Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 07:43:50 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d32c708de8c296676bedac144d49f089c1617695029; expires=Thu, 06-May-21 07:43:49 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED cf-request-id: 0947bc527900003531c6369000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63b96330cbf63531-ICN

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 07:43:51 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=def18636da203a43d017c1d24b498deb91617695031; expires=Thu, 06-May-21 07:43:51 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b96337cfa812ea-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 07:43:51 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc56dc000012eabaadb000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UzuaZEL7MMmVIMbSn1rYxZGvMnx-2WZvgZxXYP8NMW1H5xjzLNlWFsTyjIfBnMGQ3V1TZfxsKBsrmVH8PMffzkrDviEGg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=farZ2%2BUm7rw%2FNczmPiwWpDONpDk%2BbSy4MWIETENhI8t%2FRsUE%2FE6O7nzjDnhqF%2FVQYXPKCPSfO0nynZJcMeZEtahjfFiZip0pPCM7YRVwqj9P9Zc%3D"}],"max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 07:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d8f85692a4c877037a28f5ce0ea2e805e1617695031; expires=Thu, 06-May-21 07:43:51 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 0947bc56dc00003538d7b2b000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fnsbg7Hul1VBzOzfR30OGn3z1d5AImZDNkUzqGKt40Mah6ZNEgnOh8oysXAlSHHg%2FnA5EuaXRk6UElIsRpqixE1HllBPCiFFumP4iJQ1p9L8GHg%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b96337ca293538-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 07:43:51 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=d8f85692a4c877037a28f5ce0ea2e805e1617695031; expires=Thu, 06-May-21 07:43:51 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b96337da7e3538-ICN Accept-Ranges: bytes Age: 550040 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Wed, 06 Apr 2022 07:43:51 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc56e9000035381b0e2000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wrS2Bwl82BbKPVdGguHe%2FS8Y9YLO99yENViorvLuTpZb9ON%2FH2JcNZm1f1K3AkqCiVn%2FMF7arFPNCQ3aLl1cBL8Y8XNZcYFsSorh1rgC%2BeQkofU%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

HTTP/1.1 404 Not Found Date: Tue, 06 Apr 2021 07:43:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19 Connection: keep-alive Set-Cookie: __cfduid=d9f1e7a901e72e29c726917a3831fee0b1617695031; expires=Thu, 06-May-21 07:43:51 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 0947bc58e8000042bd6c30a000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4Ivdf2uONPkBCzh538ITqLlHqk8kzpyBfHEbFeD%2BcctxpbhvL17R4JOH1lEax5AiJBsB7szeDojUosZpKk9YMqlkQic1kW5RUlRYMY1f"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b9633b0f3342bd-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 07:43:53 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d928716abd0e589aee2390d854f75570c1617695033; expires=Thu, 06-May-21 07:43:53 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b9634588603538-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 07:43:53 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc5f730000353804b6c000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UxfZKtmWAunDtVgvLPAZLLWqE7IGHeclAXUtwAozPhlWr4oYWOIeMWWXu5lWiZ9AcU3GW0jl7qCJzTH14PFUupS1mQKEw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5Vyde7fEI2mesdo8yhPVgPUwFLrHNbloAEZvUGbXpdIanumb8vdVipXuiuHd4iN7U%2FUWaIplTwfiJjFw41vBPK0Fl4zTQDEuhFw1QXhIrNrO6F0%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 07:43:53 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=db86d511711c29e2115d9a36d4515eac61617695033; expires=Thu, 06-May-21 07:43:53 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b963459b6512d6-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 07:43:53 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947bc5f7d000012d6d9144000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UwikVHY7k3oPt8rdqPyAzfZvDF8aylMLsQ-j2ihMHCj379nHws0sxXYWufnIZXYzFSJxtPjSpOFPit2PO5oh34 X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Nhe0cvVQwbFLOjBM%2FiEgzOr0DjM9b8A5L6rdrAi%2FGsi%2FcJnqDfYaztkZSMomdtkApccaxOFO%2B3K99CylmTej4B0bFej9nmxQSDXADd%2B9uwBc9GM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare