www.fireeye.com Open in urlscan Pro
149.126.77.186 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Submission: On May 01 via api (May 1st 2018, 8:57:11 pm UTC) from US

Summary HTTP 88 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 28 IPs in 6 countries across 24 domains to perform 88 HTTP transactions. The main IP is 149.126.77.186, located in Frankfurt, Germany and belongs to INCAPSULA - Incapsula Inc, US. The main domain is www.fireeye.com.
TLS certificate: Issued by Entrust Certification Authority - L1K on May 16th 2017. Valid for: a year.

This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
35	149.126.77.186 149.126.77.186	19551 (INCAPSULA) (INCAPSULA - Incapsula Inc)
1 1	2.19.35.110 2.19.35.110	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	199.15.214.214 199.15.214.214	53580 (MARKETO) (MARKETO - MARKETO)
2	23.43.123.158 23.43.123.158	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	172.217.22.66 172.217.22.66	15169 (GOOGLE) (GOOGLE - Google LLC)
2	216.58.214.72 216.58.214.72	15169 (GOOGLE) (GOOGLE - Google LLC)
1	104.16.37.47 104.16.37.47	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 3	74.125.133.157 74.125.133.157	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2.18.233.142 2.18.233.142	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2 3	172.217.22.68 172.217.22.68	15169 (GOOGLE) (GOOGLE - Google LLC)
3	216.58.214.67 216.58.214.67	15169 (GOOGLE) (GOOGLE - Google LLC)
1	23.45.97.17 23.45.97.17	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	204.79.197.200 204.79.197.200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	34.249.172.115 34.249.172.115	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	157.240.20.19 157.240.20.19	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	104.109.87.116 104.109.87.116	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	157.240.20.35 157.240.20.35	32934 (FACEBOOK) (FACEBOOK - Facebook)
3	172.82.228.19 172.82.228.19	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1	66.117.29.11 66.117.29.11	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1 5	172.217.22.46 172.217.22.46	15169 (GOOGLE) (GOOGLE - Google LLC)
1	87.248.118.22 87.248.118.22	10310 (YAHOO-1) (YAHOO-1 - Yahoo!)
1	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2.21.160.128 2.21.160.128	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2 3	185.63.145.5 185.63.145.5	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1 1	185.63.145.1 185.63.145.1	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1	199.15.215.200 199.15.215.200	53580 (MARKETO) (MARKETO - MARKETO)
1	188.125.66.33 188.125.66.33	34010 (YAHOO-IRD) (YAHOO-IRD)
2	199.96.57.6 199.96.57.6	13414 (TWITTER) (TWITTER - Twitter Inc.)
3	216.58.214.78 216.58.214.78	15169 (GOOGLE) (GOOGLE - Google LLC)
88	28

35 149.126.77.186 (Frankfurt, Germany)

ASN19551 (INCAPSULA - Incapsula Inc, US)
PTR: 149.126.77.186.ip.incapdns.net

www.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.35.110 (European Union) 1 redirects

ASN20940 (AKAMAI-ASN1, US)

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 199.15.214.214 (San Mateo, United States)

ASN53580 (MARKETO - MARKETO, Inc., US)

www2.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.43.123.158 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-43-123-158.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.66 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s17-in-f66.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.214.72 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s10-in-f72.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.37.47 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.125.133.157 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: wo-in-f157.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.233.142 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.22.68 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s17-in-f68.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.214.67 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s10-in-f3.1e100.net

www.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.97.17 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-97-17.deploy.static.akamaitechnologies.com

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 204.79.197.200 (Redmond, United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: a-0001.a-msedge.net

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.249.172.115 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-249-172-115.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.20.19 (Menlo Park, United States)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: xx-fbcdn-shv-02-frt3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.87.116 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-87-116.deploy.static.akamaitechnologies.com

cdn.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.20.35 (Menlo Park, United States)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: edge-star-mini-shv-02-frt3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.82.228.19 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.sc.omtrdc.net

fireeye.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.11 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)

fireeye.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.22.46 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.248.118.22 (United Kingdom)

ASN10310 (YAHOO-1 - Yahoo!, US)
PTR: e1.ycpi.vip.deb.yahoo.com

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.162 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f162.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.21.160.128 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.63.145.5 (United States) 2 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dc.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.63.145.1 (United States) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.15.215.200 (San Mateo, United States)

ASN53580 (MARKETO - MARKETO, Inc., US)

848-did-242.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.125.66.33 (Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.96.57.6 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.214.78 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s10-in-f14.1e100.net

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	fireeye.com www.fireeye.com www2.fireeye.com	1 MB
6	google.com 2 redirects www.google.com apis.google.com	98 KB
5	google-analytics.com 1 redirects www.google-analytics.com	15 KB
5	omtrdc.net cdn.tt.omtrdc.net fireeye.sc.omtrdc.net fireeye.tt.omtrdc.net	16 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com dc.ads.linkedin.com	2 KB
4	doubleclick.net 2 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	18 KB
3	addthis.com s7.addthis.com	186 KB
3	facebook.com www.facebook.com	1 KB
3	facebook.net connect.facebook.net	89 KB
3	google.nl www.google.nl	325 B
3	adobedtm.com assets.adobedtm.com	67 KB
2	twitter.com platform.twitter.com	37 KB
2	bing.com bat.bing.com	5 KB
2	googletagmanager.com www.googletagmanager.com	49 KB
2	marketo.net munchkin.marketo.net	5 KB
1	addthisedge.com m.addthisedge.com	909 B
1	yahoo.com sp.analytics.yahoo.com	2 KB
1	mktoresp.com 848-did-242.mktoresp.com	622 B
1	yimg.com s.yimg.com	4 KB
1	demdex.net dpm.demdex.net	995 B
1	bizographics.com sjs.bizographics.com	4 KB
1	maxmind.com js.maxmind.com	1 KB
1	googleadservices.com www.googleadservices.com	7 KB
1	typography.com 1 redirects cloud.typography.com	468 B
88	24

	Domain	Requested by
35	www.fireeye.com	www.fireeye.com
6	www2.fireeye.com	www.fireeye.com www2.fireeye.com
5	www.google-analytics.com	1 redirects www.googletagmanager.com www.fireeye.com
3	apis.google.com	s7.addthis.com apis.google.com
3	s7.addthis.com	www.fireeye.com s7.addthis.com
3	fireeye.sc.omtrdc.net	assets.adobedtm.com www.fireeye.com
3	www.facebook.com	www.fireeye.com
3	connect.facebook.net	www.fireeye.com connect.facebook.net s7.addthis.com
3	www.google.nl	www.fireeye.com
3	www.google.com	2 redirects www.fireeye.com
3	assets.adobedtm.com	www.fireeye.com assets.adobedtm.com
3	stats.g.doubleclick.net	2 redirects www.fireeye.com
2	platform.twitter.com	s7.addthis.com platform.twitter.com
2	px.ads.linkedin.com	2 redirects
2	bat.bing.com	www.googletagmanager.com www.fireeye.com
2	www.googletagmanager.com	www.fireeye.com www.googletagmanager.com
2	munchkin.marketo.net	www.fireeye.com munchkin.marketo.net
1	m.addthisedge.com	s7.addthis.com
1	sp.analytics.yahoo.com	s.yimg.com
1	848-did-242.mktoresp.com	munchkin.marketo.net
1	dc.ads.linkedin.com	www.fireeye.com
1	www.linkedin.com	1 redirects
1	googleads.g.doubleclick.net	www.googleadservices.com
1	s.yimg.com	www.fireeye.com
1	fireeye.tt.omtrdc.net	assets.adobedtm.com
1	cdn.tt.omtrdc.net	assets.adobedtm.com
1	dpm.demdex.net	assets.adobedtm.com
1	sjs.bizographics.com	www.googletagmanager.com
1	js.maxmind.com	www.fireeye.com
1	www.googleadservices.com	www.fireeye.com
1	cloud.typography.com	1 redirects
88	31

This site contains links to these domains. Also see Links.

Domain
tfs.fireeye.com
partnerportal.fireeye.com
training.fireeye.com
www2.fireeye.com
csportal.fireeye.com
community.fireeye.com
docs.fireeye.com
investors.fireeye.com
universityrelations.fireeye.com
portal.msrc.microsoft.com
download.microsoft.com
artemonsecurity.blogspot.com
www.linkedin.com
twitter.com
www.facebook.com
plus.google.com
www.youtube.com
itunes.apple.com
www.fireeye.fr
www.fireeye.de
www.fireeye.jp
www.fireeye.kr
www.addthis.com

Subject Issuer	Validity	Valid
fireeye.com Entrust Certification Authority - L1K	`2017-05-16` - `2018-06-06`	a year	crt.sh
www2.fireeye.com Entrust Certification Authority - L1K	`2017-05-02` - `2018-05-02`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Frame ID: A59B791FC63A34BD682DB8A6F381AEA7
Requests: 91 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: 2435E83933AAAE4AC569BBC4DFA009F3
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i

AddThis (Widgets) Expand

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /apis\.google\.com\/js\/[a-z]*\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

env /^Munchkin$/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Modernizr$/i

SiteCatalyst (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\/s[_-]code.*\.js/i
env /^s_(?:account|objectID|code|INST)$/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

YUI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^YAHOO$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

88
Requests

42 %
HTTPS

0 %
IPv6

24
Domains

31
Subdomains

28
IPs

6
Countries

1864 kB
Transfer

4191 kB
Size

4
Cookies

25 Outgoing links

These are links going to different origins than the main page.

URL: https://tfs.fireeye.com/
Title: Partner Enablement

Search URL Search Domain Scan URL

URL: http://partnerportal.fireeye.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: http://training.fireeye.com/
Title: Partner Education Center

Search URL Search Domain Scan URL

URL: https://www2.fireeye.com/Partner-Request-LP-New.html
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://csportal.fireeye.com/secur/login_portal.jsp?orgId=00D3000000063LS&portalId=06030000000pSNE
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://community.fireeye.com/
Title: Communities

Search URL Search Domain Scan URL

URL: https://docs.fireeye.com/
Title: Documentation Portal

Search URL Search Domain Scan URL

URL: http://investors.fireeye.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: http://universityrelations.fireeye.com/
Title: University Relations

Search URL Search Domain Scan URL

URL: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
Title: here.

