D975656AC622427BD9B1BCAD0210BB0FF062000041A8625E97BFBC6B~plO9zo5aNEi8vTNTMwujfy8WfFTRZG4i9hlmvw5Qk6ylqN7BJHQkusNPUZUOvatszdETG17SQyWxfo5GrBfK1KfQeyMxGkSbL05ERQA/jkOhrIGY5EmMI3lH9FqoC3Cto+nnrKDvxk40j9jZwGXzWsuMNzHo7clT0mC9S2g+U+uYtiNJqyD38h8mW6vp8dZXiFydPySNB+6TfzcQAmIneI6do5TbriUBvQTaGz1E3xN1EgFF5LSypHqna5w544c+kO; expires=Fri, 06 Mar 2020 21:45:05 GMT; max-age=7200; path=/; domain=.microsoft.com; HttpOnly
tls_version: tls1.2
strict-transport-security: max-age=31536000
x-rtag: RT

GET
H2 200 style.min.css
www.microsoft.com/security/blog/wp-includes/css/dist/block-library/ 40 KB
6 KB 320ms
318ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 68
date: Fri, 06 Mar 2020 19:45:05 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:20 GMT
x-rtag: RT
status: 200
etag: W/"5e39b710-a1fb"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 6320

GET
H2 200 styles.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/ 10 KB
4 KB 322ms
320ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/styles.css?ver=1583501093

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 29
date: Fri, 06 Mar 2020 19:45:05 GMT
content-encoding: gzip
last-modified: Thu, 05 Dec 2019 15:29:15 GMT
x-rtag: RT
status: 200
etag: W/"5de9224b-29a7"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 3921

GET
H2 200 uhf-search-ui.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 160 B
369 B 689ms
686ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.css?ver=1.0.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 60
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Tue, 02 Apr 2019 19:51:16 GMT
x-rtag: RT
status: 200
etag: "5ca3bd34-a0"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 160

GET
H2 200 mwf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/ 581 KB
71 KB 50ms
10ms Stylesheet
text/css 2a02:26f0:10c:381::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:381::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Fri, 06 Mar 2020 19:45:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: QshXRY8/Osc4oVEHlL0Pbw==
status: 200
content-length: 71704
x-ms-lease-state: available
last-modified: Thu, 01 Feb 2018 02:22:19 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D5691A9EA468B4"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes

GET
H2 200 style.css
www.microsoft.com/security/blog/wp-content/themes/ms_s/ 342 B
463 B 660ms
657ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms_s/style.css?ver=1.0.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 59
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Fri, 22 Feb 2019 16:32:17 GMT
x-rtag: RT
status: 200
etag: W/"5c702411-156"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 238

GET
H2 200 style.min.css
www.microsoft.com/security/blog/wp-content/themes/ms-security/ 62 KB
12 KB 586ms
584ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/style.min.css?ver=2.4.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

15545c41aa48eb0b7e9c53a83fdf86248e9b8a305c3ce43bfae6c871ddad314e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 29
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Fri, 06 Mar 2020 15:29:06 GMT
x-rtag: RT
status: 200
etag: W/"5e626c42-f7b9"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 11651

GET
H/1.1 200
OK RE1r2ij Show response
query.prod.cms.rt.microsoft.com/cms/api/am/binary/ 4 KB
3 KB 345ms
113ms Script
application/x-javascript 104.111.237.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE1r2ij?ver=1.0.0
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.237.104 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-237-104.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: c3c027a797b2f7112555a219c0a0c91e8689f97203aeab469382665f74f05016

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

AppEx-Activity-Id: 66089c18-3c19-4e7f-ada5-3abf60a7b564
Content-Encoding: gzip
X-CMS-Tenant: am
X-CMS-ServiceLocation: eastus:7
X-CMS-Type: binary
X-CMS-DocumentId: RE1r2ij
X-CMS-Alias: default
Content-Disposition: inline; filename=oa.min.js
Connection: keep-alive
MS-CV: B/w9eoqPyUebtH6OuU1n7A.0
Content-Length: 2299
X-Trace-Context: {"ActivityId":"66089c18-3c19-4e7f-ada5-3abf60a7b564"}
X-CMS-Version: 45
Last-Modified: Tue, 09 Oct 2018 21:46:16 GMT
Server: Microsoft-IIS/10.0
ETag: W/"133"
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-CMS-ExecutionTimeInMilliseconds: 130
Cache-Control: public, must-revalidate, max-age=5651
Date: Fri, 06 Mar 2020 19:45:05 GMT
X-CMS-State: Published

GET
H2 200 jquery.js Show response
www.microsoft.com/security/blog/wp-includes/js/jquery/ 95 KB
34 KB 323ms
321ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 50
date: Fri, 06 Mar 2020 19:45:05 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-17a69"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 34019

GET
H2 200 jquery-migrate.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/jquery/ 10 KB
4 KB 364ms
362ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 28
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2016 06:11:28 GMT
x-rtag: RT
status: 200
etag: W/"573eaa90-2748"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 4016

GET
H2 200 mwf-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 302 KB
70 KB 66ms
26ms Script
application/x-javascript 2a02:26f0:10c:381::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-main.var.min.js?ver=v1.23.2+5182151

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:381::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: FuF99EJdzMvbQQjP24cb+Q==
status: 200
content-length: 71185
x-ms-lease-state: available
last-modified: Thu, 01 Feb 2018 02:22:29 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D5691AA4A90431"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes

GET
H2 200 51-40faf7
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/ 164 KB
22 KB 342ms
340ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/51-40faf7?ver=2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

238db52476bf8107e2e851cd3299b071ed5944b570c1603a1ea758a4fadf5f29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

ms-operation-id: 08b5c10547e59e4389bd4a25bdd7cfc4
date: Fri, 06 Mar 2020 19:45:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-02-25T21:00:52
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: a9420ad7-325f-4067-830c-2f5c722793c9
tls_version: tls1.2
x-s1: 2020-02-25T21:00:52
ms-cv: 6/oht3tU20ulaz4p.0
vary: Accept-Encoding
content-length: 22188
x-xss-protection: 1; mode=block
last-modified: Tue, 25 Feb 2020 21:00:52 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-02-08T02:01:06.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30676508
timing-allow-origin: *
x-appversion: 1.0.7342.32433
expires: Wed, 24 Feb 2021 21:00:13 GMT

