blog.yoroi.company Open in urlscan Pro
192.0.78.217 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Submission: On July 23 via api (July 23rd 2019, 5:42:48 pm UTC) from CH

Summary HTTP 75 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 16 IPs in 3 countries across 10 domains to perform 75 HTTP transactions. The main IP is 192.0.78.217, located in San Francisco, United States and belongs to AUTOMATTIC - Automattic, Inc, US. The main domain is blog.yoroi.company.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 3rd 2019. Valid for: 3 months.

This is the only time blog.yoroi.company was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	192.0.78.217 192.0.78.217	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
13	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
2	2a00:1450:400... 2a00:1450:4001:81a::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
7	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
3	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
2	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
3	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
2	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
4	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER - Twitter Inc.)
75	16

19 192.0.78.217 (San Francisco, United States) 1 redirects

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

blog.yoroi.company	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

lh3.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lh4.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

lh5.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lh6.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: i1.wp.com

i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.136 (United States)

ASN13414 (TWITTER - Twitter Inc., US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	wp.com c0.wp.com i1.wp.com Failed i2.wp.com s0.wp.com stats.wp.com Failed widgets.wp.com pixel.wp.com	114 KB
19	yoroi.company 1 redirects blog.yoroi.company www.yoroi.company Failed	478 KB
13	googleusercontent.com lh3.googleusercontent.com lh5.googleusercontent.com lh4.googleusercontent.com lh6.googleusercontent.com	3 MB
8	twitter.com platform.twitter.com syndication.twitter.com	211 KB
4	twimg.com cdn.syndication.twimg.com pbs.twimg.com	24 KB
3	gravatar.com secure.gravatar.com	9 KB
2	gstatic.com fonts.gstatic.com	18 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	googleapis.com fonts.googleapis.com	2 KB
1	facebook.com graph.facebook.com	568 B
75	10

	Domain	Requested by
19	blog.yoroi.company	1 redirects blog.yoroi.company
13	c0.wp.com	blog.yoroi.company
6	platform.twitter.com	c0.wp.com platform.twitter.com
5	lh3.googleusercontent.com	blog.yoroi.company
3	pbs.twimg.com	blog.yoroi.company
3	secure.gravatar.com	blog.yoroi.company
3	i2.wp.com	blog.yoroi.company
3	lh6.googleusercontent.com	blog.yoroi.company
3	lh5.googleusercontent.com	blog.yoroi.company
2	syndication.twitter.com	blog.yoroi.company
2	fonts.gstatic.com	blog.yoroi.company
2	www.google-analytics.com	blog.yoroi.company
2	lh4.googleusercontent.com	blog.yoroi.company
2	fonts.googleapis.com	blog.yoroi.company
1	cdn.syndication.twimg.com	platform.twitter.com
1	pixel.wp.com	blog.yoroi.company
1	graph.facebook.com	blog.yoroi.company
1	widgets.wp.com	blog.yoroi.company
1	s0.wp.com	blog.yoroi.company
0	stats.wp.com Failed	blog.yoroi.company
0	i1.wp.com Failed	blog.yoroi.company
0	www.yoroi.company Failed	blog.yoroi.company
75	22

This site contains links to these domains. Also see Links.

Domain
www.yoroi.company
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
www.fortinet.com

Subject Issuer	Validity	Valid
tls.automattic.com Let's Encrypt Authority X3	`2019-06-03` - `2019-09-01`	3 months	crt.sh
*.wp.com Go Daddy Secure Certificate Authority - G2	`2018-04-10` - `2020-05-11`	2 years	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.googleusercontent.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.gravatar.com COMODO RSA Domain Validation Secure Server CA	`2018-09-06` - `2020-09-05`	2 years	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2018-11-19` - `2019-11-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-06-06` - `2019-09-04`	3 months	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-01-24` - `2020-01-24`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Frame ID: 5044619F5B94A8E0008A423368928517
Requests: 70 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=201930
Frame ID: 48EB2C6FE716B7FD0A2907B37EB8739B
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.940e1bc455d9af25d6ec2f14e90d0d6c.html?origin=https%3A%2F%2Fblog.yoroi.company
Frame ID: 783899100E2AA256ECC17AEDFA0AC3C0
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/css/timeline.92bbf95324b5eb65091906e99a889eb3.light.ltr.css
Frame ID: 54D039014993DB32B12DD07BC168D398
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain HTTP 301
https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

75
Requests

96 %
HTTPS

60 %
IPv6

10
Domains

22
Subdomains

16
IPs

3
Countries

4282 kB
Transfer

5475 kB
Size

0
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.yoroi.company/index.html

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/threat-intelligence.html
Title: Threat Intelligence

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/defence-center.html
Title: Defence Center

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/about-us.html
Title: About us

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/partners.html
Title: Partners

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/the-group.html
Title: The Group

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/
Title: Home

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/news.html
Title: News

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/download.html
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/career.html
Title: Career

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/contact.html
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.facebook.com/weareyoroi/

Search URL Search Domain Scan URL

URL: https://twitter.com/yoroisecurity

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCb3woWzGtRO8tYHHpje3AMA

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/yoroi

Search URL Search Domain Scan URL

URL: https://www.fortinet.com/blog/threat-research/-net-rat-malware-being-spread-by-ms-word-documents.html
Title: Nanocore

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/privacy-it.html#cookieManager
Title: qui

Search URL Search Domain Scan URL

URL: https://www.yoroi.company/privacy-it.html
Title: privacy policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain HTTP 301
https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

75 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Redirect Chain

https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain
https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

61 KB
17 KB

311ms
311ms

Document
text/html

192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

af45301d5f88d9044de32fba300a1e6e9b3aa1cf2bdfff36525bbf3c12eacb4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

:method: GET
:authority: blog.yoroi.company
:scheme: https
:path: /research/dissecting-nanocore-crimeware-attack-chain/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
server: nginx
date: Tue, 23 Jul 2019 17:42:13 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=86400
vary: Accept-Encoding Cookie
x-pingback: https://blog.yoroi.company/xmlrpc.php
link: <https://blog.yoroi.company/wp-json/>; rel="https://api.w.org/" <https://wp.me/pagkQt-Uf>; rel=shortlink
content-encoding: gzip
x-ac: 5.ams _atomic_dca

Redirect headers

status: 301
server: nginx
date: Tue, 23 Jul 2019 17:42:13 GMT
content-type: text/html; charset=UTF-8
location: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
strict-transport-security: max-age=86400
vary: Cookie
x-pingback: https://blog.yoroi.company/xmlrpc.php
x-redirect-by: WordPress
x-ac: 5.ams _atomic_dca

GET
H2 200 style.min.css
c0.wp.com/c/5.2.2/wp-includes/css/dist/block-library/ 29 KB
4 KB 1546ms
25ms Stylesheet
text/css 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.2.2/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Mon, 22 Apr 2019 12:40:04 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 all.min.css
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/ 45 KB
10 KB 242ms
241ms Stylesheet
text/css 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

d98121a51ed3f911f519cf42be28225dc26b4c9d61cfab0a580118e5c3447463

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:13 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-b296"
vary: Accept-Encoding
content-type: text/css
status: 200
x-ac: 5.ams _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 css
fonts.googleapis.com/ 10 KB
1 KB 28ms
16ms Stylesheet
text/css 2a00:1450:4001:81a::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Oswald%3A400%2C500%2C600%2C700%7CRoboto%3A100%2C400%2C500%2C600%2C700&subset=latin%2Clatin-ext

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

42261e5d96f277f102752532e2b45bcc7d09fcfae3cdf6c1e42ff6ce2d7707d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Origin: https://blog.yoroi.company

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 23 Jul 2019 17:42:13 GMT
server: ESF
access-control-allow-origin: *
date: Tue, 23 Jul 2019 17:42:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Tue, 23 Jul 2019 17:42:13 GMT

GET
H2 200 jquery.sidr.dark.min.css
blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/css/ 3 KB
1 KB 241ms
239ms Stylesheet
text/css 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/css/jquery.sidr.dark.min.css?ver=2.2.1

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

bd8b0c2e9c07473382c21f9f245c7a24433c3a100eed41e6e0695d23942b0e4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:13 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-d8d"
vary: Accept-Encoding
content-type: text/css
status: 200
x-ac: 5.ams _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 slick.min.css
blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/ 1 KB
525 B 241ms
240ms Stylesheet
text/css 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/slick.min.css?ver=1.5.9

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

066e006e482ee3cfd76f37618f99ecad50eed1c9df36841d177f6218cfb38874

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:13 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-4fd"
vary: Accept-Encoding
content-type: text/css
status: 200
x-ac: 5.ams _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 style.css
blog.yoroi.company/wp-content/themes/start-magazine/ 106 KB
19 KB 245ms
243ms Stylesheet
text/css 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/style.css?ver=1.0.0

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

41e7c6de1addd5d7f787b6edbcf89d9aa47ab057c3a84165574a8418f16f91fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:13 GMT
content-encoding: gzip
last-modified: Fri, 28 Sep 2018 12:20:27 GMT
server: nginx
etag: W/"5bae1c8b-1a983"
vary: Accept-Encoding
content-type: text/css
status: 200
x-ac: 5.ams _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 EnlighterJS.min.css
blog.yoroi.company/wp-content/plugins/enlighter/resources/ 36 KB
6 KB 244ms
242ms Stylesheet
text/css 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/plugins/enlighter/resources/EnlighterJS.min.css?ver=3.10.0

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:13 GMT
content-encoding: gzip
last-modified: Mon, 29 Apr 2019 16:04:52 GMT
server: nginx
etag: W/"5cc720a4-8f0d"
vary: Accept-Encoding
content-type: text/css
status: 200
x-ac: 5.ams _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 social-logos.min.css
c0.wp.com/p/jetpack/7.5.3/_inc/social-logos/ 26 KB
19 KB 1545ms
24ms Stylesheet
text/css 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/_inc/social-logos/social-logos.min.css

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Wed, 27 Jun 2018 01:03:44 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/7.5.3/css/ 70 KB
12 KB 1547ms
26ms Stylesheet
text/css 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/css/jetpack.css

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ca98f67f4ee42fbc2ddb637f9dbabcc48ac6885bc72f79beccb6ab3285931ff1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Fri, 21 Jun 2019 10:15:39 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 jquery.js Show response
c0.wp.com/c/5.2.2/wp-includes/js/jquery/ 95 KB
32 KB 1548ms
28ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.2.2/wp-includes/js/jquery/jquery.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Fri, 17 May 2019 17:08:53 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/5.2.2/wp-includes/js/jquery/ 10 KB
4 KB 1549ms
29ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.2.2/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Fri, 20 May 2016 06:11:28 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 postmessage.min.js Show response
c0.wp.com/p/jetpack/7.5.3/_inc/build/ 9 KB
4 KB 1547ms
27ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/_inc/build/postmessage.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 jquery.jetpack-resize.min.js Show response
c0.wp.com/p/jetpack/7.5.3/_inc/build/ 3 KB
1022 B 1549ms
28ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/_inc/build/jquery.jetpack-resize.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 yoroi-min.js Show response
blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/ 807 KB
222 KB 338ms
337ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

3e7a865c8b50bd82db738bff39cedf40d887afc1f5bf8c9ea4c519b6826e5cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:13 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-c9a99"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 5.ams _atomic_dca
strict-transport-security: max-age=86400

GET logo_white.svg
www.yoroi.company/images/ 0
0

GET vllsvxpvhtkhwkjhngpnnlwhhpkhuxgv.jpg
i1.wp.com/blog.yoroi.company/wp-content/uploads/2019/06/ 0
0

GET
H2 200 wp-emoji-release.min.js Show response
blog.yoroi.company/wp-includes/js/ 14 KB
5 KB 181ms
180ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-includes/js/wp-emoji-release.min.js?ver=5.2.2

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
content-encoding: gzip
last-modified: Mon, 08 Apr 2019 05:22:51 GMT
server: nginx
etag: W/"5caadaab-3610"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 PbezSnvp3Tt_QMseVGuOiELbQyR8zrvqySSv_Jrh_Rrm-msykp8TxnDL2A2kQHuLBThiAzZiqCeShtcLwfwvjWFgqf5YuTgaBxPuPRTZHBDKFsIHST2Zc7pdv3NwW8QxlUM08dA
lh3.googleusercontent.com/ 15 KB
15 KB 38ms
6ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/PbezSnvp3Tt_QMseVGuOiELbQyR8zrvqySSv_Jrh_Rrm-msykp8TxnDL2A2kQHuLBThiAzZiqCeShtcLwfwvjWFgqf5YuTgaBxPuPRTZHBDKFsIHST2Zc7pdv3NwW8QxlUM08dA

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

f5053d80653018c35e52d0ee6bd2fcf89ed15963d8e2e5d4afd3ae7d36106721

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7831
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 15262
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 ZYhlCIMpVb_Pm5lK5VTORtA80XHHUMsZa6zb4EF6mRWQPulJtaCuG2fKhS0PjLgYcGfSrJOShQ2ThujI6SkYr3GbI-eFlZlyiqC1h7bZzZyaVozYj1yXf7BVuqbOKwUWCg2g_3s
lh5.googleusercontent.com/ 196 KB
196 KB 103ms
8ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/ZYhlCIMpVb_Pm5lK5VTORtA80XHHUMsZa6zb4EF6mRWQPulJtaCuG2fKhS0PjLgYcGfSrJOShQ2ThujI6SkYr3GbI-eFlZlyiqC1h7bZzZyaVozYj1yXf7BVuqbOKwUWCg2g_3s