Search URL Search Domain Scan URL

URL: http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf
Title: WingBird

Search URL Search Domain Scan URL

URL: https://artemonsecurity.blogspot.com/2017/01/wingbird-rootkit-analysis.html
Title: blog post by "Artem"

Search URL Search Domain Scan URL

URL: https://www2.fireeye.com/manage-your-preferences.html
Title: Email Preferences

Search URL Search Domain Scan URL

URL: https://community.fireeye.com/welcome
Title: Communities

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fireeye
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/fireeye
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/FireEye
Title: Facebook

Search URL Search Domain Scan URL

URL: https://plus.google.com/+Fireeye
Title: Google+

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/FireEyeInc
Title: YouTube

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/eye-on-security/id1073779629?mt=2
Title: Podcast

Search URL Search Domain Scan URL

URL: https://www.fireeye.fr/
Title: French (Français)

Search URL Search Domain Scan URL

URL: https://www.fireeye.de/
Title: German (Deutsch)

Search URL Search Domain Scan URL

URL: https://www.fireeye.jp/
Title: Japanese (日本語)

Search URL Search Domain Scan URL

URL: https://www.fireeye.kr/
Title: Korean (한국어)

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
https://www.fireeye.com/content/dam/fireeye-www/fw/f/651819/A58B5C49CEF91B231.css

Request Chain 31

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1144530451&utmhn=www.fireeye.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&utmhid=1505333431&utmr=-&utmp=%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&utmht=1525208217647&utmac=UA-363943-1&utmcc=__utma%3D214676736.1624232352.1525208218.1525208218.1525208218.1%3B%2B__utmz%3D214676736.1525208218.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=833584357&utmredir=3&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=833584357&_v=5.7.2dc&z=1144530451 HTTP 302
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=833584357&_v=5.7.2dc&z=1144530451&slf_rd=1&random=1379067227

Request Chain 51

https://www.google-analytics.com/r/collect?v=1&_v=j67&a=1505333431&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de=UTF-8&dt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Forms&ea=WhitePaper%20Download&el=%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&_utma=214676736.1624232352.1525208218.1525208218.1525208218.1&_utmz=214676736.1525208218.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1525208218370&_u=YQBCAEAB~&jid=177009242&gjid=818471506&cid=1624232352.1525208218&tid=UA-363943-1&_gid=634096335.1525208218&_r=1&gtm=G4dMVGC8KK&z=211798485 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_gid=634096335.1525208218&gjid=818471506&_v=j67&z=211798485 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_v=j67&z=211798485 HTTP 302
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_v=j67&z=211798485&slf_rd=1&random=4029652493

Request Chain 65

https://px.ads.linkedin.com/collect/?time=1525208218896&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ref=&fmt=js&s=1 HTTP 302
https://px.ads.linkedin.com/collect/?time=1525208218896&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ref=&fmt=js&s=1&cookiesTest=true HTTP 302
https://www.linkedin.com/csp/dtag?_x=%2526s%253D1%2526url%253Dhttps%25253A%25252F%25252Fwww.fireeye.com%25252Fblog%25252Fthreat-research%25252F2017%25252F04%25252Fcve-2017-0199-hta-handler.html%2526pageUrl%253Dhttps%25253A%25252F%25252Fwww.fireeye.com%25252Fblog%25252Fthreat-research%25252F2017%25252F04%25252Fcve-2017-0199-hta-handler.html%2526ref%253D%2526cookiesTest%253Dtrue%2526opid%253D6572%2526fmt%253Djs%2526time%253D1525208218896&p=9 HTTP 302
https://dc.ads.linkedin.com/collect/?pid=6883&s=1&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ref=&cookiesTest=true&opid=6572&fmt=js&time=1525208218896

88 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request cve-2017-0199-hta-handler.html Show response
www.fireeye.com/blog/threat-research/2017/04/ 69 KB
19 KB 772ms
751ms Document
text/html 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

c63b1955dfe5b409514ad44046a52a3d68391f1ace79055060bbba01b7054c2e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
etag: W/"110b2-56b2b35ff18a0-gzip"
dispatcher: ${DISP_NUM}
status: 200
x-iinfo: 10-34065424-34063683 2NNN RT(1525208216271 0) q(0 0 0 0) r(8 8) U18
strict-transport-security: max-age=31536000; includeSubDomains
x-xss-protection: 1; mode=block
last-modified: Tue, 01 May 2018 20:56:57 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:57 GMT
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
cache-control: no-cache="set-cookie"
set-cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69;PATH=/;MAX-AGE=900 nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; path=/; Domain=.fireeye.com visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; expires=Wed, 01 May 2019 11:56:48 GMT; path=/; Domain=.fireeye.com incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; path=/; Domain=.fireeye.com
accept-ranges: bytes
x-content-type-options: nosniff

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 107 KB
37 KB 11ms
9ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

5289840c115a8725f816552aae25f03c928c019256a7547a9f8652a19f05ceba

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc.clientlibs/clientlibs/granite/jquery.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:46:17 GMT
etag: "1ba4e-56ace05d1dc40-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065635-0 0CNN RT(1525208217029 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-length: 37625
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 clientlibs_nav.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 10 KB
3 KB 16ms
14ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

9c9430c197476f80275443261f9c704c4fa44209e1a73a70acc5432df543c7f0

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/designs/fireeye-www/clientlibs_nav.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:24 GMT
etag: "2a69-56acda219e800-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065638-0 0CNN RT(1525208217035 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 3251
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 cds.css
www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw/css/ 4 KB
1 KB 16ms
13ms Stylesheet
text/css 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw/css/cds.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

14f5c3507c3529201adf46f8d0bd4cac4cf8ee74b08c1143020dc577a86a66ef

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/designs/fireeye-www/clientlibs_fw/css/cds.css
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:45:52 GMT
etag: "1757-56ace04546400-gzip"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
x-iinfo: 10-34065636-0 0CNN RT(1525208217033 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=43200, public
date: Tue, 01 May 2018 20:56:57 GMT
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-length: 1120
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 08:56:57 GMT

GET
S

200

A58B5C49CEF91B231.css
www.fireeye.com/content/dam/fireeye-www/fw/f/651819/
Redirect Chain

https://cloud.typography.com/6746836/6977592/css/fonts.css
https://www.fireeye.com/content/dam/fireeye-www/fw/f/651819/A58B5C49CEF91B231.css

338 KB
256 KB

6ms
6ms

Stylesheet
text/css

149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/651819/A58B5C49CEF91B231.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

192fd38d14982b1d056d505446cf8b8f8aabdbf72af04245a015aa4281246d45

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:45:30 GMT
etag: "547f8-56ace0304b280-gzip"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
x-iinfo: 10-34065654-0 0CNN RT(1525208217075 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=43200, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 261949
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 08:56:57 GMT

Redirect headers

Date: Tue, 01 May 2018 20:56:57 GMT
Last-Modified: Wed, 04 Apr 2018 18:37:39 GMT
Server: Apache
ETag: "115e2100d163a3d87ac532e0b7ef66d5:1522867059"
Vary: Accept-Encoding
Content-Type: text/html
Location: https://www.fireeye.com/content/dam/fireeye-www/fw/f/651819/A58B5C49CEF91B231.css
Cache-Control: must-revalidate, private
Connection: keep-alive
X-HCo-pid: 19
Content-Length: 154
Expires: Tue, 01 May 2018 20:56:57 GMT

GET
H2 200 clientlibs_fw.min.css
www.fireeye.com/etc/designs/fireeye-www/ 172 KB
32 KB 16ms
14ms Stylesheet
text/css 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

7833d3c2a4309372bd0a3eec38a4b0a5401423aca5b664c1d49ff593656cb80c

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/designs/fireeye-www/clientlibs_fw.min.css
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:24 GMT
etag: "2b07d-56acda219e800-gzip"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
x-iinfo: 10-34065639-0 0CNN RT(1525208217037 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=43200, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 32891
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 08:56:57 GMT

GET
H2 200 clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/ 287 B
310 B 26ms
24ms Stylesheet
text/css 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

f7de8a302ba63e8067adeb89eb0e53327b17996ce20d2026466f681c83394002

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientlibs/fireeye-blog/clientlibs_base.min.css
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:19:04 GMT
etag: "11f-56acda47c4200-gzip"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
x-iinfo: 10-34065640-0 0CNN RT(1525208217039 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=43200, public
date: Tue, 01 May 2018 20:56:57 GMT
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-length: 181
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 08:56:57 GMT

GET
H2 200 clientlibs_analytics.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 2 KB
931 B 27ms
25ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_analytics.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

eb9f5c6e7887dbc763d63af2d1dffc086d71210b2501abf22768310d7d3db092

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/designs/fireeye-www/clientlibs_analytics.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:45:54 GMT
etag: "846-56ace0472e880-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065641-0 0CNN RT(1525208217041 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 801
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 utils.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 9 KB
4 KB 27ms
25ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

08ada830a022251d78d15cefd38549eda4c4f24ba25845ff2280d23cafe2a178

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc.clientlibs/clientlibs/granite/utils.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:25 GMT
etag: "255b-56acda2292a40-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065642-0 0CNN RT(1525208217043 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 3555
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 granite.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/ 3 KB
2 KB 27ms
26ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

5b0454427cef5e4c09cad48c5b421f4d23d9a0689f4519f17956af263bf77d3b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc.clientlibs/clientlibs/granite/jquery/granite.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:25 GMT
etag: "db3-56acda2292a40-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065643-0 0CNN RT(1525208217045 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 1522
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc/clientlibs/foundation/ 16 B
137 B 27ms
26ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/foundation/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientlibs/foundation/jquery.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:25 GMT
etag: "10-56acda2292a40"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065644-0 0CNN RT(1525208217047 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 36
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 shared.min.js Show response
www.fireeye.com/etc/clientlibs/foundation/ 23 KB
7 KB 28ms
26ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/foundation/shared.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

5e4a8318d1cc410dbb2beaa0c3480335b5a71cd67728c97288ad619e34169058

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientlibs/foundation/shared.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:25 GMT
etag: "5e73-56acda2292a40-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065645-0 0CNN RT(1525208217048 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 6841
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 modern.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/ 33 KB
11 KB 28ms
27ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

c94a7abd974c79856c19536bcc51acbfd28c72d8027980e5a46fede8f0064481

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc.clientlibs/clientlibs/granite/lodash/modern.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:25 GMT
etag: "87c8-56acda2292a40-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065646-0 0CNN RT(1525208217049 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 11647
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 kernel.min.js Show response
www.fireeye.com/etc/clientlibs/foundation/personalization/ 113 KB
25 KB 31ms
29ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/foundation/personalization/kernel.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

9cb61d1b77963810d54c18b32a133870a6094c5e5afa82da0684575dad823099

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientlibs/foundation/personalization/kernel.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:25 GMT
etag: "1cf5f-56acda2292a40-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065648-0 0CNN RT(1525208217051 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 25864
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H2 200 fireeye-2-color.png
www.fireeye.com/content/dam/fireeye-www/fw/images/ 5 KB
5 KB 8ms
7ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/images/fireeye-2-color.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

a9e460758dbcc0782220f053b3c7962542e8ce5e8acfb2cf0648a601ed0591bc

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/fw/images/fireeye-2-color.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:46:17 GMT
etag: "19b5-56ace05d1dc40"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
x-iinfo: 10-34065670-0 0CNN RT(1525208217121 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=900, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 5029
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 21:11:57 GMT

GET
H2 200 Fig1.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 17 KB
17 KB 675ms
673ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig1.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

07f25a843c35fc5fc6ae44d0756d2b936e1be6499aa165b568ae45eceb808e57

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Fig1.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065672-34060930 2NNN RT(1525208217122 0) q(0 0 0 -1) r(6 6) U18
content-length: 16945
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 07:17:53 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "4231-56acf4d682a40"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:58 GMT

GET
H2 200 Fig2.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 20 KB
21 KB 677ms
676ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig2.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

11a7f958ec04c6a2e085b63d179253144a42f29a4e10df92028684d47edabed1

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Fig2.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065673-34057839 2NNN RT(1525208217122 0) q(0 0 0 -1) r(6 6) U18
content-length: 20746
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 06:34:17 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "510a-56aceb17b2c40"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:58 GMT

GET
H2 200 Fig3.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 16 KB
16 KB 659ms
658ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig3.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

02727b2ab397d4ffdee2d7f01b7e7082d68adaf23bb2b99a260274492a3f007a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Fig3.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065674-34064356 2NNN RT(1525208217124 0) q(0 0 0 -1) r(6 6) U18
content-length: 15875
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 07:17:53 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "3e03-56acf4d682a40"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:58 GMT

