www.microsoft.com Open in urlscan Pro
2a02:26f0:eb:3aa::356e Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Patpoopy.A!sms&threatid=2147740958&enterprise=0
Effective URL:
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threa...
Submission: On November 05 via manual (November 5th 2020, 6:08:48 am UTC) from GB

Summary HTTP 38 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 8 domains to perform 38 HTTP transactions. The main IP is 2a02:26f0:eb:3aa::356e, located in Ascension Island and belongs to AKAMAI-ASN1, EU. The main domain is www.microsoft.com.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on August 28th 2020. Valid for: a year.

This is the only time www.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a02:26f0:eb:... 2a02:26f0:eb:3b3::2c1a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 6	2a02:26f0:eb:... 2a02:26f0:eb:3aa::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	23.96.1.109 23.96.1.109	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a02:26f0:2b0... 2a02:26f0:2b00:992::2957	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2.16.186.26 2.16.186.26	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:170... 2a02:26f0:1700:181::37	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
1	2a02:26f0:2b0... 2a02:26f0:2b00:5::5c7a:3244	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a02:26f0:2b0... 2a02:26f0:2b00:5::5c7a:3249	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:2b0... 2a02:26f0:2b00:995::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	40.77.226.250 40.77.226.250	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	40.90.137.124 40.90.137.124	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
38	13

1 2a02:26f0:eb:3b3::2c1a (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)

go.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:eb:3aa::356e (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)

www.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.96.1.109 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

securityintelligencecenter-eastus.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:2b00:992::2957 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

assets.onestore.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.26 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-26.deploy.static.akamaitechnologies.com

statics-marketingsites-eus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:1700:181::37 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

mem.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

wcpstatic.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

az725175.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2b00:5::5c7a:3244 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

img-prod-cms-rt-microsoft-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:2b00:5::5c7a:3249 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

statics-mwf-wcus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:2b00:995::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

web.vortex.data.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.90.137.124 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	microsoft.com 2 redirects go.microsoft.com www.microsoft.com wcpstatic.microsoft.com web.vortex.data.microsoft.com	123 KB
10	azurewebsites.net securityintelligencecenter-eastus.azurewebsites.net	276 KB
5	akamaized.net statics-marketingsites-eus-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net statics-mwf-wcus-ms-com.akamaized.net	8 KB
4	s-microsoft.com c.s-microsoft.com	119 KB
4	gfx.ms mem.gfx.ms	66 KB
3	onestore.ms assets.onestore.ms	151 KB
1	live.com login.live.com
1	msecnd.net az725175.vo.msecnd.net	18 KB
38	8

	Domain	Requested by
10	securityintelligencecenter-eastus.azurewebsites.net	www.microsoft.com
6	www.microsoft.com	1 redirects www.microsoft.com
4	web.vortex.data.microsoft.com	az725175.vo.msecnd.net
4	c.s-microsoft.com	assets.onestore.ms
4	mem.gfx.ms	www.microsoft.com mem.gfx.ms
3	statics-mwf-wcus-ms-com.akamaized.net	www.microsoft.com
3	assets.onestore.ms	www.microsoft.com
1	login.live.com	mem.gfx.ms
1	img-prod-cms-rt-microsoft-com.akamaized.net	www.microsoft.com
1	az725175.vo.msecnd.net	www.microsoft.com
1	wcpstatic.microsoft.com	www.microsoft.com
1	statics-marketingsites-eus-ms-com.akamaized.net	www.microsoft.com
1	go.microsoft.com	1 redirects
38	13

This site contains links to these domains. Also see Links.

Domain
cloudblogs.microsoft.com
support.microsoft.com
azure.microsoft.com
products.office.com
dynamics.microsoft.com
powerplatform.microsoft.com
powerbi.microsoft.com
visualstudio.microsoft.com
go.microsoft.com
docs.microsoft.com
developer.microsoft.com
fasttrack.microsoft.com
partner.microsoft.com
partnercenter.microsoft.com
appsource.microsoft.com
azuremarketplace.microsoft.com
events.microsoft.com
windows.microsoft.com
www.facebook.com
twitter.com
account.microsoft.com
channel9.msdn.com
careers.microsoft.com
news.microsoft.com
privacy.microsoft.com
choice.microsoft.com

Subject Issuer	Validity	Valid
www.microsoft.com Microsoft RSA TLS CA 01	`2020-08-28` - `2021-08-28`	a year	crt.sh
*.azurewebsites.net Microsoft IT TLS CA 5	`2019-09-24` - `2021-09-24`	2 years	crt.sh
wildcard.onestore.ms Microsoft IT TLS CA 4	`2019-11-19` - `2021-11-19`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
mem.gfx.ms Microsoft IT TLS CA 2	`2020-01-06` - `2022-01-06`	2 years	crt.sh
wcpstatic.microsoft.com DigiCert SHA2 Secure Server CA	`2020-09-15` - `2021-09-15`	a year	crt.sh
*.vo.msecnd.net Microsoft IT TLS CA 2	`2020-03-18` - `2022-03-18`	2 years	crt.sh
*.vortex.data.microsoft.com Microsoft RSA TLS CA 02	`2020-10-05` - `2021-10-05`	a year	crt.sh
login.live.com DigiCert SHA2 Secure Server CA	`2020-10-07` - `2021-10-07`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
Frame ID: ED277E53C5A0584F117881CDE0F4EBDB
Requests: 37 HTTP requests in this frame