GET
H/1.1 200
OK override.css
statics-marketingsites-wcus-ms-com.akamaized.net/statics/ 1 KB
907 B 333ms
115ms Stylesheet
text/css 2.16.186.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.10 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-10.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Fri, 06 Mar 2020 19:45:05 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jun 2019 23:22:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D6EEC3A2D67C35
Vary: Accept-Encoding
Content-Type: text/css
x-ms-request-id: 448b3076-d01e-0002-19b5-4008f0000000
x-ms-version: 2009-09-19
Connection: keep-alive
Content-Length: 473

GET
H2 200 mscc-0.4.2.min.css
c.s-microsoft.com/mscc/statics/ 1 KB
934 B 30ms
9ms Stylesheet
text/css 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Fri, 06 Mar 2020 19:45:05 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:23 GMT
content-md5: QLyM0qNPDXd6ayzd1iIoLA==
access-control-allow-origin: *
etag: 0x8D795E5A424E059
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/css;charset=utf-8
status: 200
x-ms-request-id: c301cf46-701e-00d5-16fc-c75b45000000
x-ms-version: 2009-09-19
content-length: 626

GET
H2 200 RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 4 KB
4 KB 20ms
6ms Image
image/png 2a02:26f0:6c00::210:ba28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00::210:ba28 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960

Security Headers

Name	Value
X-Frame-Options	deny

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-cms-cdninvalkey: am:RE1Mu3b
date: Fri, 06 Mar 2020 19:45:05 GMT
x-source-length: 4054
status: 200
x-activityid: 96ae2c54-8aef-485a-9de0-595044e41bba
x-deployment: a89a5014e89c41b7b60a64d7ee950637
content-length: 4054
timing-allow-origin: *
last-modified: Wed, 04 Mar 2020 06:50:15 GMT
x-datacenter: NorthEU
x-frame-options: deny
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=212716
x-instance: Resizer.Web_IN_3
content-location: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
expires: Mon, 09 Mar 2020 06:50:21 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 14 KB
5 KB 868ms
868ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 22
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-362a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 4666

GET
H2 200 linkedin-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 424 B
635 B 686ms
686ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/linkedin-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

dfc6de0e1501679bd71244faed1d26b977260f78853325c865754d05c238fe22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 63
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-1a8"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 424

GET
H2 200 facebook-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 231 B
441 B 196ms
192ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/facebook-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

875071ac76430f551ed9b36d0827d818157658b2247662db454ffcba6c07bb07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 29
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-e7"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 231

GET
H2 200 twitter-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 395 B
606 B 212ms
208ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/twitter-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

d52a506abeec5c7cb2e6cafe138da0763f555a16c2920683a7eb866453624f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 29
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-18b"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 395

GET
H2 200 mail-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 247 B
458 B 226ms
223ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/mail-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

9dc88b264cb2061fdeccef48662172bf52cc1cd5c668e242e9e600f3bf39c84b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 47
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-f7"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 247

GET
H2 200 skype-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 557 B
768 B 248ms
245ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/skype-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f25fb12269bb1060790dd528cb700a87c49d8f3531cedaad0d37c617a4d1c5af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 26
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-22d"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 557

GET
H2 200 messenger-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 448 B
659 B 271ms
268ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/messenger-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

cd9f9701c135d4c08a851bc5f634242f03fef8132f8d763cddc9b8ed1d20344a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 59
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-1c0"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 448

GET
H2 200 whatsapp-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 502 B
712 B 288ms
284ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/whatsapp-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

4dadc2332aba5151f4b0bd990760d4ea2f3207f9690d0bfeff626bccef8d335f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 24
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 06 Mar 2020 15:29:11 GMT
x-rtag: RT
status: 200
etag: "5e626c47-1f6"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 502

GET
H/1.1 200
OK SamasFlowchart.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 24 KB
24 KB 294ms
86ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/SamasFlowchart.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 718137f5b71f41e1f96cb656dbd40802591e8e5fd40f2e726d60a4d9f67580c9

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:45:06 GMT
Last-Modified: Tue, 09 Jan 2018 07:13:17 GMT
X-CDN: Incapsula
Etag: "0x8D5573074AA5045"
Content-Type: image/png
X-Iinfo: 11-42147245-0 0CNN RT(1583523906485 87) q(0 -1 -1 1) r(0 -1)
Cache-Control: max-age=313887296, public
Content-Length: 24132
Expires: Fri, 15 Feb 2030 18:40:02 GMT

GET
H/1.1 200
OK Ver1_samas.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 329 KB
330 KB 293ms
86ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Ver1_samas.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 134a87f4bf94fc4699db36eff4a33be7ddff93c9f3ef295870edf0bc627eeee0

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:45:06 GMT
Last-Modified: Tue, 09 Jan 2018 07:13:24 GMT
X-CDN: Incapsula
Etag: "0x8D5573078DA8FF6"
Content-Type: image/png
X-Iinfo: 12-54173316-0 0CNN RT(1583523906485 87) q(0 -1 -1 1) r(0 -1)
Cache-Control: max-age=314642741, public
Content-Length: 336646
Expires: Sun, 24 Feb 2030 12:30:47 GMT

GET
H/1.1 200
OK Ver2_samas.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 704 KB
705 KB 293ms
85ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Ver2_samas.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: b144ba9d8f9925b95436b9de7c5ee252ed10ef98d5ef58d1fc56d461f77e7dc3