GET
H2 200 Fig4.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 244 KB
246 KB 189ms
187ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig4.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

a2b4aa77b7d7d9048989c55804f87d8451136c47fd3b6ac87f129da6de48b863

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Fig4.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065675-34063683 2NNN RT(1525208217124 0) q(0 0 0 -1) r(2 2) U18
content-length: 249851
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 07:17:53 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "3cffb-56acf4d682a40"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:57 GMT

GET
H2 200 Fig5.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 65 KB
65 KB 664ms
664ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig5.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

273cc71ecdba74f800919f2ed274d86e4c00350e3e3cf2b9673246a7bdaf166b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Fig5.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065679-34065680 2NNN RT(1525208217128 0) q(0 0 0 -1) r(6 6) U18
content-length: 66407
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 06:34:17 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "10367-56aceb17b2c40"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:58 GMT

GET
H2 200 Code1.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 9 KB
9 KB 492ms
492ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Code1.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

539f0ee528dde5d29cd047c2d68db4f5d8dbb65b82640e6c9e636af6f5f5b32d

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Code1.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065681-34065682 2NNN RT(1525208217132 0) q(0 0 0 -1) r(5 5) U18
content-length: 8915
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 07:17:53 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "22d3-56acf4d682a40"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:58 GMT

GET
H2 200 Code2.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 28 KB
28 KB 172ms
172ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Code2.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

f2136dc3eef62e9c8b8b070396c5cdd26b397763058e02c3aa9f68d7b6950bcb

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Code2.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065809-34065682 2NNN RT(1525208217628 0) q(0 0 0 -1) r(1 1) U18
content-length: 28476
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 06:34:18 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "6f3c-56aceb18a6e80"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:58 GMT

GET
H2 200 Fig6.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 261 KB
262 KB 179ms
174ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig6.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

b1833a64dac569d6afd5d5813be3eb5eab3b7ba1486651458cf11fe68811d83e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/blog/images/MSFT%200day/Fig6.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34065869-34057839 2NNN RT(1525208217798 0) q(0 0 0 -1) r(2 2) U18
content-length: 266792
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 06:30:11 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
cache-control: max-age=1209600
etag: "41228-56acea2d182c0"
dispatcher: ${DISP_NUM}
accept-ranges: bytes
expires: Tue, 15 May 2018 20:56:58 GMT

GET
H/1.1 200
OK Cookie set forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ 165 KB
56 KB 771ms
160ms Script
application/x-javascript 199.15.214.214
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.15.214.214 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

fb081668911311a53760f9e2f565a4f172416949e1039fb5c38316dc21e7d8eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www2.fireeye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Cookie: nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:56:58 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 26 Feb 2018 20:41:38 GMT
Server: Apache
ETag: "42dac-2927b-56623895cc480"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: Keep-Alive
Transfer-Encoding: chunked
Set-Cookie: BIGipServersjiweb-app_https=!YHVaXK8qWLTq/Vr+0lRBM0wOTlTd7yFC03/zgfeNaB8dALgLOT59e88kxZb9WJMpVaGE6byEAQ6D0PE=; path=/; Httponly; Secure
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
H2 200 rss.png
www.fireeye.com/content/dam/legacy/images/blog/ 1 KB
1 KB 12ms
11ms Image
image/png 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/legacy/images/blog/rss.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

0914d1fb1c58b2a0f48800b98fa271603e0b01dfdae72c53d622f0ea754c84ea

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/legacy/images/blog/rss.png
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:18:03 GMT
etag: "427-56acda0d978c0"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
x-iinfo: 10-34065870-34057771 2CNN RT(1525208217798 0) q(0 0 0 -1) r(0 0)
cache-control: max-age=900, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 1063
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 21:11:57 GMT

GET
H2 200 clientlibs_fw.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 101 KB
30 KB 9ms
6ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

6e68f0806b2280f195e6945d92c98695a6a12a5fb68c00775b348f8d6c9101dd

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/designs/fireeye-www/clientlibs_fw.min.js
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:46:17 GMT
etag: "1a07c-56ace05d1dc40-gzip"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
x-iinfo: 10-34065669-0 0CNN RT(1525208217120 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
date: Tue, 01 May 2018 20:56:57 GMT
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-length: 30236
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 20:56:57 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 6ms
6ms Script
application/x-javascript 23.43.123.158
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: HTTP/1.1
Server: 23.43.123.158 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-43-123-158.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d1ba8950e268ba9c8aac5eb337a0c9f74f98702b95ecf8edd50f2580da66169c

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:56:57 GMT
Content-Encoding: gzip
Last-Modified: Fri, 23 Mar 2018 01:36:13 GMT
Server: Apache
ETag: "efb9dc8a31f788b761366c6ecb50295c:1521768973"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 731

GET
S 200 conversion.js Show response
www.googleadservices.com/pagead/ 18 KB
7 KB 16ms
15ms Script
text/javascript 172.217.22.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

172.217.22.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

23941ad2251c35265baba97eef46e43b7ba2341a9d3b4e13f69b41eddb61c2e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 01 May 2018 20:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 17675284145658750604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 6805
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 20:56:57 GMT

GET
S 200 gtm.js Show response
www.googletagmanager.com/ 72 KB
27 KB 23ms
22ms Script
application/javascript 216.58.214.72
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

216.58.214.72 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f72.1e100.net

Software

Google Tag Manager (scaffolding) /

Resource Hash

91bf238fe33b5051df7d1c52336fb7803deec5cb367b11c2ca1978949f94951c

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:56:57 GMT
content-encoding: gzip
server: Google Tag Manager (scaffolding)
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 27096
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 20:56:57 GMT

GET
S 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 735 B
1 KB 89ms
69ms XHR
application/vnd.maxmind.com-country+json 104.16.37.47
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js
Protocol: SPDY
Server: 104.16.37.47 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7daec4b20697bd4f5fe0cf3b0fb02108e9adbc9cbd391ddf973a1ee2996b86a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Origin: https://www.fireeye.com

Response headers

date: Tue, 01 May 2018 20:56:57 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 4145285fc8406445-FRA
content-length: 735

GET
S 200 dc.js Show response
stats.g.doubleclick.net/ 45 KB
17 KB 14ms
14ms Script
text/javascript 74.125.133.157
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

74.125.133.157 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

wo-in-f157.1e100.net

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 12 Apr 2018 18:13:11 GMT
server: Golfe2
age: 6503
date: Tue, 01 May 2018 19:08:34 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 17093
expires: Tue, 01 May 2018 21:08:34 GMT

GET
H/1.1 200
OK satelliteLib-018e5c8fee015d61f6e2636ab102f2624be19551.js Show response
assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/ 110 KB
34 KB 26ms
14ms Script
application/x-javascript 2.18.233.142
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/satelliteLib-018e5c8fee015d61f6e2636ab102f2624be19551.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_analytics.min.js
Protocol: HTTP/1.1
Server: 2.18.233.142 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: a20e7e269dcfd108ca39cc2bab41e0d7620b039b623b19ed4d7c3c22186b6cd0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 01 May 2018 20:56:57 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Apr 2018 07:00:13 GMT
Server: Apache
ETag: "33604faa188b69651b1d4d6850a4b590:1523602813"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 34089
Expires: Tue, 01 May 2018 21:56:57 GMT

GET
S

200

ga-audiences
www.google.nl/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1144530451&utmhn=www.fireeye.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=CVE...
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=833584357&_v=5.7.2dc&z=1144530451
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=833584357&_v=5.7.2dc&z=1144530451&slf_rd=1&random=1379067227

42 B
109 B

16ms
15ms

Image
image/gif

216.58.214.67
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=833584357&_v=5.7.2dc&z=1144530451&slf_rd=1&random=1379067227

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

216.58.214.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:57 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=833584357&_v=5.7.2dc&z=1144530451&slf_rd=1&random=1379067227
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 13 KB
4 KB 7ms
6ms Script
application/x-javascript 23.45.97.17
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Server: 23.45.97.17 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-97-17.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 656099b1659bc72032a58e03ced048ca583dec3870bf87eb7c4cdaaef8dc6bc5

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:56:57 GMT
Content-Encoding: gzip
Last-Modified: Thu, 12 Apr 2018 21:09:56 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=26902
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4010

GET
S 200 bat.js Show response
bat.bing.com/ 14 KB
5 KB 38ms
38ms Script
application/javascript 204.79.197.200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: SPDY
Server: 204.79.197.200 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: a-0001.a-msedge.net
Software: /
Resource Hash: 9ce0ee6328d3d728d275078eb32504a47430946b6189d7de5dc8552246b2ffdb

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:56:57 GMT
content-encoding: gzip
last-modified: Wed, 18 Apr 2018 09:34:21 GMT
x-msedge-ref: Ref A: AF7EBE481BAB4A888DBEC8542D8A6069 Ref B: FRAEDGE0906 Ref C: 2018-05-01T20:56:57Z
status: 200
etag: "80c66ef8d6d31:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 4427

GET
S 200 js Show response
www.googletagmanager.com/gtag/ 64 KB
22 KB 14ms
14ms Script
application/javascript 216.58.214.72
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-8443343

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

SPDY

Server

216.58.214.72 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f72.1e100.net

Software

Google Tag Manager (scaffolding) /

Resource Hash

13d79cef4d43875e481796021baf97fb5dd6de33f132d0dfb69dbce5fe61adda

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:56:57 GMT
content-encoding: gzip
server: Google Tag Manager (scaffolding)
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 22858
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 20:56:57 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 219 B
995 B 116ms
31ms XHR
application/json 34.249.172.115
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://dpm.demdex.net/id?d_visid_ver=1.6.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=12390CDB53E9CC840A490D4E%40AdobeOrg&d_nsid=0&ts=1525208217679
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/satelliteLib-018e5c8fee015d61f6e2636ab102f2624be19551.js
Protocol: HTTP/1.1
Server: 34.249.172.115 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-249-172-115.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e74d0a901c9d8a7b7e708076d944eece8f13f17d944acb4d4b77c33e0bddc029

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: irl1-prod-dcs-dfbb781f.edge-irl1.demdex.com 5.28.4.20180427090211 5ms
Pragma: no-cache
Date: Tue, 01 May 2018 20:56:57 GMT
Content-Encoding: gzip
X-TID: r9DxR4bTRTM=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=UTF-8
Content-Length: 205
Expires: Thu, 01 Jan 2009 00:00:00 GMT

GET
H/1.1 200
OK mbox-contents-b8c0af0f30e70fb0504427e46d7b77a937a9d4a7.js Show response
assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/ 40 KB
12 KB 8ms
7ms Script
application/x-javascript 2.18.233.142
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/mbox-contents-b8c0af0f30e70fb0504427e46d7b77a937a9d4a7.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/satelliteLib-018e5c8fee015d61f6e2636ab102f2624be19551.js
Protocol: HTTP/1.1
Server: 2.18.233.142 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 69070c1ea5fb699759e671e04096910961b0b075dd7269d141f705f0d79d6202

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 01 May 2018 20:56:57 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Apr 2018 07:00:13 GMT
Server: Apache
ETag: "ddc4d7f59520cd7fb2e3fb9c9bfbb36a:1523602813"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 11896
Expires: Tue, 01 May 2018 21:56:57 GMT

GET
S 200 fbevents.js Show response
connect.facebook.net/en_US/ 39 KB
12 KB 6ms
6ms Script
application/x-javascript 157.240.20.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