Frame: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=d50b9ff2-934e-4817-d397-8dcd49124d2a&partnerId=mssecurityportal
Frame ID: A595378A08CFFE40E91198DFAE255A53
Requests: 1 HTTP requests in this frame

Frame: https://www.microsoft.com/store/buy/cartcount
Frame ID: EFF59550DE270786373A77FA4A4AFE3C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Patpoopy.A!sms&threatid=2147740958&... HTTP 302
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Behavior%3aWin32%2fPatpo... HTTP 301
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2f... Page URL

Page Statistics

38
Requests

100 %
HTTPS

62 %
IPv6

8
Domains

13
Subdomains

13
IPs

3
Countries

760 kB
Transfer

2679 kB
Size

4
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://cloudblogs.microsoft.com/microsoftsecure/?product=windows,windows-defender-advanced-threat-protection
Title: Blogs

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/help/17466/windows-defender-offline-help-protect-my-pc
Title: Microsoft Defender Offline

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/
Title: Azure

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/business/office
Title: Office 365

Search URL Search Domain Scan URL

URL: https://dynamics.microsoft.com/en-us/
Title: Dynamics 365

Search URL Search Domain Scan URL

URL: https://powerplatform.microsoft.com/en-us
Title: Power Platform

Search URL Search Domain Scan URL

URL: https://powerbi.microsoft.com/en-us/
Title: Power BI

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/microsoft-teams/group-chat-software
Title: Teams

Search URL Search Domain Scan URL

URL: https://visualstudio.microsoft.com/
Title: Visual Studio

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2026462
Title: Microsoft Advertising

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/services/cognitive-services/
Title: Azure Cognitive Services

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/
Title: Docs

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/
Title: Developer Center

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/windows
Title: Windows Dev Center

Search URL Search Domain Scan URL

URL: https://fasttrack.microsoft.com/office
Title: FastTrack

Search URL Search Domain Scan URL

URL: https://partner.microsoft.com/
Title: Partner Network

Search URL Search Domain Scan URL

URL: https://partnercenter.microsoft.com/partner/home
Title: Partner Center

Search URL Search Domain Scan URL

URL: https://appsource.microsoft.com/
Title: AppSource

Search URL Search Domain Scan URL

URL: https://azuremarketplace.microsoft.com/marketplace/
Title: Azure Marketplace

Search URL Search Domain Scan URL

URL: https://events.microsoft.com/
Title: Events

Search URL Search Domain Scan URL

URL: https://windows.microsoft.com/en-us/windows/using-defender#1TC=windows-10
Title: Windows Defender Antivirus

Search URL Search Domain Scan URL

URL: http://windows.microsoft.com/en-us/windows/using-defender#1TC=windows-10
Title: Windows Defender Antivirus

Search URL Search Domain Scan URL

URL: https://www.facebook.com/MsftWDSI/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/WDSecurity
Title:

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/
Title: Account profile

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824761&clcid=0x409
Title: Microsoft Store support

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824764&clcid=0x409
Title: Returns

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/orders
Title: Order tracking

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/academic/compare-office-365-education-plans
Title: Office 365 for schools

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/community/education/
Title: Microsoft Azure in education

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=808093
Title: AppSource

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/store/register
Title: Microsoft developer program

Search URL Search Domain Scan URL

URL: https://channel9.msdn.com/
Title: Channel 9

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/office
Title: Office Dev Center

Search URL Search Domain Scan URL

URL: https://careers.microsoft.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://news.microsoft.com/
Title: Company news

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-us
Title: Privacy at Microsoft

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/contactus
Title: Contact Microsoft

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkId=521839
Title: Privacy

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=206977
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://choice.microsoft.com/
Title: About our ads

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Patpoopy.A!sms&threatid=2147740958&enterprise=0 HTTP 302
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0 HTTP 301
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

38 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request malware-encyclopedia-description Show response
www.microsoft.com/en-us/wdsi/threats/
Redirect Chain

https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Patpoopy.A!sms&threatid=2147740958&enterprise=0
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

101 KB
23 KB

966ms
949ms

Document
text/html

2a02:26f0:eb:3aa::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:3aa::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

f79709050d49edc3f73d429185c26129546c1d453d427374d7718f7c31ddbcb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: private
content-length: 23241
content-type: text/html; charset=utf-8
content-encoding: gzip
request-context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
x-content-type-options: NOSNIFF
x-frame-options: SAMEORIGIN
date: Thu, 05 Nov 2020 06:08:31 GMT
vary: Accept-Encoding
set-cookie: ARRAffinity=5ee4a6f890e7cc89ec378006b17e98d30ac51b9ecd9e85c7e50a498fdac6ad8c;Path=/;HttpOnly;Secure;Domain=wdsi-filesubmission.trafficmanager.net ARRAffinitySameSite=5ee4a6f890e7cc89ec378006b17e98d30ac51b9ecd9e85c7e50a498fdac6ad8c;Path=/;HttpOnly;SameSite=None;Secure;Domain=wdsi-filesubmission.trafficmanager.net
tls_version: tls1.2
strict-transport-security: max-age=31536000
x-rtag: RT