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:45:06 GMT
Last-Modified: Tue, 09 Jan 2018 07:13:32 GMT
X-CDN: Incapsula
Etag: "0x8D557307E2D1750"
Content-Type: image/png
X-Iinfo: 10-29893202-0 0CNN RT(1583523906485 87) q(0 -1 -1 1) r(0 -1)
Cache-Control: max-age=314642739, public
Content-Length: 720655
Expires: Sun, 24 Feb 2030 12:30:45 GMT

GET
H/1.1 200
OK Samas2.jpg
cloudblogs.microsoft.com/uploads/prod/2018/01/ 83 KB
83 KB 301ms
94ms Image
image/jpeg 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Samas2.jpg
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: a3dbbb66db0d2ca891d83755b4a3c1c4a989b167caf01bafa50c0a9fb553a455

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:45:06 GMT
Last-Modified: Tue, 09 Jan 2018 07:13:13 GMT
X-CDN: Incapsula
Etag: "0x8D55730726F86CD"
Content-Type: image/jpeg
X-Iinfo: 9-19183053-0 0CNN RT(1583523906485 96) q(0 -1 -1 0) r(0 -1)
Cache-Control: max-age=314642739, public
Content-Length: 84610
Expires: Sun, 24 Feb 2030 12:30:45 GMT

GET
H2 200 human-operated-ransomware-blog-card-440x268.png
www.microsoft.com/security/blog/wp-content/uploads/2020/03/ 183 KB
184 KB 300ms
297ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2020/03/human-operated-ransomware-blog-card-440x268.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

9f98b5599a1f8fcf5606959b5db2f400e946018ac068c4253cf4c894873707d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 46
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Thu, 05 Mar 2020 15:47:08 GMT
x-rtag: RT
status: 200
etag: "5e611efc-2dc8d"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 187533

GET
H2 200 Quick-Wins-full-size-440x268.jpg
www.microsoft.com/security/blog/wp-content/uploads/2020/03/ 40 KB
41 KB 318ms
315ms Image
image/jpeg 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2020/03/Quick-Wins-full-size-440x268.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c52162c6149829e755d809f1de35cbe5ae4cb50898c962c2dd6290b36674f143

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 25
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Mon, 02 Mar 2020 21:24:01 GMT
x-rtag: RT
status: 200
etag: "5e5d7971-a137"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 41271

GET
H2 200 CTA-feature-1024x729.jpg
www.microsoft.com/security/blog/wp-content/uploads/2019/02/ 161 KB
162 KB 332ms
330ms Image
image/jpeg 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2019/02/CTA-feature-1024x729.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

a58941524adf31d97c86f42995772c3a250918e696d00afc4c78d149f2adc43f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Tue, 26 Feb 2019 00:33:13 GMT
x-rtag: RT
status: 200
etag: "5c748949-28405"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 164869

GET
H2 200 microsoft-uhf.js Show response
www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/ 3 KB
2 KB 57ms
53ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/microsoft-uhf.js?ver=0.2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

aa163f4777f0ee19e5f23ac0f332c22f06cd621696c62f527067c32a8c6c3a98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 29
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:22:46 GMT
x-rtag: RT
status: 200
etag: W/"5e39b676-b8a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1303

GET
H2 200 eucc.js Show response
www.microsoft.com/security/blog/wp-content/plugins/wds-microsoft-eu-cookie-compliance/assets/js/ 9 KB
3 KB 90ms
85ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-microsoft-eu-cookie-compliance/assets/js/eucc.js?ver=2.3.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c3c6fe97f918fcc40403ff671209d7d042dd4a8a7dc66e974eb1becc2bfe16ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 36
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:23:11 GMT
x-rtag: RT
status: 200
etag: W/"5e39b68f-2542"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 2931

GET
H2 200 uhf-search-ui.js Show response
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 4 KB
1 KB 58ms
53ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.js?ver=1.0.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 35
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 02 Apr 2019 19:51:16 GMT
x-rtag: RT
status: 200
etag: W/"5ca3bd34-105b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1039

GET
H2 200 modernizr.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/ 50 KB
16 KB 127ms
123ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 83
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Fri, 22 Feb 2019 16:33:49 GMT
x-rtag: RT
status: 200
etag: W/"5c70246d-c897"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 15897

GET
H2 200 mwf-auto-init-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 303 KB
71 KB 15ms
10ms Script
application/x-javascript 2a02:26f0:10c:381::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-auto-init-main.var.min.js?ver=v1.23.2+5182151

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:381::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 12go4t01WZJhAGBag3beKQ==
status: 200
content-length: 71611
x-ms-lease-state: available
last-modified: Thu, 01 Feb 2018 02:22:29 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D5691AA4A3D407"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes

GET
H2 200 picturefill.min.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/ 12 KB
5 KB 111ms
107ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/picturefill.min.js?ver=3.0.3

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 22
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Fri, 22 Feb 2019 16:34:16 GMT
x-rtag: RT
status: 200
etag: W/"5c702488-2e1f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 5181

GET
H2 200 imagesloaded.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 8 KB
3 KB 112ms
108ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/imagesloaded.min.js?ver=3.2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

11e15f1d64a63cb498d0d42720a688ed15bf78393d8c460d695a110244c066e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 27
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-1fb1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 2564

GET
H2 200 masonry.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 28 KB
9 KB 128ms
124ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/masonry.min.js?ver=3.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

733d7c26a5fb7240e83e8af2c822218b321b5143e28c2dd65ab2492297ac6bd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 62
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-7119"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 8582

GET
H2 200 project.min.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/ 7 KB
2 KB 144ms
140ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/project.min.js?ver=1.0.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

ea49a34ae66ff6330e30845980df1589a88990a50391b5b2d53248086c184924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 30
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Fri, 06 Mar 2020 15:29:11 GMT
x-rtag: RT
status: 200
etag: W/"5e626c47-1b58"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1988

GET
H2 200 wp-embed.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 1 KB
975 B 163ms
159ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/wp-embed.min.js?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 24
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-577"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 740