157.240.20.19 Menlo Park, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-02-frt3.fbcdn.net

Software

Resource Hash

112560223d7dcf6f78bd1f4f1271590233b6cd02adf7a10f896b0f628c2c4d24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 12398
x-xss-protection: 0
pragma: public
x-fb-debug: leqww+MTLb1cqKtY8wDBqkkFj6pRMrJcYqloUW3ruczMDjHorkkKQmZa7m5eXUnZ94gosGTDdw+LD8xyKGmp4g==
date: Tue, 01 May 2018 20:56:57 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 204 0
bat.bing.com/action/ 0
93 B 35ms
35ms Image
text/plain 204.79.197.200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5870833&Ver=2&mid=5231e019-f461-d6c2-1d33-f88ff57fa040&evt=pageLoad&sid=91ff0b75-1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&r=&msclkid=N&rn=138776
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: SPDY
Server: 204.79.197.200 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: a-0001.a-msedge.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Tue, 01 May 2018 20:56:57 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 37DE498F538A4A15987CC22DB8C371DD Ref B: FRAEDGE0906 Ref C: 2018-05-01T20:56:57Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK target.js Show response
cdn.tt.omtrdc.net/cdn/ 43 KB
14 KB 22ms
6ms Script
text/javascript 104.109.87.116
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tt.omtrdc.net/cdn/target.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/mbox-contents-b8c0af0f30e70fb0504427e46d7b77a937a9d4a7.js
Protocol: HTTP/1.1
Server: 104.109.87.116 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-87-116.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: fa33bdafc55d1404ff41c75d0798872676e2eac896f90652d1bf252deb032854

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 01 May 2018 20:56:57 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 04:13:03 GMT
Server: Apache
ETag: "4400f1-aa3e-56ab89a9c0948"
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: must-revalidate, max-age=2026
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14199

GET
S 200 1847206522249226 Show response
connect.facebook.net/signals/config/ 55 KB
14 KB 7ms
6ms Script
application/x-javascript 157.240.20.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1847206522249226?v=2.8.14&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

SPDY

Server

157.240.20.19 Menlo Park, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-02-frt3.fbcdn.net

Software

Resource Hash

d62e6662fcd83693024b89c47c92df014f56b1083bfa0f9128e3d1c94dd76bc4

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 13406
x-xss-protection: 0
pragma: public
x-fb-debug: LjtamJD5pknAUSbjO1r15mHN1yA6yuaYD+YDAUYFR2XqnE2MdWy3zA/OoMGZiD0vWUX3J/zHRdMcTvEVEGNJ8Q==
x-frame-options: DENY
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
98 B 6ms
6ms Image
image/gif 157.240.20.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=1847206522249226&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&rl=&if=false&ts=1525208217746&sw=1600&sh=1200&v=2.8.14&r=stable&ec=0&o=30&it=1525208217732
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: SPDY
Server: 157.240.20.35 Menlo Park, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS: edge-star-mini-shv-02-frt3.facebook.com
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:56:57 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Tue, 01 May 2018 20:56:57 GMT

GET
H2 200 hpb-bg-testimonial-blue.jpg
www.fireeye.com/content/dam/fireeye-www/brand/homepage-banner-images/ 35 KB
35 KB 284ms
284ms Image
image/jpeg 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/brand/homepage-banner-images/hpb-bg-testimonial-blue.jpg

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

017bf8b7865aa3589f54e881370a1bcf1d4251ffead66504e0f15fdfad7ffceb

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/brand/homepage-banner-images/hpb-bg-testimonial-blue.jpg
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653; _uetsid=_uet91ff0b75; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options: nosniff
last-modified: Fri, 27 Apr 2018 05:59:47 GMT
etag: "8f7e-56ace36197ac0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
status: 200
x-iinfo: 10-34065744-34057771 2CNN RT(1525208217340 0) q(0 3 3 -1) r(3 3)
cache-control: max-age=900, public
date: Tue, 01 May 2018 20:56:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 35769
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 21:11:57 GMT

GET
DATA 200
OK truncated
/ 24 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e814429f256ea8ec0ad72336781d173957c540d8b2948290f525b9af3524df07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Origin: https://www.fireeye.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 25 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4af82da2a4711e51f79b49c07d7ab53667971f62ddfa3417cde1555bdf53518d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Origin: https://www.fireeye.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 25 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 40673867a3691016c690bacfd50b6e5aa2b41c6e2cd238075126c0db41fd6216

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Origin: https://www.fireeye.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
H2 200 fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/ 58 KB
29 KB 9ms
5ms Font
application/font-woff 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rj

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

e68bbc5ef346e3ca56aa7acf09654640ccd4d9e4a3bb63aed1484aba31b3f99b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /content/dam/fireeye-www/fw/f/fireicons.woff?mva1rj
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653; _uetsid=_uet91ff0b75; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078
origin: https://www.fireeye.com
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.css
Origin: https://www.fireeye.com

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
etag: "f4ba665f"
x-frame-options: SAMEORIGIN
content-type: application/font-woff
status: 200
x-iinfo: 10-34065735-0 0CNN RT(1525208217309 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=43200, public
date: Tue, 01 May 2018 20:56:57 GMT
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-length: 29698
x-xss-protection: 1; mode=block
expires: Wed, 02 May 2018 08:56:57 GMT

GET
DATA 200
OK truncated
/ 25 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ccf598394e80ad055a43deb9e2cb616d4ee5579a707daeb655137dd59829865

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Origin: https://www.fireeye.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
H/1.1 200
OK id Show response
fireeye.sc.omtrdc.net/ 3 B
394 B 66ms
21ms XHR
application/x-javascript 172.82.228.19
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://fireeye.sc.omtrdc.net/id?d_visid_ver=1.6.0&d_fieldgroup=A&mcorgid=12390CDB53E9CC840A490D4E%40AdobeOrg&mid=18027846659949159281159865447294478782&ts=1525208217844
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/satelliteLib-018e5c8fee015d61f6e2636ab102f2624be19551.js
Protocol: HTTP/1.1
Server: 172.82.228.19 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.sc.omtrdc.net
Software: Omniture DC/2.0.0 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Origin: https://www.fireeye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Tue, 01 May 2018 20:56:57 GMT
Server: Omniture DC/2.0.0
xserver: www272
Vary: Origin
Access-Control-Allow-Methods: GET, POST, DELETE
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: https://www.fireeye.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 3
X-C: ms-6.1.5

GET
S 200 ajax Show response
fireeye.tt.omtrdc.net/m2/fireeye/mbox/ 259 B
438 B 64ms
28ms Script
text/javascript 66.117.29.11
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/ajax?mboxHost=www.fireeye.com&mboxPage=acc704700c1646009a1bd35be50b80fc&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=0&colorDepth=24&mboxSession=acc704700c1646009a1bd35be50b80fc&mboxCount=1&mboxTime=1525208217722&DTMisStage=%25DTMisStage%25&buildDate=%25buildDate%25&mbox=target-global-mbox&mboxId=0&mboxMCSDID=7598E0932E011ED3-3887042766FDCC7A&mboxMCGVID=18027846659949159281159865447294478782&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCGLH=6&vst.trk=fireeye.d5.sc.omtrdc.net&vst.trks=fireeye.sc.omtrdc.net&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&mboxReferrer=&mboxVersion=63
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/mbox-contents-b8c0af0f30e70fb0504427e46d7b77a937a9d4a7.js
Protocol: SPDY
Server: 66.117.29.11 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: /
Resource Hash: 260772996600ba7b1f88bfbb9756a93edbd4f735371e09027da2e3ae1eec84dd

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:57 GMT
content-type: text/javascript;charset=utf-8
status: 200
cache-control: no-cache
timing-allow-origin: *
content-length: 259
x-application-context: edge:prod,prod-prod26,prod-prod26-app,prod26:11180

GET
S 200 analytics.js Show response
www.google-analytics.com/ 34 KB
14 KB 38ms
6ms Script
text/javascript 172.217.22.46
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

SPDY

Server

172.217.22.46 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 12 Apr 2018 18:13:11 GMT
server: Golfe2
age: 52
date: Tue, 01 May 2018 20:56:06 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 14353
expires: Tue, 01 May 2018 22:56:06 GMT

GET
S

200

ga-audiences
www.google.nl/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j67&a=1505333431&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_gid=634096335.1525208218&gjid=818471506&_v=j67&z=211798485
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_v=j67&z=211798485
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_v=j67&z=211798485&slf_rd=1&random=4029652493

42 B
109 B

16ms
16ms

Image
image/gif

216.58.214.67
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_v=j67&z=211798485&slf_rd=1&random=4029652493

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

216.58.214.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:58 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=1624232352.1525208218&jid=177009242&_v=j67&z=211798485&slf_rd=1&random=4029652493
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
103 B 18ms
12ms Image
image/gif 172.217.22.46
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j67&a=1505333431&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de=UTF-8&dt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Forms&ea=Incident%20Response&el=%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&_utma=214676736.1624232352.1525208218.1525208218.1525208218.1&_utmz=214676736.1525208218.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1525208218381&_u=YQDCAEAB~&jid=&gjid=&cid=1624232352.1525208218&tid=UA-363943-1&_gid=634096335.1525208218&gtm=G4dMVGC8KK&z=1605351654

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

172.217.22.46 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 02:58:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 64684
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
103 B 17ms
12ms Image
image/gif 172.217.22.46
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j67&a=1505333431&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de=UTF-8&dt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Forms&ea=Security%20Assessment&el=%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&_utma=214676736.1624232352.1525208218.1525208218.1525208218.1&_utmz=214676736.1525208218.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1525208218398&_u=YQDCAEAB~&jid=&gjid=&cid=1624232352.1525208218&tid=UA-363943-1&_gid=634096335.1525208218&gtm=G4dMVGC8KK&z=147916118

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

172.217.22.46 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 02:58:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 64684
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
108 B 16ms
11ms Image
image/gif 172.217.22.46
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j67&a=1505333431&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de=UTF-8&dt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Forms&ea=Free%20Software&el=%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&_utma=214676736.1624232352.1525208218.1525208218.1525208218.1&_utmz=214676736.1525208218.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1525208218402&_u=YQDCAEAB~&jid=&gjid=&cid=1624232352.1525208218&tid=UA-363943-1&_gid=634096335.1525208218&gtm=G4dMVGC8KK&z=365583432

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

172.217.22.46 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 02:58:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 64684
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.0 200
OK getForm Show response
www2.fireeye.com/index.php/form/ 12 KB
12 KB 371ms
354ms Script
application/javascript 199.15.214.214
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&callback=jQuery110202998496297016542_1525208218668&_=1525208218669

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.15.214.214 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

b08b2d860ed3726c2de94f3c6192d8b0a9432380e4ab05fa2874328b921d8102

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www2.fireeye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Cookie: nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; BIGipServersjiweb-app_https=!YHVaXK8qWLTq/Vr+0lRBM0wOTlTd7yFC03/zgfeNaB8dALgLOT59e88kxZb9WJMpVaGE6byEAQ6D0PE=; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:56:58 GMT
X-Content-Type-Options: nosniff
Server: Apache
Connection: close
Content-Type: application/javascript; charset=utf-8

GET
S 200 ytc.js Show response
s.yimg.com/wi/ 14 KB
4 KB 130ms
130ms Script
application/javascript 87.248.118.22
Yahoo!