Redirect headers

Content-Length: 0
Location: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
Expires: Thu, 05 Nov 2020 06:08:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 05 Nov 2020 06:08:30 GMT
Connection: keep-alive
TLS_version: UNKNOWN
X-RTag: RT

GET
H/1.1 200
OK bootstrap
securityintelligencecenter-eastus.azurewebsites.net/Content/ 94 KB
23 KB 440ms
113ms Stylesheet
text/css 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/Content/bootstrap

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

f2387f07c228c33b6a9e031fdd7ad25e4a737a2f528d6c23f3bbbc4cbaabb87c

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:30 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 21:42:01 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 22477
Expires: Thu, 04 Nov 2021 21:42:01 GMT

GET
H/1.1 200
OK jqueryui
securityintelligencecenter-eastus.azurewebsites.net/Content/ 28 KB
9 KB 425ms
98ms Stylesheet
text/css 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/Content/jqueryui

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7e9abff7ebb4effe42b7afde7bb35b7c0cfef2a9941d69650808500cbdd742fd

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:31 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 15:00:43 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 8795
Expires: Thu, 04 Nov 2021 15:00:43 GMT

GET
H2 200 mwf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/ 554 KB
67 KB 74ms
15ms Stylesheet
text/css 2a02:26f0:2b00:992::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:2b00:992::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

5d597f619952c5c0413857824efe8c368707f3e67d68ae2044e4a5eb72b76d3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: BtXM7uiDrg7XbNbyPzPyqA==
status: 200
content-length: 68034
x-ms-lease-state: available
last-modified: Wed, 04 Oct 2017 00:06:20 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D50ABBBE258E40"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
x-akamai-path-stats: [3:123634:98366]

GET
H2 200 uhf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/ 121 KB
15 KB 103ms
45ms Stylesheet
text/css 2a02:26f0:2b00:992::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/uhf-west-european-default.min.css

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:2b00:992::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

45ad5e774a5d9645fff24da7a9dba40d1ac6923519d07914be0cf215cc425e2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: s/sGZtUhhPqlwI8iRy1vYA==
status: 200
content-length: 15057
x-ms-lease-state: available
last-modified: Wed, 04 Oct 2017 00:06:30 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D50ABBC4313109"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
x-akamai-path-stats: [3:118606:35394]

GET
H/1.1 200
OK site
securityintelligencecenter-eastus.azurewebsites.net/Content/ 2 KB
2 KB 438ms
110ms Stylesheet
text/css 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/Content/site

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

16e6e27a9f4a796339c310a7eb93c36084a9ef6471f0abf7af515be97da323b8

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:31 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 21:05:49 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 768
Expires: Thu, 04 Nov 2021 21:05:49 GMT

GET
H2 200 81-e5bb90
www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/b8-7691bb/31-e2d4a2/48-fa7ad2/5c-bc39fe/11-73c86a/a7-181757/8b-a47527/ 165 KB
22 KB 55ms
51ms Stylesheet
text/css 2a02:26f0:eb:3aa::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/b8-7691bb/31-e2d4a2/48-fa7ad2/5c-bc39fe/11-73c86a/a7-181757/8b-a47527/81-e5bb90?ver=2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:3aa::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

c55b3700fa0698b9f057f40512cfd3b9d6aed620598bace734338f4f6daf7a86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 1b4ebb55c028344693980b8590beefd2
date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-10-28T18:39:53
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: 61dba4bb-b35b-4938-8a37-926e554c82ac
tls_version: tls1.2
x-s1: 2020-10-28T18:39:53
ms-cv: ZO04naT380K/kezW.0
vary: Accept-Encoding
content-length: 22268
x-xss-protection: 1; mode=block
last-modified: Wed, 28 Oct 2020 18:39:53 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-10-21T07:11:04.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30889876
timing-allow-origin: *
x-appversion: 1.0.7598.41732
expires: Thu, 28 Oct 2021 18:39:47 GMT

GET
H/1.1 200
OK override.css
statics-marketingsites-eus-ms-com.akamaized.net/statics/ 1 KB
907 B 82ms
18ms Stylesheet
text/css 2.16.186.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css?c=7
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.26 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-26.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Thu, 05 Nov 2020 06:08:31 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jun 2019 23:22:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D6EEC3A2D67C35
Vary: Accept-Encoding
Content-Type: text/css
x-ms-request-id: ad6b2b0a-f01e-0073-7eb6-407ac9000000
x-ms-version: 2009-09-19
Connection: keep-alive
Content-Length: 473

GET
H/1.1 200
OK jquery Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 584 KB
220 KB 431ms
102ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/jquery