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

12da5d5092e093b7813df6018d3005ed8c7e3ccdb4ab123b82d12f8d236c61d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 16:21:47 GMT
x-content-type-options: nosniff
age: 4828
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 200280
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 YlKMH5MJVKcp7HPyPMImL8UqGW6WLrdHAoVosCZ9Y86ufriRxrAwf6GevPczc5iJGUu2i839aUQXzt7s09W_sUGZNUAa1yRU_NbqIsGdKWF3rpw7UVAQafZbkE2V-C05W0EScMo
lh3.googleusercontent.com/ 849 KB
849 KB 23ms
9ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/YlKMH5MJVKcp7HPyPMImL8UqGW6WLrdHAoVosCZ9Y86ufriRxrAwf6GevPczc5iJGUu2i839aUQXzt7s09W_sUGZNUAa1yRU_NbqIsGdKWF3rpw7UVAQafZbkE2V-C05W0EScMo

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

41d39d1daa9f0c15de6173a70df2ff1eb9857a89221ee6d9e750af41a478c511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7831
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 869118
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 5H98n9Waddy3dO1tY1ZRVyafkjbsuipnPQaV36U49Re8Fv0ijHxXkS-_eL0o26uLjluChYe_vsMtPtTOYF5az1knCvG-C4_La3bey6FsdpPa6-9WzEUWPEcFO1kDiL3h03MN-fk
lh4.googleusercontent.com/ 49 KB
50 KB 73ms
9ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh4.googleusercontent.com/5H98n9Waddy3dO1tY1ZRVyafkjbsuipnPQaV36U49Re8Fv0ijHxXkS-_eL0o26uLjluChYe_vsMtPtTOYF5az1knCvG-C4_La3bey6FsdpPa6-9WzEUWPEcFO1kDiL3h03MN-fk

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

ef76ad8af121092ad68342827b1890d107262fcc45b28e25501b3bc890c1cb63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:01:28 GMT
x-content-type-options: nosniff
age: 9647
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 50589
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 _kQAINE3ldA2ME68VwAnIU2wNAhqF6Apidm1ynTqqHE4p9zI8981J2gtWRuXj0mCGC0LCi9z5A0V1F8Y3HEu-NG6I4eqmGhiSgsd9nxZFIywTMvV_d9DrB4IlMhQn2uT4P02cZw
lh3.googleusercontent.com/ 46 KB
46 KB 21ms
20ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/_kQAINE3ldA2ME68VwAnIU2wNAhqF6Apidm1ynTqqHE4p9zI8981J2gtWRuXj0mCGC0LCi9z5A0V1F8Y3HEu-NG6I4eqmGhiSgsd9nxZFIywTMvV_d9DrB4IlMhQn2uT4P02cZw

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

f655dece6102377f79e507dff8a5805760a888b9d89de59e41850ba4cdf39e56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7831
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 47019
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 b6Qu1nMaVv7k1zPEexaUvI1s4x8rIgWVm8i6kqgbdJ7BVnOumH4h3WE4m7268w-Z_mpFfIiC0h32dfC8NmUhbV8R2aErysspUe6yvk3GnrKhRQa0bydQIEJBsDfP3NNAseXv-cA
lh3.googleusercontent.com/ 165 KB
165 KB 22ms
22ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/b6Qu1nMaVv7k1zPEexaUvI1s4x8rIgWVm8i6kqgbdJ7BVnOumH4h3WE4m7268w-Z_mpFfIiC0h32dfC8NmUhbV8R2aErysspUe6yvk3GnrKhRQa0bydQIEJBsDfP3NNAseXv-cA

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

27fe43613f7d72d4cc0acff04c82c1b0954625d968985ddef59ac5e35d4eebdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7831
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 168700
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 heF1wVeCskDhJatqJXO2RbxZcG4SVc54vRcSCPxg2kb5AIMacovDK1z83lcQ4HsCCK9IlqRCqCT4eTUjj6hU9DZKVV4mWYYRq65aJbMqgHuyEdE7npEpYP8CogTvHame6u4RQ7I
lh5.googleusercontent.com/ 16 KB
16 KB 89ms
17ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/heF1wVeCskDhJatqJXO2RbxZcG4SVc54vRcSCPxg2kb5AIMacovDK1z83lcQ4HsCCK9IlqRCqCT4eTUjj6hU9DZKVV4mWYYRq65aJbMqgHuyEdE7npEpYP8CogTvHame6u4RQ7I

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

73a57bbd2ee125b49c1dea67012fc3f7ba9e71347e4e142572834ef9b3024932

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 16:21:47 GMT
x-content-type-options: nosniff
age: 4828
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 16505
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 eZlE584lP_nxFrx6nbaD6w5almi0oCdGPI7HU6BFMXfXkYmwxk-e8YShaNzYaua1tcRfHfowEMAfw_1KRyCVaC0NXqSu85O56cI-iI6NhpEBaK_PGammJfyXbD_j7b0uc29cBzQ
lh5.googleusercontent.com/ 16 KB
16 KB 49ms
7ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/eZlE584lP_nxFrx6nbaD6w5almi0oCdGPI7HU6BFMXfXkYmwxk-e8YShaNzYaua1tcRfHfowEMAfw_1KRyCVaC0NXqSu85O56cI-iI6NhpEBaK_PGammJfyXbD_j7b0uc29cBzQ

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

20c16b40678ad3b219c875b73a714c5b8e7ef40d80e113d939d949b49d1e8fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 16:21:47 GMT
x-content-type-options: nosniff
age: 4828
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 16097
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 WIwOe0mizkC3dtwFck4vVC9AXnI8lUqouR9OyXSJnHQwXUW8d4yiR7nsRQYV5qZmI0wp9bUyY4y0bTmjuqxhb5T9rqyqufm4EvHJHj1vqE1Q9VKXJ0TD88yAR8VN9d8gGKl8VDg
lh4.googleusercontent.com/ 93 KB
94 KB 56ms
7ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh4.googleusercontent.com/WIwOe0mizkC3dtwFck4vVC9AXnI8lUqouR9OyXSJnHQwXUW8d4yiR7nsRQYV5qZmI0wp9bUyY4y0bTmjuqxhb5T9rqyqufm4EvHJHj1vqE1Q9VKXJ0TD88yAR8VN9d8gGKl8VDg

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

e271944b34afc94fbd81d6ad584c455fa62faa743e38c1502aa94b4c6fd3f1f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:01:28 GMT
x-content-type-options: nosniff
age: 9647
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 95449
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 0ODM_BHfWVnhGyAJbUjYgGXraSdBf3jBjap9Ew0hPw-9zAHsq_p6AKT_TaHPi5YlQp5Q3qY_hjy9gf2dw-WrjEQXguHlDqtw8CRrApFvw1Oxhp1uKZUyPwqyo6Z0a_YBaMHAQcY
lh6.googleusercontent.com/ 28 KB
28 KB 1289ms
7ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh6.googleusercontent.com/0ODM_BHfWVnhGyAJbUjYgGXraSdBf3jBjap9Ew0hPw-9zAHsq_p6AKT_TaHPi5YlQp5Q3qY_hjy9gf2dw-WrjEQXguHlDqtw8CRrApFvw1Oxhp1uKZUyPwqyo6Z0a_YBaMHAQcY