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

87.248.118.22 , United Kingdom, ASN10310 (YAHOO-1 - Yahoo!, US),

Reverse DNS

e1.ycpi.vip.deb.yahoo.com

Software

ATS /

Resource Hash

42bf4918673d512ac1b7d4693832335ee21c7ccc8236b65e58a5fb17d473da10

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:56:58 GMT
content-encoding: gzip
last-modified: Tue, 24 Apr 2018 01:30:19 GMT
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Accept-Encoding
content-type: application/javascript
status: 200
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
strict-transport-security: max-age=15552000
accept-ranges: bytes
content-length: 4039
via: http/1.1 spdc0027.pbp.ir2.yahoo.com (ApacheTrafficServer), https/1.1 e8.ycpi.deb.yahoo.com (ApacheTrafficServer [cMsSf ])

GET
S 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1063990389/ 2 KB
1 KB 46ms
46ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1063990389/?random=1525208218872&cv=9&fst=1525208218872&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&tiba=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

SPDY

Server

172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f162.1e100.net

Software

cafe /

Resource Hash

3fd6902b7fdd2be2acae610dbb2f42907a38b184075dd5cbcb53edea4fd7251d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1002
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 350 KB
112 KB 39ms
24ms Script
application/javascript 2.21.160.128
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s7.addthis.com/js/300/addthis_widget.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: SPDY
Server: 2.21.160.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 387cd2f4aae9d51cfdb45a797f96deb8fc9ec549009971dd73275be87dd77652

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:56:58 GMT
content-encoding: gzip
surrogate-key: client_dist
last-modified: Mon, 30 Apr 2018 15:49:58 GMT
server: nginx
etag: "5ae73b26-57958"
vary: Accept-Encoding
x-distribution: 99
cache-tag: client_dist
status: 200
cache-control: public, max-age=600
x-host: s7.addthis.com
accept-ranges: bytes
timing-allow-origin: *
content-type: application/javascript

GET
H2 200 _Incapsula_Resource Show response
www.fireeye.com/ 113 KB
16 KB 12ms
11ms Script
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fireeye.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=146275311
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS: 149.126.77.186.ip.incapdns.net
Software: /
Resource Hash: 33d64e65f4e496e717276247cd2c8a9da92adabecee2571b9c0dcaf702e5bf89

Request headers

:path: /_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=146275311
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

status: 200
content-encoding: gzip
cache-control: no-cache
content-length: 16673
content-type: application/javascript

GET
H2 200 parsys-navigation.html Show response
www.fireeye.com/shared/megamenus/jcr:content/ 13 KB
2 KB 9ms
9ms XHR
text/html 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/shared/megamenus/jcr:content/parsys-navigation.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

b4327d80eec1c41b7cc86f5240fa83469b02f2f60c44418340ea28108bd3bb32

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /shared/megamenus/jcr:content/parsys-navigation.html
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:method: GET
Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 01 May 2018 20:09:28 GMT
etag: "4403-56b2a8c2bbf8d-gzip"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
status: 200
x-iinfo: 10-34066068-0 0CNN RT(1525208218404 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=300, public
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 2277
x-xss-protection: 1; mode=block
expires: Tue, 01 May 2018 21:01:58 GMT

GET
H2 200 segmentation.segment.js Show response
www.fireeye.com/etc/ 12 KB
937 B 188ms
188ms XHR
application/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/segmentation.segment.js?_=1525208217543

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

794726d8c8a0537a40788be73391b64e6ba84d8b3e9d1e4a477967fe9a8fb7b3

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/segmentation.segment.js?_=1525208217543
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
cache-control: no-cache
:authority: www.fireeye.com
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:method: GET
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff
status: 200
x-iinfo: 10-34066070-34063683 2NNN RT(1525208218414 0) q(0 0 0 -1) r(1 1) U18
vary: Accept-Encoding,User-Agent
content-length: 779
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Apr 2018 20:14:39 GMT
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
etag: "2f0b-56ada275749c0-gzip"
dispatcher: ${DISP_NUM}
accept-ranges: bytes

GET
H2 200 stores.init.js Show response
www.fireeye.com/etc/clientcontext/default/content/jcr:content/ 5 KB
1 KB 183ms
182ms XHR
text/javascript 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler&_=1525208217544

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

c8a761c3deac94fbd6e6aae681b9281c5e43b7d57a1574fa93c3f65ff040e9da

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler&_=1525208217544
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
cache-control: no-cache
:authority: www.fireeye.com
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:method: GET
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff nosniff
date: Tue, 01 May 2018 20:56:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
x-iinfo: 10-34066071-34065682 2NNN RT(1525208218415 0) q(0 0 0 -1) r(1 1) U18
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,User-Agent
content-length: 1260
dispatcher: ${DISP_NUM}

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/153/ 8 KB
4 KB 7ms
6ms Script
application/x-javascript 23.43.123.158
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/153/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Server: 23.43.123.158 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-43-123-158.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 88694454a2bc3241a6531d725aa9f7f53725d43f59eb07418753f8f819ec46b5

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:56:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 02 Jun 2017 17:28:55 GMT
Server: Apache
ETag: "fafeea2338ae61b3f895cc89d77ce074:1496424535"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 3659
Expires: Thu, 09 Aug 2018 20:56:58 GMT

GET
H/1.1 200
OK s-code-contents-9ce38d55235aac587fd33aff852adda8ed05817d.js Show response
assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/ 56 KB
21 KB 10ms
10ms Script
application/x-javascript 2.18.233.142
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/s-code-contents-9ce38d55235aac587fd33aff852adda8ed05817d.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1790e736b614e0afecbbbf9be7069b90b875fdd6/satelliteLib-018e5c8fee015d61f6e2636ab102f2624be19551.js
Protocol: HTTP/1.1
Server: 2.18.233.142 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 433fb5a9934811099ea8158aa37244f52e86495cd0ce8a43dbdea8e1f2073900

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:56:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Apr 2018 07:00:13 GMT
Server: Apache
ETag: "4ce0244428c665a384b4bb0b58b1fef1:1523602813"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 21199
Expires: Tue, 01 May 2018 21:56:58 GMT

GET
S

200

/ Show response
dc.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?time=1525208218896&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fi...
https://px.ads.linkedin.com/collect/?time=1525208218896&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fi...
https://www.linkedin.com/csp/dtag?_x=%2526s%253D1%2526url%253Dhttps%25253A%25252F%25252Fwww.fireeye.com%25252Fblog%25252Fthreat-research%25252F2017%25252F04%25252Fcve-2017-0199-hta-handler.html%252...
https://dc.ads.linkedin.com/collect/?pid=6883&s=1&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fireeye.com%2Fblo...

0
94 B

110ms
110ms

Script
application/javascript

185.63.145.5
LinkedIn Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://dc.ads.linkedin.com/collect/?pid=6883&s=1&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ref=&cookiesTest=true&opid=6572&fmt=js&time=1525208218896
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: SPDY
Server: 185.63.145.5 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:57:00 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 20
x-li-uuid: vXHA2sOgKhUQPVqXwyoAAA==

Redirect headers

date: Tue, 01 May 2018 20:56:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-li-fabric: prod-lva1
status: 302
strict-transport-security: max-age=2592000
x-li-uuid: kd3br8WgKhVQ7LTWSysAAA==
server: Apache-Coyote/1.1
pragma: no-cache
x-li-pop: prod-efr5
vary: Accept-Encoding
content-language: en-US
location: https://dc.ads.linkedin.com/collect/?pid=6883&s=1&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&pageUrl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ref=&cookiesTest=true&opid=6572&fmt=js&time=1525208218896
x-xss-protection: 1; mode=block
cache-control: no-store, private
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ wss://*.linkedin.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com; object-src 'none'; media-src blob: *; frame-ancestors http://*.adnxs.com https://*.adnxs.com http://*.linkedin.com https://*.linkedin.com http://*.slideshare.net https://*.slideshare.net https://*.msn.com http://*.msn.com http://*.outlook.com https://*.outlook.com translate.googleusercontent.com pemberly.www.linkedin.com:4443; report-uri https://www.linkedin.com/lite/contentsecurity?f=ad
x-li-proto: http/2
x-fs-uuid: 91dddbafc5a02a1550ecb4d64b2b0000

GET
H/1.1 200
OK visitWebPage Show response
848-did-242.mktoresp.com/webevents/ 43 B
622 B 763ms
150ms XHR
image/gif 199.15.215.200
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://848-did-242.mktoresp.com/webevents/visitWebPage?_mchNc=1525208218923&_mchCn=&_mchId=848-DID-242&_mchTk=_mch-fireeye.com-1525208218921-25058&_mchHo=www.fireeye.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&_mchPc=https%3A&_mchVr=153&_mchHa=&_mchRe=&_mchQp=

Requested by

Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/153/munchkin.js

Protocol

HTTP/1.1

Server

199.15.215.200 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

cbbd42bb1d88693e6805bd9d676840424af5ecf3e13d874fd06e6b57d53d8d40

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Origin: https://www.fireeye.com

Response headers

Pragma: no-cache
Date: Tue, 01 May 2018 20:56:59 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 01 May 2018 15:56:59 -0500
Server: Apache
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: Keep-Alive
Content-Type: image/gif
Keep-Alive: timeout=5, max=100
Content-Length: 43
Expires: -1

GET
H/1.1 200
OK s29453771439341
fireeye.sc.omtrdc.net/b/ss/fireeyev1prod/1/JS-1.6.2-D7QN/ 43 B
526 B 30ms
29ms Image
image/gif 172.82.228.19
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fireeye.sc.omtrdc.net/b/ss/fireeyev1prod/1/JS-1.6.2-D7QN/s29453771439341?AQB=1&ndh=1&pf=1&t=1%2F4%2F2018%2020%3A56%3A58%202%200&sdid=7598E0932E011ED3-3887042766FDCC7A&D=D%3D&mid=18027846659949159281159865447294478782&aamlh=6&ce=UTF-8&pageName=us-en%3Ablog%3Athreat-research%3A2017%3A04%3Acve-2017-0199-hta-handler&g=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&cc=USD&ch=FireEye%20Blogs&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c9=D%3Dv9&v9=FireEye%20Blogs&c10=D%3Dv10&v10=Threat%20Research&c11=US&v11=US&c20=D%3Dv27&c22=%2Fundefined%2Fundefined%2F&c23=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20...%0A%09%09&v27=%25Content%20Category%3A%20Level%203%25&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: HTTP/1.1
Server: 172.82.228.19 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.sc.omtrdc.net
Software: Omniture DC/2.0.0 /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 01 May 2018 20:56:58 GMT
Last-Modified: Wed, 02 May 2018 20:56:58 GMT
Server: Omniture DC/2.0.0
xserver: www272
ETag: "3275359708037316608-4859561195398926531"
Vary: *
X-C: ms-6.1.5
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 30 Apr 2018 20:56:58 GMT