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

68eb1b68ce12ddf4e3aec1ce64cf031a94daf13a90df876eba94ca6ce36a28eb

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:31 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 21:15:56 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Transfer-Encoding: chunked
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Expires: Thu, 04 Nov 2021 21:15:56 GMT

GET
H/1.1 200
OK jqueryui Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 0
729 B 435ms
103ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/jqueryui

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:30 GMT
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 20:55:27 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent
Content-Length: 0
Expires: Thu, 04 Nov 2021 20:55:27 GMT

GET
H/1.1 200
OK modernizr Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 11 KB
6 KB 433ms
101ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/modernizr

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:30 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 15:00:43 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 5229
Expires: Thu, 04 Nov 2021 15:00:43 GMT

GET
H/1.1 200
OK bootstrap Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 30 KB
12 KB 520ms
95ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/bootstrap

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0c477768d9d0fad3f16c9a5a43644a5d0b8556181940a8646c7901e6dc2a8279

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:31 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 20:44:51 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 11224
Expires: Thu, 04 Nov 2021 20:44:51 GMT

GET
H/1.1 200
OK site Show response
securityintelligencecenter-eastus.azurewebsites.net/bundles/ 2 KB
2 KB 530ms
95ms Script
text/javascript 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/bundles/site

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

389dbd8a2c1c1f70a9774b3cc353b2424e21d455aa2988c28d9139444790c1a5

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:30 GMT
Content-Encoding: gzip
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 04 Nov 2020 21:05:49 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Request-Context: appId=cid-v1:5f4e9a6c-0f63-4df4-b5bf-5df7206a5c64
Vary: User-Agent,Accept-Encoding
Content-Length: 1392
Expires: Thu, 04 Nov 2021 21:05:49 GMT

GET
H2 200 mwf-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/scripts/ 295 KB
68 KB 102ms
46ms Script
application/x-javascript 2a02:26f0:2b00:992::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/scripts/mwf-main.var.min.js

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:2b00:992::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

fdda94d6f04cee5097401cf9131ae9c2eb83f89f6f1def976799f161e862ee80

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: QCHr9xF2/V6zxFFEEcCTqA==
status: 200
content-length: 69465
x-ms-lease-state: available
last-modified: Wed, 04 Oct 2017 00:06:31 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D50ABBC4B1D494"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
x-akamai-path-stats: [3:124943:40057]

GET
H/1.1 200
OK meversion Show response
mem.gfx.ms/ 27 KB
10 KB 35ms
7ms Script
application/javascript 2a02:26f0:1700:181::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/meversion?partner=webframework&market=en-us

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:181::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

9a99223f2c1d4ec6099ab8f34ab0cfdc0eb2943f7c1cb3a4dd226b5a518bec1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Thu, 05 Nov 2020 06:08:31 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, no-transform, max-age=43200
X-UA-Compatible: IE=edge
Connection: keep-alive
Content-Length: 9533
Expires: Thu, 05 Nov 2020 14:00:49 GMT

GET
H2 200 wcp-consent.js Show response
wcpstatic.microsoft.com/mscc/lib/v2/ 51 KB
13 KB 31ms
12ms Script
application/javascript 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 919dca34db91911735f214ed2cff5e08f37459d94a364afb3df187baf1f77aff

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
vary: Accept-Encoding
content-md5: 1SASGSEzi1FltZlq3xaTHA==
age: 5895
x-cache: HIT
status: 200
content-length: 12802
x-ms-lease-status: unlocked
last-modified: Wed, 14 Oct 2020 22:31:33 GMT
etag: 0x8D87090E7569F4F
x-azure-ref: 035ajXwAAAABXwi9LG+u3RpI+OuCJ9LHHRlJBMzFFREdFMDkxNQAzOWI0NjE1Ny1jYjllLTQ5YjctYTY1YS04NzIyYTNmODI0ZTQ=
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3dac7e13-101e-004e-312c-b3467f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 fe-a5cf09 Show response
www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4... 130 KB
35 KB 83ms
82ms Script
text/javascript 2a02:26f0:eb:3aa::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/bb-d7480b/db-bc0148/dc-7e9864/6d-c07ea1/45-6fa1b7/23-c64e70/cd-23d3b0/6d-1e7ed0/b7-cadaa7/c4-898cf2/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/b2-7087f0/ea-1a640b/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/fe-a5cf09?ver=2.0&iife=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:3aa::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

302366c5636618a6ee2cc072b73fe6e9866bda3cafaf36a147832f80bcbdc8a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: bb6de93126d48d45a4533a23f1599fe7
date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-10-28T18:40:04
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: 2bf2b4a6-eebe-4a0a-91fe-1dd39a2494cc
tls_version: tls1.2
x-s1: 2020-10-28T18:40:04
ms-cv: vtmL6JYAVk2CR9pe.0
vary: Accept-Encoding
content-length: 34971
x-xss-protection: 1; mode=block
last-modified: Wed, 28 Oct 2020 18:40:04 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-10-21T07:11:04.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30889860
timing-allow-origin: *
x-appversion: 1.0.7598.41732
expires: Thu, 28 Oct 2021 18:39:31 GMT