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d84cb13f102ae9028a454625d547cb4e20b32a3b4306721c13ddc40a8f94bde7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7832
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 28770
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 PzRNH1j9wHUDP9UCc2ONOQ_q-AMb5KCV4vsywMuglZCxW9oknJBwpe03Svwr_q4-Js81qrUOoahi4bemX9TW2NH8aDjI8sZ-x7dhqMadHKkE8NIu7LVLlRnOQK7PWIAr-5-XIPQ
lh6.googleusercontent.com/ 835 KB
836 KB 1288ms
26ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh6.googleusercontent.com/PzRNH1j9wHUDP9UCc2ONOQ_q-AMb5KCV4vsywMuglZCxW9oknJBwpe03Svwr_q4-Js81qrUOoahi4bemX9TW2NH8aDjI8sZ-x7dhqMadHKkE8NIu7LVLlRnOQK7PWIAr-5-XIPQ

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

601778f6b3efabdbf5e673ea17bbb960e0c6cb97461d6991b105591841908af2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7832
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 855534
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 RMZOfxnhFrHkVyo8GgPMcbgLToUJ3Q7UWUb6iA213ZnTZCj3A41lsjFqamwPkWqu_NAnpoVLGCqA6xrWV36Ni4JM1ETGkL3WX09eO7w8J8NvfHurX1MOkiEvxAWIruTqxZVxO3k
lh6.googleusercontent.com/ 552 KB
552 KB 1263ms
12ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh6.googleusercontent.com/RMZOfxnhFrHkVyo8GgPMcbgLToUJ3Q7UWUb6iA213ZnTZCj3A41lsjFqamwPkWqu_NAnpoVLGCqA6xrWV36Ni4JM1ETGkL3WX09eO7w8J8NvfHurX1MOkiEvxAWIruTqxZVxO3k

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

00a7a07da81c0554fcda7559981653f75f41a383104c19e6d084d75e0e865b2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7832
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 565346
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 r2S-PxSk8nVfdQ060lXYm7R04PCYA4jJrtRc4Kz5h9Xo4IYCxz44qiWaUKkfYiDnC8E_4QsqD3dDt0L5U8H1GRegABJSdUwcOqqxa6b0ciENRP2wr6b89Diti72qRQC_9kPQmNY
lh3.googleusercontent.com/ 526 KB
526 KB 1244ms
8ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/r2S-PxSk8nVfdQ060lXYm7R04PCYA4jJrtRc4Kz5h9Xo4IYCxz44qiWaUKkfYiDnC8E_4QsqD3dDt0L5U8H1GRegABJSdUwcOqqxa6b0ciENRP2wr6b89Diti72qRQC_9kPQmNY

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d836313514cc33e602cfc295cd6e55d9520315acf0d964190b47019eb1dfbed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 15:31:44 GMT
x-content-type-options: nosniff
age: 7832
status: 200
content-disposition: inline;filename="pasted image 0.png"
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 538543
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 24 Jul 2019 06:56:30 GMT

GET
H2 200 cropped-Screenshot_2019-07-23_100024.png
i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/07/ 6 KB
6 KB 7169ms
25ms Image
image/webp 192.0.77.2
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/07/cropped-Screenshot_2019-07-23_100024.png?resize=300%2C169&ssl=1

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

8c01f8551bff35625cddf692aa4f9f7f9b9942c31e8b08df2410ab781ff61dc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 6
date: Tue, 23 Jul 2019 17:42:22 GMT
x-content-type-options: nosniff
x-bytes-saved: 88130
last-modified: Tue, 23 Jul 2019 11:27:21 GMT
server: nginx
etag: "1110ce3e0a6330c8"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://blog.yoroi.company/wp-content/uploads/2019/07/cropped-Screenshot_2019-07-23_100024.png>; rel="canonical"
content-length: 5766
expires: Thu, 22 Jul 2021 23:27:21 GMT

GET
H2 200 cropped-Untitled2-1.png
i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/07/ 20 KB
21 KB 5913ms
26ms Image
image/webp 192.0.77.2
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/07/cropped-Untitled2-1.png?resize=300%2C169&ssl=1

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

46dcc0d9e236585e529d9d13fe9067f969ab1507d542972c8a5548dcb09f6d95

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:22 GMT
x-content-type-options: nosniff
x-bytes-saved: 136049
last-modified: Wed, 17 Jul 2019 09:01:30 GMT
server: nginx
etag: "5c4df293fa197f37"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://blog.yoroi.company/wp-content/uploads/2019/07/cropped-Untitled2-1.png>; rel="canonical"
content-length: 20884
expires: Fri, 16 Jul 2021 21:01:30 GMT

GET
H2 200 cropped-1111.png
i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/07/ 2 KB
2 KB 5892ms
28ms Image
image/webp 192.0.77.2
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/blog.yoroi.company/wp-content/uploads/2019/07/cropped-1111.png?resize=300%2C169&ssl=1

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

8b2c77a854961936a4e14cd9a7804a2bbc7b6acb1845f7cb615d38685f8e3a0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 7
date: Tue, 23 Jul 2019 17:42:22 GMT
x-content-type-options: nosniff
x-bytes-saved: 8828
last-modified: Mon, 08 Jul 2019 13:16:32 GMT
server: nginx
etag: "c9f4c2b8faa25c43"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://blog.yoroi.company/wp-content/uploads/2019/07/cropped-1111.png>; rel="canonical"
content-length: 2174
expires: Thu, 08 Jul 2021 01:16:32 GMT

GET
H2 200 photon.min.js Show response
c0.wp.com/p/jetpack/7.5.3/_inc/build/photon/ 782 B
414 B 15ms
14ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/_inc/build/photon/photon.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

50deeb5590f52d9e52c82f0aa04d34371b4a89770452e41e68503a9fcd551eba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:15 GMT

GET
H2 200 devicepx-jetpack.js Show response
s0.wp.com/wp-content/js/ 10 KB
3 KB 5285ms
7ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201930
Requested by: Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Tue, 23 Jul 2019 17:42:20 GMT
content-encoding: gzip
server: nginx
etag: W/"58674312-52b6"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 04 Apr 2020 08:38:59 GMT