GET
H2 200 _Incapsula_Resource
www.fireeye.com/ 1 B
34 B 7ms
6ms Image
text/plain 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.fireeye.com/_Incapsula_Resource?SWKMTFSR=1&e=0.2916432979238801
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS: 149.126.77.186.ip.incapdns.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /_Incapsula_Resource?SWKMTFSR=1&e=0.2916432979238801
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1525208218921-25058; tp=7048; s_ppv=us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200; s_cc=true; ___utmvc=wl3kE7p05ANbwFRBmIGc9HwQ5MQowT1B03NMRWH0hBiggCyHGy2K1Dk6g41dDCbWsF377nmyTZ8cntBjp0qq+Ob2P3NxwGjPWL/xdrYU/KqPG3RG1EbY7NFTIgBd7weGux/DOBBrq6mEVgaaty4IrRBM/0MNGq9mJluhzwEyQ2Sj3kviwvaD82osEQkEkiEPTrso9mzO7+VV0m36dnht/hwwtYRN+QkF2uVMBg2oLylprSQBYvqiT3bfcXOBs4o5zH5f6oev2U50GErv7+/gnOX7Yj7Th/u7Ob14srLTbDaiK5zkSIZvK3rzXDwTACcdkPgwZqQ1t7gJkF3GuJXFnlxdJ8ObALx/ZYIvnXknPDHlUOTIoYL8NhsgAgSW3dDdOeVIih/eLE7JnLgsMhLOhG5AZp01XMeKPcSJV5rxAM9qvkuD5NJO9O8Vw0IvVwJJT7IY59OVGN0G+jtG5zfGBlIeT3iPMpN7a/zDsbDOVLJVwNWkKEY7lVTeWIQWPeiuIXNtKcyx6FokqrJN5v5uHAWprAprJrJbNY06TvFjbdQp0zwGRXIDWeeB15PtFsQqA0YVDgic3AaQW4oAdMv2CCTWuIlvtmc/fJgdBMbqDDceY0NjhbZBydkOWvaKss9yIF7iUar+u5xOWP4re4i2rKgoJpvBDcg//zRg85YrCxavWgVV9f9BzuwRIHKVO6hpCVH08MA9hBHIHjO4navfAkkCQiGI1LBuuPZu8GtfFdRejC+7yH3dFPe4H8tY64SANJjMY3z4fT4qOXK3/3qS/LqWLtJRW/Q33IZ/RK057hH3Cb5MJ/RHrZXj0fHwjd2WCVwMWrbZQ5qR8kB/D//lih8g/uHeYCJ3cqKYa/mn4eDPEL88j6RkcG09RhLB2b/0nH+4UcdhWpiTW5pVdf8DGmbY9OKImLfEW11cIwLUoGopbbMu8junEeQC7pgzwQERHaD0wpBB0URc2C3HXk/gAjOzmBvVgmiHvoc3U7PR3G2NElbFXgYZj4OhHORtsC2bIH/5aWeJGqhvMAMxVzJKWxO+ZdOGCz2w2j6i1iShmaJp2HYgyela+RDn+QH1iRjCTidOxuQwwWrm97HzTCHEpe4WLGRpZ2VzdD04MTkxNyxzPWEzNjQ4NmEzOGVhOGEwODQ4NTlmNjc5ZmIxNjI5YTliN2RhNDg4NmJiMTdiOGJhYTg0YWRhMTdjNjI4MzkyNzY4ZGFhNjI3YTczYTA2ZTc0
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.fireeye.com
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:scheme: https
:method: GET
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

status: 200
cache-control: no-cache
content-length: 1
content-type: text/plain

GET
S 200 /
www.google.com/ads/user-lists/1063990389/ 42 B
116 B 15ms
15ms Image
image/gif 172.217.22.68
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/user-lists/1063990389/?random=1525208218872&cv=9&fst=1525204800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&tiba=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&fmt=3&cdct=2&is_vtc=1&random=1739750478&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

172.217.22.68 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s17-in-f68.1e100.net

Software

adclick_server /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:58 GMT
x-content-type-options: nosniff
server: adclick_server
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 /
www.google.nl/ads/user-lists/1063990389/ 42 B
107 B 14ms
14ms Image
image/gif 216.58.214.67
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/user-lists/1063990389/?random=1525208218872&cv=9&fst=1525204800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&tiba=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&fmt=3&cdct=2&is_vtc=1&random=1739750478&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

SPDY

Server

216.58.214.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f3.1e100.net

Software

adclick_server /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:58 GMT
x-content-type-options: nosniff
server: adclick_server
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 sp.pl Show response
sp.analytics.yahoo.com/ 0
2 KB 108ms
34ms Script
application/x-javascript 188.125.66.33
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&jsonp=YAHOO.ywa.I13N.handleJSONResponse&d=Tue%2C%2001%20May%202018%2020%3A56%3A59%20GMT&n=0&b=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&.yp=435600&f=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&enc=UTF-8

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

SPDY

Server

188.125.66.33 , Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 01 May 2018 20:56:59 GMT
via: http/1.1 spdc0032.pbp.ir2.yahoo.com (ApacheTrafficServer)
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: application/x-javascript
status: 200
cache-control: no-cache, private, must-revalidate
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
accept-ranges: bytes
content-length: 0
expires: Tue, 01 May 2018 20:56:59 GMT

GET
H/1.1 200 loader.json Show response
www.fireeye.com/etc/clientcontext/default/contextstores/twitterprofiledata/ 64 B
284 B 656ms
656ms XHR
application/json 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/contextstores/twitterprofiledata/loader.json?authorizableId=anonymous

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Protocol

HTTP/1.1

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

5529960538c68ee9fae25260035ba2191ea3141953179b00be4efdb47595d1f2

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientcontext/default/contextstores/twitterprofiledata/loader.json?authorizableId=anonymous
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1525208218921-25058; tp=7048; s_ppv=us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200; s_cc=true; ___utmvc=wl3kE7p05ANbwFRBmIGc9HwQ5MQowT1B03NMRWH0hBiggCyHGy2K1Dk6g41dDCbWsF377nmyTZ8cntBjp0qq+Ob2P3NxwGjPWL/xdrYU/KqPG3RG1EbY7NFTIgBd7weGux/DOBBrq6mEVgaaty4IrRBM/0MNGq9mJluhzwEyQ2Sj3kviwvaD82osEQkEkiEPTrso9mzO7+VV0m36dnht/hwwtYRN+QkF2uVMBg2oLylprSQBYvqiT3bfcXOBs4o5zH5f6oev2U50GErv7+/gnOX7Yj7Th/u7Ob14srLTbDaiK5zkSIZvK3rzXDwTACcdkPgwZqQ1t7gJkF3GuJXFnlxdJ8ObALx/ZYIvnXknPDHlUOTIoYL8NhsgAgSW3dDdOeVIih/eLE7JnLgsMhLOhG5AZp01XMeKPcSJV5rxAM9qvkuD5NJO9O8Vw0IvVwJJT7IY59OVGN0G+jtG5zfGBlIeT3iPMpN7a/zDsbDOVLJVwNWkKEY7lVTeWIQWPeiuIXNtKcyx6FokqrJN5v5uHAWprAprJrJbNY06TvFjbdQp0zwGRXIDWeeB15PtFsQqA0YVDgic3AaQW4oAdMv2CCTWuIlvtmc/fJgdBMbqDDceY0NjhbZBydkOWvaKss9yIF7iUar+u5xOWP4re4i2rKgoJpvBDcg//zRg85YrCxavWgVV9f9BzuwRIHKVO6hpCVH08MA9hBHIHjO4navfAkkCQiGI1LBuuPZu8GtfFdRejC+7yH3dFPe4H8tY64SANJjMY3z4fT4qOXK3/3qS/LqWLtJRW/Q33IZ/RK057hH3Cb5MJ/RHrZXj0fHwjd2WCVwMWrbZQ5qR8kB/D//lih8g/uHeYCJ3cqKYa/mn4eDPEL88j6RkcG09RhLB2b/0nH+4UcdhWpiTW5pVdf8DGmbY9OKImLfEW11cIwLUoGopbbMu8junEeQC7pgzwQERHaD0wpBB0URc2C3HXk/gAjOzmBvVgmiHvoc3U7PR3G2NElbFXgYZj4OhHORtsC2bIH/5aWeJGqhvMAMxVzJKWxO+ZdOGCz2w2j6i1iShmaJp2HYgyela+RDn+QH1iRjCTidOxuQwwWrm97HzTCHEpe4WLGRpZ2VzdD04MTkxNyxzPWEzNjQ4NmEzOGVhOGEwODQ4NTlmNjc5ZmIxNjI5YTliN2RhNDg4NmJiMTdiOGJhYTg0YWRhMTdjNjI4MzkyNzY4ZGFhNjI3YTczYTA2ZTc0
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:method: GET
Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json; charset=UTF-8
status: 200
x-iinfo: 10-34066136-34066137 NNNN CT(157 325 0) RT(1525208218643 0) q(0 0 5 -1) r(6 6) U10000
x-xss-protection: 1; mode=block
set-cookie: ___utmvc=a; Max-Age=0; path=/; expires=Sun, 29 Apr 2018 11:55:13 GMT
vary: User-Agent
dispatcher: ${DISP_NUM}

GET
H/1.1 200 loader.json Show response
www.fireeye.com/etc/clientcontext/default/contextstores/fbprofiledata/ 63 B
162 B 173ms
173ms XHR
application/json 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/contextstores/fbprofiledata/loader.json?authorizableId=anonymous

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Protocol

HTTP/1.1

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

3a81ad9bc69582468671824f1bd4b9e3c3c82ce201480394e47b04a534cb7094

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientcontext/default/contextstores/fbprofiledata/loader.json?authorizableId=anonymous
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1525208218921-25058; tp=7048; s_ppv=us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200; s_cc=true
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:method: GET
Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:56:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json; charset=UTF-8
status: 200
x-iinfo: 10-34066340-34066137 PNNN RT(1525208219303 0) q(0 0 0 -1) r(1 1) U10000
dispatcher: ${DISP_NUM}
vary: User-Agent
x-xss-protection: 1; mode=block

GET
H/1.1 200 loader.json Show response
www.fireeye.com/etc/clientcontext/default/contextstores/fbinterestsdata/ 5 B
136 B 169ms
169ms XHR
application/json 149.126.77.186
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/contextstores/fbinterestsdata/loader.json?authorizableId=anonymous

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Protocol

HTTP/1.1

Server

149.126.77.186 Frankfurt, Germany, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

149.126.77.186.ip.incapdns.net

Software

Resource Hash

7b86d506062bf09d8db4e081fbf442b773929e5c13a70f415243e12185f37767

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /etc/clientcontext/default/contextstores/fbinterestsdata/loader.json?authorizableId=anonymous
pragma: no-cache
cookie: AWSELB=5F2B578318E89D8E08CFED7804764C1968F619D94F001E6A5759DB2F3814FCBBF078D9D23FA80D0B0DCA421C304FA45FC2B8DC265F96266DC22058073F7283791BC9BFBB69; nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1525208218921-25058; tp=7048; s_ppv=us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200; s_cc=true
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.fireeye.com
x-requested-with: XMLHttpRequest
:scheme: https
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
:method: GET
Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding: gzip
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:57:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json; charset=UTF-8
status: 200
x-iinfo: 10-34066388-34066137 PNNN RT(1525208219515 0) q(0 0 0 -1) r(1 1) U10000
dispatcher: ${DISP_NUM}
vary: User-Agent
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK forms2.css
www2.fireeye.com/js/forms2/css/ 13 KB
3 KB 453ms
151ms Stylesheet
text/css 199.15.214.214
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2.css

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.15.214.214 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www2.fireeye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Cookie: nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; BIGipServersjiweb-app_https=!YHVaXK8qWLTq/Vr+0lRBM0wOTlTd7yFC03/zgfeNaB8dALgLOT59e88kxZb9WJMpVaGE6byEAQ6D0PE=; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1525208218921-25058; tp=7048; s_ppv=us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200; s_cc=true
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:57:00 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 07 Apr 2017 19:34:58 GMT
Server: Apache
ETag: "52164e-33f8-54c98b884bc80"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2610