GET
H2 200 19-c0fae7 Show response
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a... 128 KB
34 KB 181ms
177ms Script
text/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/1b-c96630/db-bc0148/dc-7e9864/78-4c7d22/e1-c35781/40-7b7803/cd-23d3b0/6d-1e7ed0/b7-cadaa7/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/db-f3b1fd/93-283c2d/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/19-c0fae7?ver=2.0&iife=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

10733a5d876108f81c5f78eee5c9760a739d89c52fa6180c4290b7f909f24346

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

ms-operation-id: 11eaf5c01a129944935c09775528f11a
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-02-25T20:53:15
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: 7c3711c6-6814-435d-baf9-3834de4f5aac
tls_version: tls1.2
x-s1: 2020-02-25T20:53:14
ms-cv: OVP0QPrTPECETVRO.0
vary: Accept-Encoding
content-length: 34474
x-xss-protection: 1; mode=block
last-modified: Tue, 25 Feb 2020 20:53:14 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-02-08T02:01:06.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30676085
timing-allow-origin: *
x-appversion: 1.0.7342.32433
expires: Wed, 24 Feb 2021 20:53:11 GMT

GET
H/1.1 200
OK meversion Show response
mem.gfx.ms/ 26 KB
10 KB 26ms
6ms Script
application/javascript 2a02:26f0:6c00:19d::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c35c2ab6aa2d6ff4c126f4197f075c94e38371f7244267051317b63e607ab306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Fri, 06 Mar 2020 19:45:06 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Expires: Sat, 07 Mar 2020 06:34:00 GMT
Cache-Control: public, no-transform, max-age=43200
Connection: keep-alive
Content-Length: 9388
X-UA-Compatible: IE=edge

GET
H2 200 mscc-0.4.2.min.js Show response
c.s-microsoft.com/mscc/statics/ 4 KB
2 KB 12ms
9ms Script
text/javascript 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:14 GMT
content-md5: AO6kLOW8s6NiicKEPl74tA==
access-control-allow-origin: *
etag: 0x8D795E59EC908A0
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/javascript;charset=utf-8
status: 200
x-ms-request-id: c301cbc5-701e-00d5-7dfc-c75b45000000
x-ms-version: 2009-09-19
content-length: 2017

GET
H2 200 launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js Show response
assets.adobedtm.com/ 123 KB
26 KB 536ms
162ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Requested by: Host: query.prod.cms.rt.microsoft.com
URL: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE1r2ij?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c022d284134bd3ce8c0cc2c18b16a221fe4e8c3d9b5e6745dd4f9e2f45f3c27e

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:06 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:55 GMT
server: AkamaiNetStorage
etag: "fac34a38aa26f9abf9018259dc897ca2:1583273635.325789"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 26585
expires: Fri, 06 Mar 2020 20:45:06 GMT

GET
H2 200 mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 26 KB
26 KB 332ms
331ms Font
application/font-woff 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/51-40faf7?ver=2.0
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ms-operation-id: 588b128e7354724d8b7117f3dc123198
date: Fri, 06 Mar 2020 19:45:06 GMT
x-content-type-options: nosniff
x-rtag: RT
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: cae7e3f7-cff9-4bc5-a8aa-1b308dd93b6c
tls_version: tls1.2
ms-cv: jbPaQc8zYE2JpeqB.0
content-length: 26288
x-xss-protection: 1; mode=block
last-modified: Fri, 01 Nov 2019 08:35:05 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2019-10-26T07:31:04.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=20609408
x-appversion: 1.0.7237.42332
expires: Sat, 31 Oct 2020 08:35:14 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ 29 KB
29 KB 26ms
9ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "5b68d583e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=161663
accept-ranges: bytes
content-length: 29388
expires: Sun, 08 Mar 2020 16:39:29 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 33 KB
34 KB 32ms
17ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "588d483e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=259339
accept-ranges: bytes
content-length: 34052
expires: Mon, 09 Mar 2020 19:47:25 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 29 KB
30 KB 19ms
17ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 10 Jan 2020 19:09:42 GMT
access-control-allow-origin: *
etag: "83cce83e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=319485
accept-ranges: bytes
content-length: 30132
expires: Tue, 10 Mar 2020 12:29:51 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/ 27 KB
27 KB 24ms
24ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "1282d283e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=302967
accept-ranges: bytes
content-length: 27168
expires: Tue, 10 Mar 2020 07:54:33 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/ 28 KB
29 KB 21ms
21ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:45:06 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "95edd883e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=297737
accept-ranges: bytes
content-length: 28908
expires: Tue, 10 Mar 2020 06:27:23 GMT

GET
H2 204 _log
uhf.microsoft.com/ 0
128 B 41ms
9ms Image
text/html 2a02:26f0:10c:383::2b57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uhf.microsoft.com/_log?o=mscc&s=Microsoft.OneRenderFramework.Core&m=show&nv=aspnet-3.1.3&sv=0.1.2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:383::2b57 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 06 Mar 2020 19:45:06 GMT
access-control-allow-origin: *
content-type: text/html
status: 204
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Fri, 06 Mar 2020 19:45:06 GMT

GET
H/1.1 200
OK meBoot.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/ 132 KB
29 KB 6ms
6ms Script
application/javascript 2a02:26f0:6c00:19d::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/meBoot.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

7ddde9c325e7854bedabf59c04f3b81bf8539701d4c0e7fdc66624fd1580d78b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Feb 2020 09:21:28 GMT
Date: Fri, 06 Mar 2020 19:45:06 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28828
X-UA-Compatible: IE=edge

POST
H2 200 admin-ajax.php Show response
www.microsoft.com/security/blog/wp-admin/ 58 B
880 B 1533ms
1532ms XHR
application/json 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-admin/admin-ajax.php