GET
H2 200 gprofiles.js Show response
secure.gravatar.com/js/ 20 KB
7 KB 39ms
12ms Script
application/x-javascript 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gravatar.com/js/gprofiles.js?ver=2019Julaa
Requested by: Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:15 GMT
content-encoding: gzip
last-modified: Thu, 23 Aug 2018 15:01:14 GMT
server: nginx
etag: W/"5b7ecc3a-50bc"
content-type: application/x-javascript
status: 200
cache-control: max-age=604800
expires: Tue, 30 Jul 2019 17:42:15 GMT

GET
H2 200 wpgroho.js Show response
c0.wp.com/p/jetpack/7.5.3/modules/ 1 KB
620 B 6059ms
23ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/modules/wpgroho.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:21 GMT
content-encoding: br
last-modified: Thu, 04 Apr 2019 21:15:29 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:21 GMT

GET
H2 200 skip-link-focus-fix.min.js Show response
blog.yoroi.company/wp-content/themes/start-magazine/js/ 557 B
359 B 15754ms
256ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/js/skip-link-focus-fix.min.js?ver=20130115

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

818266fe4b7bbf0fe187b6190933c99af05829f70c2d6023acab03f8af5a59b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-22d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 jquery.cycle2.min.js Show response
blog.yoroi.company/wp-content/themes/start-magazine/vendors/cycle2/js/ 22 KB
7 KB 15756ms
257ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/cycle2/js/jquery.cycle2.min.js?ver=2.1.6

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

87a1a7e65f6ceed57d27b07cac22836a7682617932fc9d4376887b0ae1754a35

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-599c"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 jquery.sidr.min.js Show response
blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/js/ 7 KB
3 KB 15751ms
252ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/sidr/js/jquery.sidr.min.js?ver=2.2.1

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

fd57ae7228574a83527cb8917ec5a0ff944aa787934ee5b85a7976f259b7ae31

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-1b7a"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 slick.min.js Show response
blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/ 40 KB
10 KB 15761ms
262ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/slick/slick.min.js?ver=1.5.9

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

4fc7a9c6dd1051ab261a550db0b16147da4236dedfb2efc6311ebff48a045350

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-9e0d"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 custom.min.js Show response
blog.yoroi.company/wp-content/themes/start-magazine/js/ 944 B
563 B 15759ms
260ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/js/custom.min.js?ver=1.0.0

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

1ee4cfe6a384063358c337aa4d3394cb33ab48becbedb3351c6d1ddf701320a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
content-encoding: gzip
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
etag: W/"5ba8a516-3b0"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 twitter-timeline.min.js Show response
c0.wp.com/p/jetpack/7.5.3/_inc/build/ 357 B
418 B 6059ms
24ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/_inc/build/twitter-timeline.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

a09b5785c230e1f08f23ea6af8aa0d341736c3371d8bc6b30fc0aff9c213e46b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:21 GMT
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
strict-transport-security: max-age=15552000
content-type: application/javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 357
expires: Wed, 22 Jul 2020 17:42:21 GMT

GET
H2 200 queuehandler.min.js Show response
c0.wp.com/p/jetpack/7.5.3/_inc/build/likes/ 6 KB
2 KB 6059ms
24ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/_inc/build/likes/queuehandler.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:21 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:21 GMT

GET
H2 200 mootools-core-yc.js Show response
blog.yoroi.company/wp-content/plugins/enlighter/resources/ 88 KB
28 KB 15756ms
258ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/plugins/enlighter/resources/mootools-core-yc.js?ver=3.10.0

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
content-encoding: gzip
last-modified: Mon, 29 Apr 2019 16:04:53 GMT
server: nginx
etag: W/"5cc720a5-15e0e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 EnlighterJS.min.js Show response
blog.yoroi.company/wp-content/plugins/enlighter/resources/ 49 KB
15 KB 180ms
179ms Script
application/x-javascript 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/plugins/enlighter/resources/EnlighterJS.min.js?ver=3.10.0

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
content-encoding: gzip
last-modified: Mon, 29 Apr 2019 16:04:53 GMT
server: nginx
etag: W/"5cc720a5-c395"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 3.fra _atomic_dca
strict-transport-security: max-age=86400

GET
H2 200 wp-embed.min.js Show response
c0.wp.com/c/5.2.2/wp-includes/js/ 1 KB
690 B 6059ms
24ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.2.2/wp-includes/js/wp-embed.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:21 GMT
content-encoding: br
last-modified: Thu, 30 Aug 2018 12:40:26 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:21 GMT

GET
H2 200 sharing.min.js Show response
c0.wp.com/p/jetpack/7.5.3/_inc/build/sharedaddy/ 8 KB
2 KB 6059ms
24ms Script
application/javascript 192.0.77.37
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/7.5.3/_inc/build/sharedaddy/sharing.min.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

59842a2e19c5471be1eb2fc9c8509b539add5f30e152fa4ca714189cf9afb904

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 23 Jul 2019 17:42:21 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Wed, 22 Jul 2020 17:42:21 GMT

GET e-201930.js
stats.wp.com/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 14 KB
1 KB 638ms
18ms Stylesheet
text/css 2a00:1450:4001:81a::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Pacifico|Open+Sans:300,400,600,700,800

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

ae4bda5a652e3c1680b9e11ed4d49b188dfdc2ee34ef44fb0b3da60d815ba0d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 23 Jul 2019 17:42:14 GMT
server: ESF
access-control-allow-origin: *
date: Tue, 23 Jul 2019 17:42:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Tue, 23 Jul 2019 17:42:14 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
18 KB 18ms
5ms Script
text/javascript 2a00:1450:4001:821::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 20 Jun 2019 21:35:04 GMT
server: Golfe2
age: 3314
date: Tue, 23 Jul 2019 16:47:08 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17707
expires: Tue, 23 Jul 2019 18:47:08 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v16/ 9 KB
9 KB 45ms
7ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Pacifico|Open+Sans:300,400,600,700,800
Origin: https://blog.yoroi.company

Response headers

date: Wed, 19 Jun 2019 17:28:00 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:10:29 GMT
server: sffe
age: 2938455
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9132
x-xss-protection: 0
expires: Thu, 18 Jun 2020 17:28:00 GMT

GET
H2 200 fa-brands-400.woff2
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/ 62 KB
62 KB 15738ms
251ms Font
application/font-woff2 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/fa-brands-400.woff2

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

3a5a197947223babcd9e0e759e9284202d70ce33b9f8d7e6ffd3f5bce5fec649

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1
Origin: https://blog.yoroi.company

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
x-ac: 3.fra _atomic_dca
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
access-control-allow-origin: *
etag: "5ba8a516-f728"
strict-transport-security: max-age=86400
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
status: 200
accept-ranges: bytes
content-length: 63272

GET
H2 200 fa-solid-900.woff2
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/ 58 KB
58 KB 15741ms
255ms Font
application/font-woff2 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/fa-solid-900.woff2

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

b82ad8fbcf9bf844726f648ef268b74f8c2f668f56eafd98b05703e086ff1d5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1
Origin: https://blog.yoroi.company

