Network Analysis

GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com

HTTP/1.1 200 OK X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=15768000 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self' *.identrust.com Last-Modified: Fri, 22 Oct 2021 20:14:01 GMT ETag: "37d-5cef6a6e73440" Accept-Ranges: bytes Content-Length: 893 X-Content-Type-Options: nosniff X-Frame-Options: sameorigin Content-Type: application/pkcs7-mime Cache-Control: max-age=3600 Expires: Tue, 26 Oct 2021 01:32:30 GMT Date: Tue, 26 Oct 2021 00:32:30 GMT Connection: keep-alive

GET /vpn.exe HTTP/1.1 Host: duzlwewk2uk96.cloudfront.net Connection: Keep-Alive

HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 15699256 Connection: keep-alive Date: Tue, 26 Oct 2021 00:32:32 GMT Last-Modified: Tue, 26 Oct 2021 00:17:58 GMT ETag: "4dd57eb8ea614ca43e679abeaf5351bf" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 13748bbc0f98e51e751e7e4b1939b964.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN51-C1 X-Amz-Cf-Id: xjozMfj1S9S0_NGWt3WCQVTR3Nagy0RgryEN669a5919de9AGjqoyQ==

GET /adsli/note866.exe HTTP/1.1 Host: papwli.pw Connection: Keep-Alive

HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Sun, 24 Oct 2021 16:02:25 GMT Accept-Ranges: bytes ETag: "d9107789f0c8d71:0" Server: Microsoft-IIS/8.5 Date: Mon, 25 Oct 2021 16:33:56 GMT Content-Length: 2145280