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c02f7dbcbf49114dec273e763bca1199ed3126242c464c0262893752c1c9281b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Origin: https://www.microsoft.com
X-Requested-With: XMLHttpRequest
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-edgeconnect-origin-mex-latency: 1148
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-rtag: RT
status: 200
tls_version: tls1.2
content-length: 58
x-xss-protection: 1; mode=block
nr-enabled: 1, 1
referrer-policy: strict-origin-when-cross-origin
wpe-backend: apache, apache
x-wpe-loopback-upstream-addr: 127.0.0.1:6783, 127.0.0.1:6783
date: Fri, 06 Mar 2020 19:45:08 GMT
x-frame-options: SAMEORIGIN, SAMEORIGIN
content-type: application/json; charset=UTF-8
pragma: no-cache
cache-control: no-cache, must-revalidate, max-age=0, no-store
content-security-policy: upgrade-insecure-requests
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
DATA 200
OK truncated
/ 358 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 RCe273b42c34d5427cb02b2d6cd022cac2-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 1 KB
756 B 166ms
166ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RCe273b42c34d5427cb02b2d6cd022cac2-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b954e9deae1dd21ad3db40c79138e411b4165510df603dd6e7e1ad8e7b38971e

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:07 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 511
expires: Fri, 06 Mar 2020 20:45:07 GMT

GET
H2 200 RCf4d5a6b020184421bd20da64431bd00c-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 1 KB
824 B 166ms
166ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RCf4d5a6b020184421bd20da64431bd00c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d234c547122d2621d54d94ca01cb714d49f8bd25fea3bdcc3c3c5f24b6e88594

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:07 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 578
expires: Fri, 06 Mar 2020 20:45:07 GMT

GET
H2 200 RCb88241d3e29144c1b886ab5fabb4ef5a-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 3 KB
1 KB 166ms
166ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RCb88241d3e29144c1b886ab5fabb4ef5a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8ed9c234ecfa1787fe94a919e7a247a9488bb4ecc256d72f314ff8e11ecde7f2

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:07 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1010
expires: Fri, 06 Mar 2020 20:45:07 GMT

GET
H2 200 RC609c6a62e6764307915e122757d5274b-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 74 KB
19 KB 167ms
167ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RC609c6a62e6764307915e122757d5274b-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b149454d4a8486f01d3a5b927d3dfeefa4bb425324b1c187e202d5e5c01d60df

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:07 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 19171
expires: Fri, 06 Mar 2020 20:45:07 GMT

GET
H2 200 jsll-4.js Show response
az725175.vo.msecnd.net/scripts/ 54 KB
18 KB 330ms
81ms Script
text/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8DD6) /
Resource Hash: e6bbfa4af18fb4f0e9c8a31d6654eac92d0f82dc895c6e5f49b54a8de51e5923

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Mar 2020 19:45:07 GMT
content-encoding: gzip
content-md5: Dy7dMa7nsOSUbofNz/X23A==
age: 1726
x-cache: HIT
status: 200
content-length: 18058
x-ms-lease-status: unlocked
last-modified: Thu, 14 Mar 2019 00:43:49 GMT
server: ECAcc (lha/8DD6)
etag: 0x8D6A8161FD3B925
vary: Accept-Encoding
content-type: text/javascript; charset="utf-8"
x-ms-request-id: ecf51654-801e-0016-10eb-f30eb5000000
cache-control: public, max-age=1800, immutable
x-ms-version: 2009-09-19

GET
H/1.1 200
OK t.js Show response
web.vortex.data.microsoft.com/collect/v1/ 281 B
966 B 666ms
165ms Script
application/javascript 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272020-03-06T19%3A45%3A07.567Z%27&os=%27MacOS%27&appId=%27JS%3AsecurityBlog%27&-ver=%271.0%27&-impressionGuid=%27cf7aa6b5-8486-4739-af60-e7ec39caf983%27&-pageName=%27Undefined%27&-uri=%27https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22metaTags%22%3A%7B%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27No%20mas%2C%20Samas%3A%20What%27s%20in%20this%20ransomware%27s%20modus%20operandi%3F%20-%20Microsoft%20Security%27&*isLoggedIn=false&*flashInstalled=false&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.14%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false

Requested by

Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

9c310cc0718e3baeec3ed7634cafa1d9d60a2198df76ce5c1d57518ccc4f16e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Fri, 06 Mar 2020 19:45:07 GMT
X-Content-Type-Options: nosniff
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control: no-cache, no-store
MS-CV: hR9eLWozjUKeRtuVhDIymg.0
Content-Type: application/javascript
Content-Length: 281
Expires: 0

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:39e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:39e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 06 Mar 2020 19:45:08 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=47882
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 349 KB
113 KB 319ms
115ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Tue, 21 Jan 2020 20:57:37 GMT
server: nginx/1.15.8
etag: W/"5e2765c1-57446"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Fri, 06 Mar 2020 19:45:08 GMT
x-host: s7.addthis.com
content-length: 114924

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F&time=158352...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fsecurity%252Fblog%252F2016...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F&time=158352...

0
94 B

165ms
165ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F&time=1583523908138&liSync=true
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:45:08 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: 5Coj3JrO+RVQEhM3UisAAA==

Redirect headers

date: Fri, 06 Mar 2020 19:45:08 GMT
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
status: 302
strict-transport-security: max-age=2592000
content-length: 0
x-xss-protection: 1; mode=block
server: Play
pragma: no-cache
x-li-pop: prod-efr5
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: pMXbz5rO+RVQEk/ofSsAAA==
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F&time=1583523908138&liSync=true
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
x-li-fabric: prod-lor1
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 494ms
157ms Script
application/x-javascript 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:09 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: C0B7E130097BC605
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=45993
accept-ranges: bytes
content-length: 948
x-amz-id-2: WMRpIO186SrpMgXAdDxxqtwuB/nVpPpDrif5aSQ8+ORAAGwczaqMUoDLYLjYQOU+EHP09vSgz8E=

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 143ms
143ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Origin: https://www.microsoft.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H2 200 me.srf
login.live.com/ Frame 095B 0
0 649ms
222ms Document
text/html 40.90.22.188
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=817d50b5-a6a7-409a-88ab-00c9dd20b334&partnerId=mssecurity