GET
H/1.1 200
OK forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/ 826 B
597 B 459ms
152ms Stylesheet
text/css 199.15.214.214
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.15.214.214 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www2.fireeye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Cookie: nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==; __utma=214676736.1624232352.1525208218.1525208218.1525208218.1; __utmc=214676736; __utmz=214676736.1525208218.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=214676736.1.10.1525208218; _uetsid=_uet91ff0b75; AMCVS_12390CDB53E9CC840A490D4E%40AdobeOrg=1; AMCV_12390CDB53E9CC840A490D4E%40AdobeOrg=817868104%7CMCIDTS%7C17653%7CMCMID%7C18027846659949159281159865447294478782%7CMCAAMLH-1525813017%7C6%7CMCAAMB-1525813017%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1525215417s%7CNONE%7CMCAID%7CNONE; mbox=check#true#1525208278|session#acc704700c1646009a1bd35be50b80fc#1525210078|PC#acc704700c1646009a1bd35be50b80fc.26_18#1526417818; BIGipServersjiweb-app_https=!YHVaXK8qWLTq/Vr+0lRBM0wOTlTd7yFC03/zgfeNaB8dALgLOT59e88kxZb9WJMpVaGE6byEAQ6D0PE=; _ga=GA1.2.1624232352.1525208218; _gid=GA1.2.634096335.1525208218; _gat_UA-363943-1=1; _mkto_trk=id:848-DID-242&token:_mch-fireeye.com-1525208218921-25058; tp=7048; s_ppv=us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200; s_cc=true
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:57:00 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 07 Apr 2017 19:34:58 GMT
Server: Apache
ETag: "521654-33a-54c98b884bc80"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 242

GET
S 200 _ate.track.config_resp Show response
m.addthisedge.com/live/boost/fewebadmin/ 2 KB
909 B 26ms
17ms Script
application/javascript 2.21.160.128
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: SPDY
Server: 2.21.160.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 6b14ea5fc64171a1b09271b769c1f0e13315a7cb42713a2726d84d66b4e328f4

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:57:00 GMT
content-encoding: gzip
surrogate-key: fewebadmin
etag: 1602101382
vary: Accept-Encoding
cache-tag: fewebadmin
status: 200
cache-control: public, max-age=25, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-type: application/javascript;charset=UTF-8
content-length: 701

GET
H/1.1 200
OK s28509912246244
fireeye.sc.omtrdc.net/b/ss/fireeyev1prod/1/JS-1.6.2-D7QN/ 43 B
526 B 23ms
22ms Image
image/gif 172.82.228.19
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fireeye.sc.omtrdc.net/b/ss/fireeyev1prod/1/JS-1.6.2-D7QN/s28509912246244?AQB=1&ndh=1&pf=1&t=1%2F4%2F2018%2020%3A57%3A0%202%200&D=D%3D&mid=18027846659949159281159865447294478782&aamlh=6&ce=UTF-8&pageName=us-en%3Ablog%3Athreat-research%3A2017%3A04%3Acve-2017-0199-hta-handler&g=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&cc=USD&events=event24&c21=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&v28=3353&v29=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&v30=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%C2%AB%20CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&pe=lnk_o&pev2=marketo%20form%20view&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Protocol: HTTP/1.1
Server: 172.82.228.19 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS: *.sc.omtrdc.net
Software: Omniture DC/2.0.0 /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 01 May 2018 20:57:00 GMT
Last-Modified: Wed, 02 May 2018 20:57:00 GMT
Server: Omniture DC/2.0.0
xserver: www272
ETag: "3275359712332283904-5393237751242636629"
Vary: *
X-C: ms-6.1.5
P3P: CP="This is not a P3P policy"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, max-age=0, no-transform, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 30 Apr 2018 20:57:00 GMT

GET
S 200 layers.41d5b639a31042ad27e1.js Show response
s7.addthis.com/static/ 261 KB
74 KB 16ms
15ms Script
application/javascript 2.21.160.128
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s7.addthis.com/static/layers.41d5b639a31042ad27e1.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: SPDY
Server: 2.21.160.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: ef661c03d664b650adf61e22141995b6a3c0611cb2e4f22205df5d00d5554a9d

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:57:00 GMT
content-encoding: gzip
last-modified: Tue, 24 Apr 2018 16:52:18 GMT
server: nginx
etag: "5adf60c2-41232"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
x-host: s7.addthis.com
accept-ranges: bytes
timing-allow-origin: *

GET
S 200 sdk.js Show response
connect.facebook.net/en_US/ 209 KB
63 KB 6ms
6ms Script
application/x-javascript 157.240.20.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

SPDY

Server

157.240.20.19 Menlo Park, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-02-frt3.fbcdn.net

Software

Resource Hash

f50e84b17271f8258c4d91c160dc78fb79eb7e60b017d456725c8ad64d00ecc2

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: cOjo/6hT7HZxnGCIFEhzUw==
status: 200
content-length: 64502
x-xss-protection: 0
x-fb-debug: iP/cTG4oPv5Gg5VVcl1Os2HaDDERXZHHR/AcY3/6V4QQrrnp39lAvzTdNovvHf6nEg9ru3AxKfNJ1ZTah8QOEA==
x-fb-content-md5: a2723200fd179f8b3337ad3adcf86441
x-frame-options: DENY
date: Tue, 01 May 2018 20:57:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "91a0f4782a368859f9d58b1db860fe3d"
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
timing-allow-origin: *
expires: Tue, 01 May 2018 21:00:01 GMT

GET
S 200 widgets.js Show response
platform.twitter.com/ 123 KB
36 KB 6ms
6ms Script
application/javascript 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: 7e1549d8014a30c3c17fdca43be710f1c4acbe33706b008f7ef45b99f6b2bbe5

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:57:00 GMT
content-encoding: gzip
age: 867
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 36295
x-served-by: cache-tw-fra1-cr1-11-TWFRA1
last-modified: Thu, 26 Apr 2018 22:37:34 GMT
x-timer: S1525208221.864223,VS0,VE0
etag: "734cb84ab666fc8eeea3489e24aa3b7d+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=1800
accept-ranges: bytes

GET
S 200 plusone.js Show response
apis.google.com/js/ 43 KB
17 KB 46ms
31ms Script
application/javascript 216.58.214.78
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

SPDY

Server

216.58.214.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f14.1e100.net

Software

ESF /

Resource Hash

b77f7a1bcd96a2caaf538664502d60c0b3ee7574aaf4babffb852b57809737d7

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180429.12_p0
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180429.12_p0
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
date: Tue, 01 May 2018 20:57:00 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "f49b293a9507c3ddd6920a67750db230"
timing-allow-origin: *
expires: Tue, 01 May 2018 20:57:00 GMT

GET
S 200 button.7db838345f9545c91ea4497f64abb814.js Show response
platform.twitter.com/js/ 4 KB
1 KB 8ms
5ms Script
application/javascript 199.96.57.6
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.7db838345f9545c91ea4497f64abb814.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: SPDY
Server: 199.96.57.6 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software: /
Resource Hash: f28622f939416ae1b803ae820fb5c9605b91057f2b88b571f61236969aa1a41a

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:57:00 GMT
content-encoding: gzip
age: 425798
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1394
x-served-by: cache-tw-fra1-cr1-11-TWFRA1
last-modified: Thu, 26 Apr 2018 22:34:35 GMT
x-timer: S1525208221.912858,VS0,VE0
etag: "8acfe6fdaf660e4040ed80fc61fd875d+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes

GET
S 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.pSDax_UbHJ4.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCOzcr2O0Op7DxtPy3WOW7hdoZJ6KQ/ 131 KB
46 KB 6ms
6ms Script
text/javascript 216.58.214.78
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.pSDax_UbHJ4.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCOzcr2O0Op7DxtPy3WOW7hdoZJ6KQ/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

SPDY

Server

216.58.214.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f14.1e100.net

Software

sffe /

Resource Hash

212e12a89f6fcf2a9715537148a514fede37c974d83bad6897494f9e74963920

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Mon, 30 Apr 2018 23:28:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 28 Apr 2018 02:52:16 GMT
server: sffe
age: 77291
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 46544
x-xss-protection: 1; mode=block
expires: Tue, 30 Apr 2019 23:28:49 GMT

GET
S 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.pSDax_UbHJ4.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCOzcr2O0Op7DxtPy3WOW7hdoZJ6KQ/ 97 KB
34 KB 11ms
10ms Script
text/javascript 216.58.214.78
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.pSDax_UbHJ4.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCOzcr2O0Op7DxtPy3WOW7hdoZJ6KQ/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

SPDY

Server

216.58.214.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s10-in-f14.1e100.net

Software

sffe /

Resource Hash

75b7be3706ea25ab69ed855e7b8c5b49a3915aceb6c66a2cb2011577a8a8f611

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Mon, 30 Apr 2018 23:28:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 28 Apr 2018 02:52:16 GMT
server: sffe
age: 77283
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 34941
x-xss-protection: 1; mode=block
expires: Tue, 30 Apr 2019 23:28:57 GMT

GET
S 200 /
www.facebook.com/impression.php/f3e4d8ecd894e8/ 43 B
1 KB 42ms
42ms Image
image/gif 157.240.20.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/impression.php/f3e4d8ecd894e8/?lid=115&payload=%7B%22source%22%3A%22jssdk%22%7D

Protocol

SPDY

Server

157.240.20.35 Menlo Park, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

edge-star-mini-shv-02-frt3.facebook.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
x-xss-protection: 0
pragma: no-cache
x-fb-debug: RLsFKO3fjnpRG/OZKQiHbXarGSwz1EnN+9Sj4VhPSmZ/yuNS0hrEHz/QKqOTSz+Ugt7rtSSPHfxsD4InFBxpbw==
date: Tue, 01 May 2018 20:57:01 GMT
expect-ct: max-age=10, report-uri="http://reports.fb.com/expectct/"
strict-transport-security: max-age=15552000; preload
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 200 /
www.facebook.com/impression.php/f3633d81832c2c8/ 43 B
178 B 46ms
46ms Image
image/gif 157.240.20.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/impression.php/f3633d81832c2c8/?api_key=172525162793917&lid=115&payload=%7B%22source%22%3A%22jssdk%22%7D

Protocol

SPDY

Server

157.240.20.35 Menlo Park, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

edge-star-mini-shv-02-frt3.facebook.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
x-xss-protection: 0
pragma: no-cache
x-fb-debug: nGvcqRA+FjqRMMLvdqUq5+yn3ZuNcWEyaGLMFnvPKFmvV7sqee3M6WL+lxFVI3VeeSktDnLcMFzHxYtB+/jcSw==
date: Tue, 01 May 2018 20:57:01 GMT
expect-ct: max-age=10, report-uri="http://reports.fb.com/expectct/"
strict-transport-security: max-age=15552000; preload
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
S 200 132.3f8dcb25ff9c4caa7526.js Show response
s7.addthis.com/static/ 418 B
609 B 7ms
7ms Script
application/javascript 2.21.160.128
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s7.addthis.com/static/132.3f8dcb25ff9c4caa7526.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: SPDY
Server: 2.21.160.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 513cf0b206071bc640a34933a78acb4f989f18d3b75cdf7579051be8f12acc1f

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Tue, 01 May 2018 20:57:01 GMT
last-modified: Tue, 24 Apr 2018 16:52:18 GMT
server: nginx
etag: "5adf60c2-1a2"
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
x-host: s7.addthis.com
accept-ranges: bytes
timing-allow-origin: *
content-length: 418

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.0 200
OK Cookie set XDFrame Show response
www2.fireeye.com/index.php/form/ Frame 2435 2 KB
1020 B 305ms
305ms Document
text/html 199.15.214.214
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/XDFrame

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.15.214.214 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

209f0594f470dd81e958be83e324d48aa07d394c7ec39f196fb38ca1b8de3690

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www2.fireeye.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Cookie: tp=7048; s_ppv=us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 01 May 2018 20:57:00 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Connection: Keep-Alive
Set-Cookie: BIGipServersjiweb-app_https=!w1eEWuO3KWuiW8/+0lRBM0wOTlTd7yI+4PdbdIXleiYUV1Yag3P0oKvVGWuq2NCTV1S4EZc1xrtPuQQ=; path=/; Httponly; Secure
Content-Length: 634