GET
H/1.1 200
OK meversion Show response
mem.gfx.ms/ 27 KB
10 KB 7ms
7ms Script
application/javascript 2a02:26f0:1700:181::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/meversion?partner=MSSecurityPortal&market=en-us&uhf=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:181::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

229b4ae338f342538f022e1db1baf815929bd8e16011c7ad22defcd978e74348

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Thu, 05 Nov 2020 06:08:31 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, no-transform, max-age=43200
X-UA-Compatible: IE=edge
Connection: keep-alive
Content-Length: 9540
Expires: Thu, 05 Nov 2020 11:18:26 GMT

GET
H2 200 jsll-4.js Show response
az725175.vo.msecnd.net/scripts/ 55 KB
18 KB 32ms
8ms Script
text/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F78) /
Resource Hash: 0cd276ca60dcb0f9d19cdf696f5c75e68ba28ed9115b0171c6138cfdbad5c694

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
content-md5: 6MuJ0polBYxf+MsUfabf2Q==
age: 1480
x-cache: HIT
status: 200
content-length: 18365
x-ms-lease-status: unlocked
last-modified: Wed, 07 Oct 2020 19:06:44 GMT
server: ECAcc (frc/8F78)
etag: 0x8D86AF42210ED79
vary: Accept-Encoding
content-type: text/javascript; charset="utf-8"
x-ms-request-id: 4364405f-001e-0025-3536-b35798000000
cache-control: public, max-age=1800, immutable
x-ms-version: 2009-09-19

GET
H2 200 RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 4 KB
4 KB 63ms
16ms Image
image/png 2a02:26f0:2b00:5::5c7a:3244
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:2b00:5::5c7a:3244 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960

Security Headers

Name	Value
X-Frame-Options	deny

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-cms-cdninvalkey: am:RE1Mu3b
date: Thu, 05 Nov 2020 06:08:31 GMT
x-source-length: 4054
status: 200
x-activityid: 157c1359-7030-474a-8244-1ad30407afd5
content-location: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
x-deployment: a89a5014e89c41b7b60a64d7ee950637
content-length: 4054
last-modified: Wed, 04 Nov 2020 12:42:16 GMT
x-datacenter: NorthEU
x-frame-options: deny
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=369236
timing-allow-origin: *
expires: Mon, 09 Nov 2020 12:42:27 GMT

GET
H/1.1 200
OK 30x30_happy.png
securityintelligencecenter-eastus.azurewebsites.net/content/ 480 B
766 B 96ms
96ms Image
image/png 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/content/30x30_happy.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

e46ec8fe0d90eda8729be2a1e6d56cd65da4ee9e4851ee49d02cd0b141b9a65d

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:30 GMT
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 07 Oct 2020 18:59:08 GMT
Server: Microsoft-IIS/10.0
ETag: "02644efdb9cd61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 480

GET
H/1.1 200
OK 30x30_sad.png
securityintelligencecenter-eastus.azurewebsites.net/content/ 483 B
769 B 94ms
94ms Image
image/png 23.96.1.109
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securityintelligencecenter-eastus.azurewebsites.net/content/30x30_sad.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.1.109 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

ab427284fbe1ae77c2895c78d9da9ebcfa5eb211173c7ef9be705c4dedbc413a

Security Headers

Name	Value
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 05 Nov 2020 06:08:31 GMT
X-Content-Type-Options: NOSNIFF
Last-Modified: Wed, 07 Oct 2020 18:59:08 GMT
Server: Microsoft-IIS/10.0
ETag: "02644efdb9cd61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 483

GET
H2 200 facebook.svg
statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/ 461 B
873 B 69ms
16ms Image
image/svg+xml 2a02:26f0:2b00:5::5c7a:3249
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/facebook.svg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:2b00:5::5c7a:3249 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

1b90d623aded4efa4ac6470083fa721dee7d5619141175c7ca914d71a05da460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: f46e810c61f1dc42a49ce6e86feefdeb
date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: 8e330c49-2b94-4538-b342-b50574f390fe
ms-cv: HnxF4eWbNE26hrtl.0
content-length: 331
x-xss-protection: 1; mode=block
last-modified: Mon, 27 Jan 2020 22:08:32 GMT
server: Microsoft-IIS/10.0
x-az: {did:465c2693b8cc432da90e2d8e62cdf5bc, rid: 1, sn: mwf-wcus-prod, dt: 2020-01-24T19:22:33.7816155Z, bt: 2020-01-17T22:45:44.0000000Z}
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=7142248
x-appversion: 1.0.7321.40972
expires: Tue, 26 Jan 2021 22:05:59 GMT

GET
H2 200 twitter.svg
statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/ 831 B
1010 B 70ms
17ms Image
image/svg+xml 2a02:26f0:2b00:5::5c7a:3249
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/twitter.svg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:2b00:5::5c7a:3249 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

f4d21dc6a3bc75e851bccd0b7faab2f09930184e3b112a6feba5cecb0c6c13c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 10bb88c99e3b4545aa3c4e533fa135c7
date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: 15a1e846-aeb1-47d0-891b-4af22b68294a
ms-cv: xH7Fy1u9lEmKK3D6.0
content-length: 468
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Feb 2020 21:14:55 GMT
server: Microsoft-IIS/10.0
x-az: {did:465c2693b8cc432da90e2d8e62cdf5bc, rid: 2, sn: mwf-wcus-prod, dt: 2020-02-27T18:54:37.0756220Z, bt: 2020-02-19T00:12:08.0000000Z}
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=9817584
x-appversion: 1.0.7354.364
expires: Fri, 26 Feb 2021 21:14:55 GMT