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/meBoot.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.90.22.188 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: login.live.com
:scheme: https
:path: /me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=817d50b5-a6a7-409a-88ab-00c9dd20b334&partnerId=mssecurity
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: Fri, 06 Mar 2020 19:44:09 GMT
vary: Accept-Encoding
server: Microsoft-IIS/10.0
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
set-cookie: uaid=817d50b5a6a7409a88ab00c9dd20b334; domain=login.live.com; Secure; path=/; HttpOnly MSPRequ=id=N&lt=1583523909&co=1; domain=login.live.com; Secure; path=/; HttpOnly
referrer-policy: strict-origin-when-cross-origin
x-ms-request-id: 5edcb7ce-38c1-4768-bed4-72a009129ee3
ppserver: PPV: 30 H: BY1PPF51F6A9DB3 V: 0
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
date: Fri, 06 Mar 2020 19:45:09 GMT
content-length: 4318

GET
H/1.1 200
OK meCore.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/ 101 KB
17 KB 6ms
6ms Script
application/javascript 2a02:26f0:6c00:19d::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/meCore.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

aed1e03b227468b53fac24720b477f0eb239b6879ff8cd945d9bb625f670223c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Feb 2020 09:21:34 GMT
Date: Fri, 06 Mar 2020 19:45:09 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16987
X-UA-Compatible: IE=edge

GET
H2 200 RC02a99f79d83643db96d68f21ab6d4c4e-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 2 KB
1 KB 151ms
150ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RC02a99f79d83643db96d68f21ab6d4c4e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a9ff1d8e5394b324c020747c9556e5c37e096bad5e2332d6cfd08de57497d7b4

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:09 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 810
expires: Fri, 06 Mar 2020 20:45:09 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5a733b9bbd7faa84/ 1 KB
715 B 309ms
301ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5a733b9bbd7faa84/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 54d6708cd6dc7015978f4f54e47c6e25e4f6a4056e0d012cbd25ace40436193d

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:45:09 GMT
content-encoding: gzip
etag: -1434393054--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=58, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 538

GET
H/1.1 200
OK t.js Show response
web.vortex.data.microsoft.com/collect/v1/ 281 B
966 B 276ms
155ms Script
application/javascript 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.ClientError%27&time=%272020-03-06T19%3A45%3A09.262Z%27&os=%27MacOS%27&appId=%27JS%3AsecurityBlog%27&*errorInfo=%27%7B%22Page%22%3A%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F%22%2C%22Script%22%3A%22%22%2C%22Message%22%3A%22Script%20error.%22%2C%22LineNumber%22%3A0%2C%22StackTrace%22%3A%22%22%2C%22UserAgent%22%3A%22Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36%22%2C%22Platform%22%3A%22Linux%20x86_64%22%7D%27&*wasDisplayed=false&*impressionGuid=%27cf7aa6b5-8486-4739-af60-e7ec39caf983%27&*pageName=%27Undefined%27&*uri=%27https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F%27&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.14%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false

Requested by

Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d265c2a55fe3218f7dd56f19a3a0f879a3441e2668f941b738ec00203292e272

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Fri, 06 Mar 2020 19:45:08 GMT
X-Content-Type-Options: nosniff
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control: no-cache, no-store
MS-CV: P7x+rOBjzkeHd4dvY4jmGw.0
Content-Type: application/javascript
Content-Length: 281
Expires: 0