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
x-ac: 3.fra _atomic_dca
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
access-control-allow-origin: *
etag: "5ba8a516-e8d4"
strict-transport-security: max-age=86400
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
status: 200
accept-ranges: bytes
content-length: 59604

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v16/ 9 KB
9 KB 44ms
6ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Pacifico|Open+Sans:300,400,600,700,800
Origin: https://blog.yoroi.company

Response headers

date: Tue, 09 Jul 2019 01:03:37 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:12:28 GMT
server: sffe
age: 1269518
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9080
x-xss-protection: 0
expires: Wed, 08 Jul 2020 01:03:37 GMT

GET
H2 200 fa-regular-400.woff2
blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/ 15 KB
15 KB 15736ms
250ms Font
application/font-woff2 192.0.78.217
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/webfonts/fa-regular-400.woff2

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.217 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

0fefffa15777b279ce61a06932e05bade8fcb729dd9bee04e93fcdd21e8f4552

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.yoroi.company/wp-content/themes/start-magazine/vendors/font-awesome/css/all.min.css?ver=5.1.1
Origin: https://blog.yoroi.company

Response headers

date: Tue, 23 Jul 2019 17:42:30 GMT
x-ac: 3.fra _atomic_dca
last-modified: Mon, 24 Sep 2018 08:49:26 GMT
server: nginx
access-control-allow-origin: *
etag: "5ba8a516-3a48"
strict-transport-security: max-age=86400
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
status: 200
accept-ranges: bytes
content-length: 14920

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.yoroi.company

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
199 B 13ms
13ms Image
image/gif 2a00:1450:4001:821::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j77&a=762048247&t=pageview&_s=1&dl=https%3A%2F%2Fblog.yoroi.company%2Fresearch%2Fdissecting-nanocore-crimeware-attack-chain%2F&ul=en-us&de=UTF-8&dt=Dissecting%20NanoCore%20Crimeware%20Attack%20Chain%20%E2%80%93%20Yoroi%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAUAB~&jid=664232985&gjid=249790728&cid=1586268328.1563903743&tid=UA-54504571-5&_gid=137008824.1563903743&_r=1&z=1424186683

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Jul 2019 17:42:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 93 KB
93 KB 29ms
7ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: c0.wp.com
URL: https://c0.wp.com/p/jetpack/7.5.3/_inc/build/twitter-timeline.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4197) /
Resource Hash: 67e3b1265f2ecef2ba487372b5e420109ebf520e470ed9610fdd6b4dd1dbf89b

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 23 Jul 2019 17:42:31 GMT
Last-Modified: Wed, 17 Jul 2019 18:01:51 GMT
Server: ECS (fcn/4197)
Etag: "e09c732e5d56860e58c6f26d69b0861e"
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
Content-Length: 95170

GET
H2 200 master.html
widgets.wp.com/likes/ Frame 48EB 0
0 541ms
12ms Document
text/html 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=201930
Requested by: Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/master.html?ver=201930
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Response headers

status: 200
server: nginx
date: Tue, 23 Jul 2019 17:42:31 GMT
content-type: text/html
last-modified: Thu, 21 Mar 2019 13:37:08 GMT
vary: Accept-Encoding
etag: W/"5c939384-84e"
content-encoding: gzip
x-ac: 2.ams _dfw
x-nc: HIT ams 2

GET
H2 200 hovercard.min.css
secure.gravatar.com/dist/css/ 7 KB
2 KB 37ms
12ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gravatar.com/dist/css/hovercard.min.css?ver=2019Julaa
Requested by: Host: blog.yoroi.company
URL: https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-1a2e"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Tue, 30 Jul 2019 17:42:31 GMT

GET
H2 200 services.min.css
secure.gravatar.com/dist/css/ 3 KB
564 B 37ms
12ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gravatar.com/dist/css/services.min.css?ver=2019Julaa
Requested by: Host: blog.yoroi.company
URL: https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-a54"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Tue, 30 Jul 2019 17:42:31 GMT

GET
H2 200 / Show response
graph.facebook.com/ 232 B
568 B 53ms
40ms Script
text/javascript 2a03:2880:f02d:e:face:b00c:0:2
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.yoroi.company%2Fresearch%2Fdissecting-nanocore-crimeware-attack-chain%2F&_=1563903751185

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/wordpress/wp-content/themes/start-magazine/js/yoroi-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

e1528c7a0ee25307c0f2fff82c4577a1d381e9d3966c69d75f1320830d638a11

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-app-usage: {"call_count":0,"total_cputime":0,"total_time":0}
status: 200
date: Tue, 23 Jul 2019 17:42:31 GMT
x-fb-rev: 1000971330
content-length: 120
pragma: no-cache
x-fb-debug: Nu7EMkg+Tr1b3+fP8jvfN9NtnNC490QnphtmSUGiZvgK5av71y+m4UrdOvRkzzRusEE4xSSjvWAIjpLIxzseAA==
x-fb-trace-id: CO3tWiB4hRc
etag: "7cebfab01e7853cfd79bec9624268036003acdd7"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AWvMqJSlZqAnj5Kyj1no0_O
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v2.10
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
123 B 1302ms
12ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.07747837781160927
Requested by: Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 23 Jul 2019 17:42:32 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H/1.1 200
OK widget_iframe.940e1bc455d9af25d6ec2f14e90d0d6c.html
platform.twitter.com/widgets/ Frame 7838 0
0 7ms
7ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.940e1bc455d9af25d6ec2f14e90d0d6c.html?origin=https%3A%2F%2Fblog.yoroi.company
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E9) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Tue, 23 Jul 2019 17:42:31 GMT
Etag: "7d3f6ed140174a20e7c8be261a70a863"
Last-Modified: Wed, 17 Jul 2019 18:00:26 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40E9)
X-Cache: HIT
Content-Length: 15194

GET
H/1.1 200
OK moment~timeline~tweet.5f7a3a92d1e2161ba3f6a441af6bf728.js Show response
platform.twitter.com/js/ 24 KB
25 KB 14ms
8ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline~tweet.5f7a3a92d1e2161ba3f6a441af6bf728.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40B6) /
Resource Hash: d01c160543171842e3b3e5e9179f3197eb95f9b995a15af1f41e514f716a9775

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 23 Jul 2019 17:42:31 GMT
Last-Modified: Wed, 17 Jul 2019 18:00:18 GMT
Server: ECS (fcn/40B6)
Etag: "cf0b563670e91a6273023564b912ad2e"
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
Content-Length: 24820

GET
H/1.1 200
OK timeline.49693ebcd57b08708ebca7502c7c343d.js Show response
platform.twitter.com/js/ 23 KB
23 KB 20ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/timeline.49693ebcd57b08708ebca7502c7c343d.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40B4) /
Resource Hash: 16375db367d03b63d3447ec0a6383c999bfa2a9a2ca934a905feaa8b4efa4357