GET
H2 200 rss.svg
statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/ 554 B
892 B 70ms
17ms Image
image/svg+xml 2a02:26f0:2b00:5::5c7a:3249
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://statics-mwf-wcus-ms-com.akamaized.net/_h/mwfhash2/mwf.app/images/components/social/rss.svg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:2b00:5::5c7a:3249 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

1046d9a67d0b1c6dbfa1debafd073d74e8a6f16fa20bdb4b71008d4484f880d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: e6b77389aea7dc45aa6cd1d70458775e
date: Thu, 05 Nov 2020 06:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: b4d375ee-a818-4c42-9523-df03cadad1f9
ms-cv: lCNeyYxZXkO7bZrH.0
content-length: 350
x-xss-protection: 1; mode=block
last-modified: Tue, 17 Dec 2019 13:11:48 GMT
server: Microsoft-IIS/10.0
x-az: {did:465c2693b8cc432da90e2d8e62cdf5bc, rid: 2, sn: mwf-wcus-prod, dt: 2019-12-17T10:55:14.4717644Z, bt: 2019-11-14T00:13:40.0000000Z}
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=3567728
x-appversion: 1.0.7257.410
expires: Wed, 16 Dec 2020 13:10:39 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 33 KB
34 KB 102ms
16ms Font
font/woff2 2a02:26f0:2b00:995::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:2b00:995::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 06:08:31 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "588d483e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=471843
accept-ranges: bytes
content-length: 34052
expires: Tue, 10 Nov 2020 17:12:34 GMT

GET
H/1.1 200
OK t.js Show response
web.vortex.data.microsoft.com/collect/v1/ 281 B
966 B 124ms
28ms Script
application/javascript 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272020-11-05T06%3A08%3A31.894Z%27&os=%27MacOS%27&appId=%27JS%3AWDSI-Prod%27&-ver=%271.0%27&-impressionGuid=%27318bcea3-d391-4238-91c9-78d20974f218%27&-pageName=%27malware-encyclopedia-description%27&-uri=%27https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fwdsi%2Fthreats%2Fmalware-encyclopedia-description%3Fname%3DBehavior%253aWin32%252fPatpoopy.A!sms%26threatid%3D2147740958%26enterprise%3D0%27&-market=%27en-us%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22metaTags%22%3A%7B%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27Behavior%3AWin32%2FPatpoopy.A!sms%20threat%20description%20-%20Microsoft%20Security%20Intelligence%27&*isLoggedIn=false&*flashInstalled=false&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.3.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false

Requested by

Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d67ffeba83cd875559e1d0a5e055d4de007013d08bb91ffbb1e2091a6465e0ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 Nov 2020 06:08:31 GMT
X-Content-Type-Options: nosniff
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control: no-cache, no-store
MS-CV: J1weWsx/gkGWeFCbBvCoFg.0
Content-Type: application/javascript
Content-Length: 281
Expires: 0

GET
H2 200 mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 26 KB
26 KB 20ms
19ms Font
application/font-woff 2a02:26f0:eb:3aa::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/b8-7691bb/31-e2d4a2/48-fa7ad2/5c-bc39fe/11-73c86a/a7-181757/8b-a47527/81-e5bb90?ver=2.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:3aa::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/b8-7691bb/31-e2d4a2/48-fa7ad2/5c-bc39fe/11-73c86a/a7-181757/8b-a47527/81-e5bb90?ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 0476eb224d023a458ecd8866b33647d4
date: Thu, 05 Nov 2020 06:08:31 GMT
x-content-type-options: nosniff
x-rtag: RT
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: 97e1ab01-31b2-4a7b-a891-772f447fda79
tls_version: tls1.2
ms-cv: 5fKbKaUGfUCqBeI/.0
content-length: 26288
x-xss-protection: 1; mode=block
last-modified: Thu, 24 Sep 2020 17:24:41 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-09-06T04:38:08.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=27947770
x-appversion: 1.0.7553.37144
expires: Fri, 24 Sep 2021 17:24:41 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ 29 KB
29 KB 54ms
33ms Font
font/woff2 2a02:26f0:2b00:995::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:2b00:995::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 06:08:31 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "5b68d583e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=122432
accept-ranges: bytes
content-length: 29388
expires: Fri, 06 Nov 2020 16:09:03 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/ 27 KB
27 KB 16ms
16ms Font
font/woff2 2a02:26f0:2b00:995::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:2b00:995::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 06:08:31 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "1282d283e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=510174
accept-ranges: bytes
content-length: 27168
expires: Wed, 11 Nov 2020 03:51:25 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 29 KB
30 KB 16ms
16ms Font
font/woff2 2a02:26f0:2b00:995::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:2b00:995::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.1/css/mwf-west-european-default.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 05 Nov 2020 06:08:32 GMT
last-modified: Fri, 10 Jan 2020 19:09:42 GMT
etag: "83cce83e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=510294
accept-ranges: bytes
content-length: 30132
expires: Wed, 11 Nov 2020 03:53:26 GMT