GET
H/1.1 200
OK t.js Show response
web.vortex.data.microsoft.com/collect/v1/ 281 B
966 B 320ms
87ms Script
application/javascript 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.ContentUpdate%27&time=%272020-03-06T19%3A45%3A09.286Z%27&os=%27MacOS%27&appId=%27JS%3AsecurityBlog%27&-ver=%271.0%27&-impressionGuid=%27cf7aa6b5-8486-4739-af60-e7ec39caf983%27&-pageName=%27Undefined%27&-uri=%27https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F17%2Fno-mas-samas-whats-in-this-ransomwares-modus-operandi%2F%27&-pageTags=%27%7B%22metaTags%22%3A%7B%7D%2C%22timing%22%3A%22%7B%5C%22first-paint%5C%22%3A1486.8649989366531%2C%5C%22first-contentful-paint%5C%22%3A1486.8649989366531%2C%5C%22navigationStart%5C%22%3A1583523904956%2C%5C%22unloadEventStart%5C%22%3A0%2C%5C%22unloadEventEnd%5C%22%3A0%2C%5C%22redirectStart%5C%22%3A0%2C%5C%22redirectEnd%5C%22%3A0%2C%5C%22fetchStart%5C%22%3A1583523904956%2C%5C%22domainLookupStart%5C%22%3A1583523904957%2C%5C%22domainLookupEnd%5C%22%3A1583523904959%2C%5C%22connectStart%5C%22%3A1583523904959%2C%5C%22connectEnd%5C%22%3A1583523904971%2C%5C%22secureConnectionStart%5C%22%3A1583523904963%2C%5C%22requestStart%5C%22%3A1583523904971%2C%5C%22responseStart%5C%22%3A1583523905572%2C%5C%22responseEnd%5C%22%3A1583523905797%2C%5C%22domLoading%5C%22%3A1583523905574%2C%5C%22domInteractive%5C%22%3A1583523906570%2C%5C%22domContentLoadedEventStart%5C%22%3A1583523906572%2C%5C%22domContentLoadedEventEnd%5C%22%3A1583523906579%2C%5C%22domComplete%5C%22%3A1583523909240%2C%5C%22loadEventStart%5C%22%3A1583523909240%2C%5C%22loadEventEnd%5C%22%3A1583523909263%7D%22%7D%27&-pageHeight=7871&-vpHeight=1200&-vpWidth=1600&-behavior=0&-vScrollOffset=0&-hScrollOffset=0&-contentVer=%272.0%27&-content=%27%5B%7B%22cN%22%3A%22headerArea%22%2C%22cT%22%3A%22Area_coreuiArea%22%2C%22id%22%3A%22a1Body%22%2C%22sN%22%3A1%2C%22aN%22%3A%22Body%22%7D%2C%7B%22cN%22%3A%22headerRegion%22%2C%22cT%22%3A%22Region_coreui-region%22%2C%22id%22%3A%22r1a1%22%2C%22sN%22%3A1%2C%22aN%22%3A%22a1%22%7D%2C%7B%22cN%22%3A%22headerUniversalHeader%22%2C%22cT%22%3A%22Module_coreui-universalheader%22%2C%22id%22%3A%22m1r1a1%22%2C%22sN%22%3A1%2C%22aN%22%3A%22r1a1%22%7D%2C%7B%22cN%22%3A%22Universal%20Header_cont%22%2C%22cT%22%3A%22Container%22%2C%22id%22%3A%22c3m1r1a1%22%2C%22sN%22%3A3%2C%22aN%22%3A%22m1r1a1%22%7D%2C%7B%22cN%22%3A%22GlobalNav_Logo_cont%22%2C%22cT%22%3A%22Container%22%2C%22id%22%3A%22c3c3m1r1a1%22%2C%22sN%22%3A3%2C%22aN%22%3A%22c3m1r1a1%22%7D%2C%7B%22cN%22%3A%22CatNav_Security_nav%22%2C%22id%22%3A%22n6c3m1r1a1%22%2C%22sN%22%3A6%2C%22aN%22%3A%22c3m1r1a1%22%7D%2C%7B%22cN%22%3A%22Category%20nav_cont%22%2C%22cT%22%3A%22Container%22%2C%22id%22%3A%22c8c3m1r1a1%22%2C%22sN%22%3A8%2C%22aN%22%3A%22c3m1r1a1%22%7D%2C%7B%22id%22%3A%22nn2c8c3m1r1a1%22%2C%22sN%22%3A2%2C%22aN%22%3A%22c8c3m1r1a1%22%7D%2C%7B%22id%22%3A%22nn4c8c3m1r1a1%22%2C%22sN%22%3A4%2C%22aN%22%3A%22c8c3m1r1a1%22%7D%2C%7B%22id%22%3A%22nn6c8c3m1r1a1%22%2C%22sN%22%3A6%2C%22aN%22%3A%22c8c3m1r1a1%22%7D%2C%7B%22id%22%3A%22nn8c8c3m1r1a1%22%2C%22sN%22%3A8%2C%22aN%22%3A%22c8c3m1r1a1%22%7D%2C%7B%22id%22%3A%22nn10c8c3m1r1a1%22%2C%22sN%22%3A10%2C%22aN%22%3A%22c8c3m1r1a1%22%7D%2C%7B%22id%22%3A%22nn12c8c3m1r1a1%22%2C%22sN%22%3A12%2C%22aN%22%3A%22c8c3m1r1a1%22%7D%2C%7B%22cN%22%3A%22Header%20actions_cont%22%2C%22cT%22%3A%22Container%22%2C%22id%22%3A%22c9c3m1r1a1%22%2C%22sN%22%3A9%2C%22aN%22%3A%22c3m1r1a1%22%7D%2C%7B%22cN%22%3A%22GlobalNav_cont%22%2C%22cT%22%3A%22Container%22%2C%22id%22%3A%22c1c9c3m1r1a1%22%2C%22sN%22%3A1%2C%22aN%22%3A%22c9c3m1r1a1%22%7D%2C%7B%22cN%22%3A%22GlobalNav_More_nonnav%22%2C%22id%22%3A%22nn1c1c9c3m1r1a1%22%2C%22sN%22%3A1%2C%22aN%22%3A%22c1c9c3m1r1a1%22%7D%2C%7B%22cN%22%3A%22GlobalNav_Search_cont%22%2C%22cT%22%3A%22Container%22%2C%22id%22%3A%22c3c1c9c3m1r1a1%22%2C%22sN%22%3A3%2C%22aN%22%3A%22c1c9c3m1r1a1%22%7D%2C%7B%22cN%22%3A%22GlobalNav_Account_cont%22%2C%22cT%22%3A%22Container%22%2C%22id%22%3A%22c5c1c9c3m1r1a1%22%2C%22sN%22%3A5%2C%22aN%22%3A%22c1c9c3m1r1a1%22%7D%5D%27&*baseType=%27Ms.Content.ContentUpdate%27&*title=%27No%20mas%2C%20Samas%3A%20What%27s%20in%20this%20ransomware%27s%20modus%20operandi%3F%20-%20Microsoft%20Security%27&*cookieEnabled=true&*isJs=true&*isDomComplete=true&*isLoggedIn=false&*pageLoadTime=4284&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.14%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false

Requested by

Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

20c7d4cfb333934c909315dd33660814c8cbeaa25173a0e500007d7ea4fd32ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Fri, 06 Mar 2020 19:45:08 GMT
X-Content-Type-Options: nosniff
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control: no-cache, no-store
MS-CV: u6+idj9WZU+Mo+2tuSmyVQ.0
Content-Type: application/javascript
Content-Length: 281
Expires: 0

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 385ms
147ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
Origin: https://www.microsoft.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 91ms
91ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Fri, 06 Mar 2020 19:45:09 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

Verdicts & Comments Add Verdict or Comment

97 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.microsoft.com/	1970-01-19 07:52:05	Name: __atuvs Value: 5e62a8443912e1b7000
			www.microsoft.com/	1970-01-19 17:22:14	Name: __atuvc Value: 1%7C10

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1
console-api	log	(Line 2) Message: Start KWIF
console-api	log	(Line 2) Message: JSLL starts
console-api	log	(Line 2) Message: ID syncs starts
console-api	log	(Line 2) Message: JSLL ends
console-api	log	(Line 2) Message: webblends match failed forhttps://www.microsoft.com/security/blog/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/
console-api	log	(Line 2) Message: ID syncs ends with appid