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 23 Jul 2019 17:42:31 GMT
Last-Modified: Wed, 17 Jul 2019 18:00:18 GMT
Server: ECS (fcn/40B4)
Etag: "15af387ddc25a6249fd9c82ff4d8854c"
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
Content-Length: 23065

GET
H2 200 profile Show response
cdn.syndication.twimg.com/timeline/ 15 KB
3 KB 179ms
159ms Script
application/javascript 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_yoroisecurity_old&dnt=false&domain=blog.yoroi.company&lang=en&screen_name=yoroisecurity&suppress_response_codes=true&t=1737670&tweet_limit=2&tz=GMT%2B0200&with_replies=false

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

tsa_f /

Resource Hash

4567cfc29140cfc5b845765769de157b5aed41c3541241cb6eb3b74565da7513

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-disposition: attachment; filename=jsonp.jsonp
strict-transport-security: max-age=631138519
content-length: 2732
x-xss-protection: 0
x-response-time: 135
last-modified: Tue, 23 Jul 2019 17:42:31 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: must-revalidate, max-age=300
x-connection-hash: 71f24eb4d6f742e4b587ffc88a6133ee
timing-allow-origin: *
x-transaction: 00815ca400152120
expires: Tue, 23 Jul 2019 17:47:31 GMT

GET
H2 200 syndication
syndication.twitter.com/i/jot/ 43 B
124 B 1665ms
137ms Image
image/gif 104.244.42.136
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1563903751236%2C%22dnt%22%3Afalse%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 116
pragma: no-cache
last-modified: Tue, 23 Jul 2019 17:42:32 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 70e23d047bec3b44f7e24edcaf695ec5
x-transaction: 00cf8f60007ff86a
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK timeline.92bbf95324b5eb65091906e99a889eb3.light.ltr.css
platform.twitter.com/css/ Frame 54D0 54 KB
54 KB 6ms
6ms Stylesheet
text/css 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/timeline.92bbf95324b5eb65091906e99a889eb3.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A0) /
Resource Hash: 54d47056f9d6613407674456c491fe454c7a7c53e68e59566dac407dd6631fa4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 23 Jul 2019 17:42:31 GMT
Last-Modified: Wed, 17 Jul 2019 18:00:14 GMT
Server: ECS (fcn/41A0)
Etag: "c48402b3e77043a672d1178388dcf2ca"
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Accept-Ranges: bytes
Content-Type: text/css; charset=utf-8
Content-Length: 54832

GET
H/1.1 200
OK timeline.92bbf95324b5eb65091906e99a889eb3.light.ltr.css
platform.twitter.com/css/ 16 KB
16 KB 7ms
7ms Image
text/css 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/timeline.92bbf95324b5eb65091906e99a889eb3.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A0) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 23 Jul 2019 17:42:31 GMT
Last-Modified: Wed, 17 Jul 2019 18:00:14 GMT
Server: ECS (fcn/41A0)
Etag: "c48402b3e77043a672d1178388dcf2ca"
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Accept-Ranges: bytes
Content-Type: text/css; charset=utf-8
Content-Length: 54832

GET
H2 200 wtANzwYI_normal.jpeg
pbs.twimg.com/profile_images/534689469253701632/ Frame 54D0 2 KB
2 KB 8ms
7ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/534689469253701632/wtANzwYI_normal.jpeg

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40E9) /

Resource Hash

a78e816fad93bab829c882b85bf1aafb5ae0cb7523b8d6de5457651fed1caeca

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2187
x-response-time: 248
surrogate-key: profile_images profile_images/bucket/3 profile_images/534689469253701632
last-modified: Tue, 18 Nov 2014 12:45:58 GMT
server: ECS (fcn/40E9)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 4c73906c06e5c8cc0482bc53fcea0e65
accept-ranges: bytes

GET
H2 200 EAK3nuwXYAEpMix
pbs.twimg.com/media/ Frame 54D0 10 KB
10 KB 9ms
7ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/EAK3nuwXYAEpMix?format=png&name=360x360

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4199) /

Resource Hash

209e14b1233c6e4438b826dd752e6596adaa9e8e0c68565bdc30e0f83076273a

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 10016
x-response-time: 149
surrogate-key: media media/bucket/1 media/1153686347753938945
last-modified: Tue, 23 Jul 2019 15:18:34 GMT
server: ECS (fcn/4199)
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: f8223ca9ec29a8a707a282e173819e70
accept-ranges: bytes

GET
H2 200 D_2M4dqXsAMAyaj
pbs.twimg.com/media/ Frame 54D0 8 KB
8 KB 13ms
12ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/D_2M4dqXsAMAyaj?format=jpg&name=360x360

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41AD) /

Resource Hash

7b6f7edd38d9100b405100bf6b28afa8931f30f9aff8ce6f25f7bbc7abbdcb5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:31 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 8505
x-response-time: 154
surrogate-key: media media/bucket/1 media/1152231981339619331
last-modified: Fri, 19 Jul 2019 14:59:26 GMT
server: ECS (fcn/41AD)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 27bffd2e885d9638a2675c80ee3a6058
accept-ranges: bytes

GET
DATA 200
OK truncated
/ Frame 54D0 707 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 54D0 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 54D0 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 54D0 644 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
492 B 1204ms
132ms Image
image/gif 104.244.42.136
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fblog.yoroi.company%2Fresearch%2Fdissecting-nanocore-crimeware-attack-chain%2F%22%2C%22widget_frame%22%3Afalse%2C%22widget_partner%22%3A%22jetpack%22%2C%22widget_creator_screen_name%22%3A%22yoroisecurity%22%2C%22widget_data_source%22%3A%22profile%3Ayoroisecurity%22%2C%22query%22%3Anull%2C%22profile_id%22%3Anull%2C%22item_ids%22%3A%5B%221153686349322620931%22%2C%221152231982853709824%22%5D%2C%22item_details%22%3A%7B%221153686349322620931%22%3A%7B%22item_type%22%3A0%7D%2C%221152231982853709824%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1563903751694%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%229adde0b%3A1563344675151%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22component%22%3A%22timeline%22%2C%22element%22%3A%22initial%22%2C%22action%22%3A%22results%22%7D%7D

Requested by

Host: blog.yoroi.company
URL: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://blog.yoroi.company/research/dissecting-nanocore-crimeware-attack-chain/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 17:42:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 111
pragma: no-cache
last-modified: Tue, 23 Jul 2019 17:42:32 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 70e23d047bec3b44f7e24edcaf695ec5
x-transaction: 001a422000d24551
expires: Tue, 31 Mar 1981 05:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.yoroi.company
URL: https://www.yoroi.company/images/logo_white.svg

Domain: i1.wp.com
URL: https://i1.wp.com/blog.yoroi.company/wp-content/uploads/2019/06/vllsvxpvhtkhwkjhngpnnlwhhpkhuxgv.jpg?w=462&ssl=1