GET
H/1.1 200
OK meBoot.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20266.2/en-US/ 147 KB
30 KB 25ms
7ms Script
application/javascript 2a02:26f0:1700:181::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20266.2/en-US/meBoot.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurityPortal&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:181::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

8516e9c40b16e366b7cd1f2fc8aba22bf8bd3438e75dfb4039d58646f4ffc8c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Oct 2020 03:45:56 GMT
Date: Thu, 05 Nov 2020 06:08:32 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30129
X-UA-Compatible: IE=edge

GET
DATA 200
OK truncated
/ 358 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 30ms
30ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D346f186814164da4a697ccdf17725214%26HASH%3D346f%26LV%3D202011%26V%3D4%26LU%3D1604556512006%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H2 200 me.srf
login.live.com/ Frame A595 0
0 289ms
99ms Document
text/html 40.90.137.124
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=d50b9ff2-934e-4817-d397-8dcd49124d2a&partnerId=mssecurityportal

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.20266.2/en-US/meBoot.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.90.137.124 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: login.live.com
:scheme: https
:path: /me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=d50b9ff2-934e-4817-d397-8dcd49124d2a&partnerId=mssecurityportal
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: Thu, 05 Nov 2020 06:07:32 GMT
vary: Accept-Encoding
server: Microsoft-IIS/10.0
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
set-cookie: uaid=d50b9ff2934e4817d3978dcd49124d2a; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly MSPRequ=id=N&lt=1604556512&co=1; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly
referrer-policy: strict-origin-when-cross-origin
x-ms-request-id: f28ccd3d-dc47-4d73-bb09-15ba727812ba
ppserver: PPV: 30 H: BL02PF832E0F339 V: 0
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
date: Thu, 05 Nov 2020 06:08:32 GMT
content-length: 4326

GET
H/1.1 200
OK meCore.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20266.2/en-US/ 100 KB
17 KB 7ms
7ms Script
application/javascript 2a02:26f0:1700:181::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20266.2/en-US/meCore.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurityPortal&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:181::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

c6e2bb9d0657c4b07543257b8a8c028e3626a348537728b34ee8ad5d5db28a83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 06 Oct 2020 03:46:00 GMT
Date: Thu, 05 Nov 2020 06:08:32 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17034
X-UA-Compatible: IE=edge

GET
H2 200 cartcount Show response
www.microsoft.com/store/buy/ Frame EFF5 1 KB
1 KB 20ms
20ms Document
text/html 2a02:26f0:eb:3aa::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/store/buy/cartcount

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/bb-d7480b/db-bc0148/dc-7e9864/6d-c07ea1/45-6fa1b7/23-c64e70/cd-23d3b0/6d-1e7ed0/b7-cadaa7/c4-898cf2/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/b2-7087f0/ea-1a640b/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/fe-a5cf09?ver=2.0&iife=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:3aa::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

68d929a10c3cd609b936b50a541533994b044b38558a33530ff45d1b420cc07e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /store/buy/cartcount
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: MC1=GUID=346f186814164da4a697ccdf17725214&HASH=346f&LV=202011&V=4&LU=1604556512006; MS0=6e99a1d8d95a406a8300b95058faae18; MSFPC=GUID=346f186814164da4a697ccdf17725214&HASH=346f&LV=202011&V=4&LU=1604556512006; MSCC=NR
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0

Response headers

status: 200
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
x-activity-id: b84634ee-466f-410d-931c-194e4ec2e063
ms-cv: Qj3dnGLqHEy3dxZR.0
x-appversion: 1.0.7593.1255
x-az: {did:9a8cd53207774949b337f7edab013e9f, rid: 21, sn: storeexp-neu-prod, dt: 2020-10-06T23:22:57.3380689Z, bt: 2020-10-15T00:41:50.0000000Z}
ms-operation-id: 4bfda7ea51a9844498881cef54ebd6de
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-content-type-options: nosniff
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
x-xss-protection: 1; mode=block
content-length: 489
cache-control: max-age=75215
expires: Fri, 06 Nov 2020 03:02:07 GMT
date: Thu, 05 Nov 2020 06:08:32 GMT
vary: Accept-Encoding
tls_version: tls1.2
strict-transport-security: max-age=31536000
x-rtag: Str