GET
H/1.1 200
OK Cookie set forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ Frame 2435 165 KB
0 771ms
160ms Script
application/x-javascript 199.15.214.214
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.15.214.214 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

fb081668911311a53760f9e2f565a4f172416949e1039fb5c38316dc21e7d8eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www2.fireeye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Cookie: nlbi_153517=ppmSFuEDtjJ2g4Zj9aJbDAAAAAB3vCrqZOemai8ysLeXOpPa; visid_incap_153517=ywaPToiHRNKlHyOw+flvV5jU6FoAAAAAQUIPAAAAAACiO5THTgnlaUyM5UHn/LdG; incap_ses_533_153517=6po8HYoB4nuJh8tpRJllB5nU6FoAAAAAPrtt8a3CojDXehs3TXvAhw==
Connection: keep-alive
Cache-Control: no-cache

Response headers

Date: Tue, 01 May 2018 20:56:58 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 26 Feb 2018 20:41:38 GMT
Server: Apache
ETag: "42dac-2927b-56623895cc480"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: Keep-Alive
Transfer-Encoding: chunked
Set-Cookie: BIGipServersjiweb-app_https=!YHVaXK8qWLTq/Vr+0lRBM0wOTlTd7yFC03/zgfeNaB8dALgLOT59e88kxZb9WJMpVaGE6byEAQ6D0PE=; path=/; Httponly; Secure
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

Verdicts & Comments Add Verdict or Comment

284 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fireeye.com/	1970-01-18 15:40:10	Name: __atuvs Value: 5ae8d49b573150e8000
www.fireeye.com/	1970-01-19 01:10:22	Name: __atuvc Value: 1%7C18
.fireeye.com/	1969-12-31 23:59:59	Name: s_ppv Value: us-en%253Ablog%253Athreat-research%253A2017%253A04%253Acve-2017-0199-hta-handler%2C17%2C17%2C1200
.fireeye.com/	1969-12-31 23:59:59	Name: tp Value: 7048

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.fireeye.com/etc/clientlibs/foundation/personalization/kernel.min.js(Line 1) Message: authorizableId is anonymous
console-api	log	URL: https://www.fireeye.com/etc/clientlibs/foundation/personalization/kernel.min.js(Line 1) Message: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
console-api	log	URL: https://www.fireeye.com/etc/clientlibs/foundation/personalization/kernel.min.js(Line 1) Message: object is null

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

848-did-242.mktoresp.com
apis.google.com
assets.adobedtm.com
bat.bing.com
cdn.tt.omtrdc.net
cloud.typography.com
connect.facebook.net
dc.ads.linkedin.com
dpm.demdex.net
fireeye.sc.omtrdc.net
fireeye.tt.omtrdc.net
googleads.g.doubleclick.net
js.maxmind.com
m.addthisedge.com
munchkin.marketo.net
platform.twitter.com
px.ads.linkedin.com
s.yimg.com
s7.addthis.com
sjs.bizographics.com
sp.analytics.yahoo.com
stats.g.doubleclick.net
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.nl
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
104.109.87.116
104.16.37.47
149.126.77.186
157.240.20.19
157.240.20.35
172.217.16.162
172.217.22.46
172.217.22.66
172.217.22.68
172.82.228.19
185.63.145.1
185.63.145.5
188.125.66.33
199.15.214.214
199.15.215.200
199.96.57.6
2.18.233.142
2.19.35.110
2.21.160.128
204.79.197.200
216.58.214.67
216.58.214.72
216.58.214.78
23.43.123.158
23.45.97.17
34.249.172.115
66.117.29.11
74.125.133.157
87.248.118.22
017bf8b7865aa3589f54e881370a1bcf1d4251ffead66504e0f15fdfad7ffceb
02727b2ab397d4ffdee2d7f01b7e7082d68adaf23bb2b99a260274492a3f007a
07f25a843c35fc5fc6ae44d0756d2b936e1be6499aa165b568ae45eceb808e57
08ada830a022251d78d15cefd38549eda4c4f24ba25845ff2280d23cafe2a178
0914d1fb1c58b2a0f48800b98fa271603e0b01dfdae72c53d622f0ea754c84ea
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
112560223d7dcf6f78bd1f4f1271590233b6cd02adf7a10f896b0f628c2c4d24
11a7f958ec04c6a2e085b63d179253144a42f29a4e10df92028684d47edabed1
13d79cef4d43875e481796021baf97fb5dd6de33f132d0dfb69dbce5fe61adda
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
14f5c3507c3529201adf46f8d0bd4cac4cf8ee74b08c1143020dc577a86a66ef
192fd38d14982b1d056d505446cf8b8f8aabdbf72af04245a015aa4281246d45
209f0594f470dd81e958be83e324d48aa07d394c7ec39f196fb38ca1b8de3690
212e12a89f6fcf2a9715537148a514fede37c974d83bad6897494f9e74963920
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675
23941ad2251c35265baba97eef46e43b7ba2341a9d3b4e13f69b41eddb61c2e9
260772996600ba7b1f88bfbb9756a93edbd4f735371e09027da2e3ae1eec84dd
273cc71ecdba74f800919f2ed274d86e4c00350e3e3cf2b9673246a7bdaf166b
33d64e65f4e496e717276247cd2c8a9da92adabecee2571b9c0dcaf702e5bf89
387cd2f4aae9d51cfdb45a797f96deb8fc9ec549009971dd73275be87dd77652
397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b
3a81ad9bc69582468671824f1bd4b9e3c3c82ce201480394e47b04a534cb7094
3fd6902b7fdd2be2acae610dbb2f42907a38b184075dd5cbcb53edea4fd7251d
40673867a3691016c690bacfd50b6e5aa2b41c6e2cd238075126c0db41fd6216
42bf4918673d512ac1b7d4693832335ee21c7ccc8236b65e58a5fb17d473da10
433fb5a9934811099ea8158aa37244f52e86495cd0ce8a43dbdea8e1f2073900
4af82da2a4711e51f79b49c07d7ab53667971f62ddfa3417cde1555bdf53518d
513cf0b206071bc640a34933a78acb4f989f18d3b75cdf7579051be8f12acc1f
5289840c115a8725f816552aae25f03c928c019256a7547a9f8652a19f05ceba
539f0ee528dde5d29cd047c2d68db4f5d8dbb65b82640e6c9e636af6f5f5b32d
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5529960538c68ee9fae25260035ba2191ea3141953179b00be4efdb47595d1f2
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5b0454427cef5e4c09cad48c5b421f4d23d9a0689f4519f17956af263bf77d3b
5ccf598394e80ad055a43deb9e2cb616d4ee5579a707daeb655137dd59829865
5e4a8318d1cc410dbb2beaa0c3480335b5a71cd67728c97288ad619e34169058
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
656099b1659bc72032a58e03ced048ca583dec3870bf87eb7c4cdaaef8dc6bc5
69070c1ea5fb699759e671e04096910961b0b075dd7269d141f705f0d79d6202
6b14ea5fc64171a1b09271b769c1f0e13315a7cb42713a2726d84d66b4e328f4
6e68f0806b2280f195e6945d92c98695a6a12a5fb68c00775b348f8d6c9101dd
75b7be3706ea25ab69ed855e7b8c5b49a3915aceb6c66a2cb2011577a8a8f611
7833d3c2a4309372bd0a3eec38a4b0a5401423aca5b664c1d49ff593656cb80c
794726d8c8a0537a40788be73391b64e6ba84d8b3e9d1e4a477967fe9a8fb7b3
7b86d506062bf09d8db4e081fbf442b773929e5c13a70f415243e12185f37767
7e1549d8014a30c3c17fdca43be710f1c4acbe33706b008f7ef45b99f6b2bbe5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
88694454a2bc3241a6531d725aa9f7f53725d43f59eb07418753f8f819ec46b5
91bf238fe33b5051df7d1c52336fb7803deec5cb367b11c2ca1978949f94951c
9c9430c197476f80275443261f9c704c4fa44209e1a73a70acc5432df543c7f0
9cb61d1b77963810d54c18b32a133870a6094c5e5afa82da0684575dad823099
9ce0ee6328d3d728d275078eb32504a47430946b6189d7de5dc8552246b2ffdb
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a20e7e269dcfd108ca39cc2bab41e0d7620b039b623b19ed4d7c3c22186b6cd0
a2b4aa77b7d7d9048989c55804f87d8451136c47fd3b6ac87f129da6de48b863
a7daec4b20697bd4f5fe0cf3b0fb02108e9adbc9cbd391ddf973a1ee2996b86a
a9e460758dbcc0782220f053b3c7962542e8ce5e8acfb2cf0648a601ed0591bc
b08b2d860ed3726c2de94f3c6192d8b0a9432380e4ab05fa2874328b921d8102
b1833a64dac569d6afd5d5813be3eb5eab3b7ba1486651458cf11fe68811d83e
b4327d80eec1c41b7cc86f5240fa83469b02f2f60c44418340ea28108bd3bb32
b77f7a1bcd96a2caaf538664502d60c0b3ee7574aaf4babffb852b57809737d7
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c63b1955dfe5b409514ad44046a52a3d68391f1ace79055060bbba01b7054c2e
c8a761c3deac94fbd6e6aae681b9281c5e43b7d57a1574fa93c3f65ff040e9da
c94a7abd974c79856c19536bcc51acbfd28c72d8027980e5a46fede8f0064481
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cbbd42bb1d88693e6805bd9d676840424af5ecf3e13d874fd06e6b57d53d8d40
d1ba8950e268ba9c8aac5eb337a0c9f74f98702b95ecf8edd50f2580da66169c
d62e6662fcd83693024b89c47c92df014f56b1083bfa0f9128e3d1c94dd76bc4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e68bbc5ef346e3ca56aa7acf09654640ccd4d9e4a3bb63aed1484aba31b3f99b
e74d0a901c9d8a7b7e708076d944eece8f13f17d944acb4d4b77c33e0bddc029
e814429f256ea8ec0ad72336781d173957c540d8b2948290f525b9af3524df07
eb9f5c6e7887dbc763d63af2d1dffc086d71210b2501abf22768310d7d3db092
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef661c03d664b650adf61e22141995b6a3c0611cb2e4f22205df5d00d5554a9d
f2136dc3eef62e9c8b8b070396c5cdd26b397763058e02c3aa9f68d7b6950bcb
f28622f939416ae1b803ae820fb5c9605b91057f2b88b571f61236969aa1a41a
f50e84b17271f8258c4d91c160dc78fb79eb7e60b017d456725c8ad64d00ecc2
f7de8a302ba63e8067adeb89eb0e53327b17996ce20d2026466f681c83394002
fa33bdafc55d1404ff41c75d0798872676e2eac896f90652d1bf252deb032854
fb081668911311a53760f9e2f565a4f172416949e1039fb5c38316dc21e7d8eb

www.fireeye.com Open in urlscan Pro 149.126.77.186 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

88 Requests

42 %HTTPS

0 %IPv6

24 Domains

31 Subdomains

28 IPs

6 Countries

1864 kBTransfer

4191 kBSize

4 Cookies

25 Outgoing links

Redirected requests

88 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fireeye.com Open in urlscan Pro
149.126.77.186 Public Scan

Screenshot
Live screenshot

Full Image

88
Requests

42 %
HTTPS

0 %
IPv6

24
Domains

31
Subdomains

28
IPs

6
Countries

1864 kB
Transfer

4191 kB
Size

4
Cookies

88 HTTP transactions
5 data transactions