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
assets.onestore.ms
az725175.vo.msecnd.net
c.s-microsoft.com
cloudblogs.microsoft.com
img-prod-cms-rt-microsoft-com.akamaized.net
login.live.com
mem.gfx.ms
px.ads.linkedin.com
query.prod.cms.rt.microsoft.com
s7.addthis.com
snap.licdn.com
statics-marketingsites-wcus-ms-com.akamaized.net
uhf.microsoft.com
v1.addthisedge.com
web.vortex.data.microsoft.com
www.linkedin.com
www.microsoft.com
z.moatads.com
104.111.237.104
107.154.114.97
152.199.19.160
2.16.186.10
23.210.248.44
2a02:26f0:10c:381::2957
2a02:26f0:10c:381::356e
2a02:26f0:10c:383::2b57
2a02:26f0:10c:39e::25ea
2a02:26f0:6c00:183::356e
2a02:26f0:6c00:19d::37
2a02:26f0:6c00::210:ba28
2a05:f500:10:101::b93f:9101
2a05:f500:11:101::b93f:9005
40.77.226.250
40.90.22.188
72.247.225.88
72.247.226.64
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
10733a5d876108f81c5f78eee5c9760a739d89c52fa6180c4290b7f909f24346
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
11e15f1d64a63cb498d0d42720a688ed15bf78393d8c460d695a110244c066e3
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
134a87f4bf94fc4699db36eff4a33be7ddff93c9f3ef295870edf0bc627eeee0
15545c41aa48eb0b7e9c53a83fdf86248e9b8a305c3ce43bfae6c871ddad314e
16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade
1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
20c7d4cfb333934c909315dd33660814c8cbeaa25173a0e500007d7ea4fd32ea
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
238db52476bf8107e2e851cd3299b071ed5944b570c1603a1ea758a4fadf5f29
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04
4dadc2332aba5151f4b0bd990760d4ea2f3207f9690d0bfeff626bccef8d335f
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
54d6708cd6dc7015978f4f54e47c6e25e4f6a4056e0d012cbd25ace40436193d
66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066
6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6
718137f5b71f41e1f96cb656dbd40802591e8e5fd40f2e726d60a4d9f67580c9
733d7c26a5fb7240e83e8af2c822218b321b5143e28c2dd65ab2492297ac6bd7
7ddde9c325e7854bedabf59c04f3b81bf8539701d4c0e7fdc66624fd1580d78b
875071ac76430f551ed9b36d0827d818157658b2247662db454ffcba6c07bb07
893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8
8ed9c234ecfa1787fe94a919e7a247a9488bb4ecc256d72f314ff8e11ecde7f2
9c310cc0718e3baeec3ed7634cafa1d9d60a2198df76ce5c1d57518ccc4f16e5
9dc88b264cb2061fdeccef48662172bf52cc1cd5c668e242e9e600f3bf39c84b
9f98b5599a1f8fcf5606959b5db2f400e946018ac068c4253cf4c894873707d8
a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c
a3dbbb66db0d2ca891d83755b4a3c1c4a989b167caf01bafa50c0a9fb553a455
a58941524adf31d97c86f42995772c3a250918e696d00afc4c78d149f2adc43f
a9ff1d8e5394b324c020747c9556e5c37e096bad5e2332d6cfd08de57497d7b4
aa163f4777f0ee19e5f23ac0f332c22f06cd621696c62f527067c32a8c6c3a98
ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7
aed1e03b227468b53fac24720b477f0eb239b6879ff8cd945d9bb625f670223c
b144ba9d8f9925b95436b9de7c5ee252ed10ef98d5ef58d1fc56d461f77e7dc3
b149454d4a8486f01d3a5b927d3dfeefa4bb425324b1c187e202d5e5c01d60df
b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102
b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4
b313c30f1624ccb2ead023a02c157a7a44233be2bf12c99928b82400b885a360
b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178
b954e9deae1dd21ad3db40c79138e411b4165510df603dd6e7e1ad8e7b38971e
c022d284134bd3ce8c0cc2c18b16a221fe4e8c3d9b5e6745dd4f9e2f45f3c27e
c02f7dbcbf49114dec273e763bca1199ed3126242c464c0262893752c1c9281b
c35c2ab6aa2d6ff4c126f4197f075c94e38371f7244267051317b63e607ab306
c3c027a797b2f7112555a219c0a0c91e8689f97203aeab469382665f74f05016
c3c6fe97f918fcc40403ff671209d7d042dd4a8a7dc66e974eb1becc2bfe16ed
c52162c6149829e755d809f1de35cbe5ae4cb50898c962c2dd6290b36674f143
cd9f9701c135d4c08a851bc5f634242f03fef8132f8d763cddc9b8ed1d20344a
d234c547122d2621d54d94ca01cb714d49f8bd25fea3bdcc3c3c5f24b6e88594
d265c2a55fe3218f7dd56f19a3a0f879a3441e2668f941b738ec00203292e272
d52a506abeec5c7cb2e6cafe138da0763f555a16c2920683a7eb866453624f39
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f
dfc6de0e1501679bd71244faed1d26b977260f78853325c865754d05c238fe22
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6bbfa4af18fb4f0e9c8a31d6654eac92d0f82dc895c6e5f49b54a8de51e5923
ea49a34ae66ff6330e30845980df1589a88990a50391b5b2d53248086c184924
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b
f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81
f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d
f25fb12269bb1060790dd528cb700a87c49d8f3531cedaad0d37c617a4d1c5af
f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

www.microsoft.com Open in urlscan Pro 2a02:26f0:6c00:183::356e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

72 Requests

100 %HTTPS

50 %IPv6

13 Domains

19 Subdomains

18 IPs

4 Countries

2435 kBTransfer

4798 kBSize

2 Cookies

67 Outgoing links

Redirected requests

72 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.microsoft.com Open in urlscan Pro
2a02:26f0:6c00:183::356e Public Scan

Screenshot
Live screenshot

Full Image

72
Requests

100 %
HTTPS

50 %
IPv6

13
Domains

19
Subdomains

18
IPs

4
Countries

2435 kB
Transfer

4798 kB
Size

2
Cookies

72 HTTP transactions
1 data transactions