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 33ms
32ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D346f186814164da4a697ccdf17725214%26HASH%3D346f%26LV%3D202011%26V%3D4%26LU%3D1604556512006%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 54ms
28ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D346f186814164da4a697ccdf17725214%26HASH%3D346f%26LV%3D202011%26V%3D4%26LU%3D1604556512006%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Behavior%3aWin32%2fPatpoopy.A!sms&threatid=2147740958&enterprise=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.microsoft.com/	1970-01-19 13:44:02	Name: MSCC Value: NR
www.microsoft.com/	1970-01-19 22:28:12	Name: MSFPC Value: GUID=346f186814164da4a697ccdf17725214&HASH=346f&LV=202011&V=4&LU=1604556512006
.microsoft.com/	1970-01-19 13:42:38	Name: MS0 Value: 6e99a1d8d95a406a8300b95058faae18
.microsoft.com/	1970-01-19 22:28:12	Name: MC1 Value: GUID=346f186814164da4a697ccdf17725214&HASH=346f&LV=202011&V=4&LU=1604556512006

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.onestore.ms
az725175.vo.msecnd.net
c.s-microsoft.com
go.microsoft.com
img-prod-cms-rt-microsoft-com.akamaized.net
login.live.com
mem.gfx.ms
securityintelligencecenter-eastus.azurewebsites.net
statics-marketingsites-eus-ms-com.akamaized.net
statics-mwf-wcus-ms-com.akamaized.net
wcpstatic.microsoft.com
web.vortex.data.microsoft.com
www.microsoft.com
152.199.19.160
2.16.186.26
23.96.1.109
2620:1ec:bdf::10
2a02:26f0:1700:181::37
2a02:26f0:2b00:5::5c7a:3244
2a02:26f0:2b00:5::5c7a:3249
2a02:26f0:2b00:992::2957
2a02:26f0:2b00:995::356e
2a02:26f0:eb:3aa::356e
2a02:26f0:eb:3b3::2c1a
40.77.226.250
40.90.137.124
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
0c477768d9d0fad3f16c9a5a43644a5d0b8556181940a8646c7901e6dc2a8279
0cd276ca60dcb0f9d19cdf696f5c75e68ba28ed9115b0171c6138cfdbad5c694
0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba
1046d9a67d0b1c6dbfa1debafd073d74e8a6f16fa20bdb4b71008d4484f880d3
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
16e6e27a9f4a796339c310a7eb93c36084a9ef6471f0abf7af515be97da323b8
1b90d623aded4efa4ac6470083fa721dee7d5619141175c7ca914d71a05da460
229b4ae338f342538f022e1db1baf815929bd8e16011c7ad22defcd978e74348
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
302366c5636618a6ee2cc072b73fe6e9866bda3cafaf36a147832f80bcbdc8a9
389dbd8a2c1c1f70a9774b3cc353b2424e21d455aa2988c28d9139444790c1a5
45ad5e774a5d9645fff24da7a9dba40d1ac6923519d07914be0cf215cc425e2f
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
5d597f619952c5c0413857824efe8c368707f3e67d68ae2044e4a5eb72b76d3d
68d929a10c3cd609b936b50a541533994b044b38558a33530ff45d1b420cc07e
68eb1b68ce12ddf4e3aec1ce64cf031a94daf13a90df876eba94ca6ce36a28eb
7e9abff7ebb4effe42b7afde7bb35b7c0cfef2a9941d69650808500cbdd742fd
8516e9c40b16e366b7cd1f2fc8aba22bf8bd3438e75dfb4039d58646f4ffc8c6
919dca34db91911735f214ed2cff5e08f37459d94a364afb3df187baf1f77aff
9a99223f2c1d4ec6099ab8f34ab0cfdc0eb2943f7c1cb3a4dd226b5a518bec1f
ab427284fbe1ae77c2895c78d9da9ebcfa5eb211173c7ef9be705c4dedbc413a
c55b3700fa0698b9f057f40512cfd3b9d6aed620598bace734338f4f6daf7a86
c6e2bb9d0657c4b07543257b8a8c028e3626a348537728b34ee8ad5d5db28a83
d67ffeba83cd875559e1d0a5e055d4de007013d08bb91ffbb1e2091a6465e0ed
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e46ec8fe0d90eda8729be2a1e6d56cd65da4ee9e4851ee49d02cd0b141b9a65d
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b
f2387f07c228c33b6a9e031fdd7ad25e4a737a2f528d6c23f3bbbc4cbaabb87c
f4d21dc6a3bc75e851bccd0b7faab2f09930184e3b112a6feba5cecb0c6c13c0
f79709050d49edc3f73d429185c26129546c1d453d427374d7718f7c31ddbcb7
fdda94d6f04cee5097401cf9131ae9c2eb83f89f6f1def976799f161e862ee80
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

www.microsoft.com Open in urlscan Pro 2a02:26f0:eb:3aa::356e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

38 Requests

100 %HTTPS

62 %IPv6

8 Domains

13 Subdomains

13 IPs

3 Countries

760 kBTransfer

2679 kBSize

4 Cookies

41 Outgoing links

Page URL History

Redirected requests

38 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.microsoft.com Open in urlscan Pro
2a02:26f0:eb:3aa::356e Public Scan

Screenshot
Live screenshot

Full Image

38
Requests

100 %
HTTPS

62 %
IPv6

8
Domains

13
Subdomains

13
IPs

3
Countries

760 kB
Transfer

2679 kB
Size

4
Cookies

38 HTTP transactions
1 data transactions