Domain: stats.wp.com
URL: https://stats.wp.com/e-201930.js

Verdicts & Comments Add Verdict or Comment

121 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://c0.wp.com/c/5.2.2/wp-includes/js/jquery/jquery-migrate.min.js(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=86400

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.yoroi.company
c0.wp.com
cdn.syndication.twimg.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
i1.wp.com
i2.wp.com
lh3.googleusercontent.com
lh4.googleusercontent.com
lh5.googleusercontent.com
lh6.googleusercontent.com
pbs.twimg.com
pixel.wp.com
platform.twitter.com
s0.wp.com
secure.gravatar.com
stats.wp.com
syndication.twitter.com
widgets.wp.com
www.google-analytics.com
www.yoroi.company
i1.wp.com
stats.wp.com
www.yoroi.company
104.244.42.136
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
192.0.78.217
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:46c:e8b:1e2f:2bd:694
2a00:1450:4001:808::2001
2a00:1450:4001:81a::200a
2a00:1450:4001:820::2001
2a00:1450:4001:821::200e
2a00:1450:4001:825::2003
2a03:2880:f02d:e:face:b00c:0:2
2a04:fa87:fffe::c000:4902
00a7a07da81c0554fcda7559981653f75f41a383104c19e6d084d75e0e865b2e
066e006e482ee3cfd76f37618f99ecad50eed1c9df36841d177f6218cfb38874
0fefffa15777b279ce61a06932e05bade8fcb729dd9bee04e93fcdd21e8f4552
12da5d5092e093b7813df6018d3005ed8c7e3ccdb4ab123b82d12f8d236c61d0
16375db367d03b63d3447ec0a6383c999bfa2a9a2ca934a905feaa8b4efa4357
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1ee4cfe6a384063358c337aa4d3394cb33ab48becbedb3351c6d1ddf701320a0
209e14b1233c6e4438b826dd752e6596adaa9e8e0c68565bdc30e0f83076273a
20c16b40678ad3b219c875b73a714c5b8e7ef40d80e113d939d949b49d1e8fe2
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e
27fe43613f7d72d4cc0acff04c82c1b0954625d968985ddef59ac5e35d4eebdc
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29
3a5a197947223babcd9e0e759e9284202d70ce33b9f8d7e6ffd3f5bce5fec649
3e7a865c8b50bd82db738bff39cedf40d887afc1f5bf8c9ea4c519b6826e5cdd
41d39d1daa9f0c15de6173a70df2ff1eb9857a89221ee6d9e750af41a478c511
41e7c6de1addd5d7f787b6edbcf89d9aa47ab057c3a84165574a8418f16f91fc
42261e5d96f277f102752532e2b45bcc7d09fcfae3cdf6c1e42ff6ce2d7707d4
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
4567cfc29140cfc5b845765769de157b5aed41c3541241cb6eb3b74565da7513
46dcc0d9e236585e529d9d13fe9067f969ab1507d542972c8a5548dcb09f6d95
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
4fc7a9c6dd1051ab261a550db0b16147da4236dedfb2efc6311ebff48a045350
50deeb5590f52d9e52c82f0aa04d34371b4a89770452e41e68503a9fcd551eba
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
54d47056f9d6613407674456c491fe454c7a7c53e68e59566dac407dd6631fa4
59842a2e19c5471be1eb2fc9c8509b539add5f30e152fa4ca714189cf9afb904
601778f6b3efabdbf5e673ea17bbb960e0c6cb97461d6991b105591841908af2
67e3b1265f2ecef2ba487372b5e420109ebf520e470ed9610fdd6b4dd1dbf89b
73a57bbd2ee125b49c1dea67012fc3f7ba9e71347e4e142572834ef9b3024932
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c
7b6f7edd38d9100b405100bf6b28afa8931f30f9aff8ce6f25f7bbc7abbdcb5a
818266fe4b7bbf0fe187b6190933c99af05829f70c2d6023acab03f8af5a59b0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87a1a7e65f6ceed57d27b07cac22836a7682617932fc9d4376887b0ae1754a35
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c
8b2c77a854961936a4e14cd9a7804a2bbc7b6acb1845f7cb615d38685f8e3a0d
8c01f8551bff35625cddf692aa4f9f7f9b9942c31e8b08df2410ab781ff61dc5
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce
a09b5785c230e1f08f23ea6af8aa0d341736c3371d8bc6b30fc0aff9c213e46b
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a78e816fad93bab829c882b85bf1aafb5ae0cb7523b8d6de5457651fed1caeca
a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2
abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae4bda5a652e3c1680b9e11ed4d49b188dfdc2ee34ef44fb0b3da60d815ba0d2
af45301d5f88d9044de32fba300a1e6e9b3aa1cf2bdfff36525bbf3c12eacb4f
b82ad8fbcf9bf844726f648ef268b74f8c2f668f56eafd98b05703e086ff1d5b
ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d
bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f
bd8b0c2e9c07473382c21f9f245c7a24433c3a100eed41e6e0695d23942b0e4a
c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af
ca98f67f4ee42fbc2ddb637f9dbabcc48ac6885bc72f79beccb6ab3285931ff1
d01c160543171842e3b3e5e9179f3197eb95f9b995a15af1f41e514f716a9775
d836313514cc33e602cfc295cd6e55d9520315acf0d964190b47019eb1dfbed9
d84cb13f102ae9028a454625d547cb4e20b32a3b4306721c13ddc40a8f94bde7
d98121a51ed3f911f519cf42be28225dc26b4c9d61cfab0a580118e5c3447463
e1528c7a0ee25307c0f2fff82c4577a1d381e9d3966c69d75f1320830d638a11
e271944b34afc94fbd81d6ad584c455fa62faa743e38c1502aa94b4c6fd3f1f4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da
ef76ad8af121092ad68342827b1890d107262fcc45b28e25501b3bc890c1cb63
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82
f5053d80653018c35e52d0ee6bd2fcf89ed15963d8e2e5d4afd3ae7d36106721
f655dece6102377f79e507dff8a5805760a888b9d89de59e41850ba4cdf39e56
fd57ae7228574a83527cb8917ec5a0ff944aa787934ee5b85a7976f259b7ae31

blog.yoroi.company Open in urlscan Pro 192.0.78.217 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

75 Requests

96 %HTTPS

60 %IPv6

10 Domains

22 Subdomains

16 IPs

3 Countries

4282 kBTransfer

5475 kBSize

0 Cookies

18 Outgoing links

Page URL History

Redirected requests

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.yoroi.company Open in urlscan Pro
192.0.78.217 Public Scan

Screenshot
Live screenshot

Full Image

75
Requests

96 %
HTTPS

60 %
IPv6

10
Domains

22
Subdomains

16
IPs

3
Countries

4282 kB
Transfer

5475 kB
Size

0
Cookies

75 HTTP transactions
5 data transactions