Edit tour

Windows Analysis Report
https://b45032.com/

Overview

General Information

Sample URL:	https://b45032.com/
Analysis ID:	1589661
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

HTML title does not match URL

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2320,i,16585267306971853294,6447281845026543591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://b45032.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://b45032.com/

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://b45032.com/images_plus/other/en/right3.jpg	Avira URL Cloud: Label: phishing
Source: https://b45032.com/gdcode_1736725694	Avira URL Cloud: Label: phishing
Source: https://b45032.com/common/storage/cms/cms_1045.png?v=1611754636	Avira URL Cloud: Label: phishing
Source: https://b45032.com/images_plus/other/en/right2.jpg	Avira URL Cloud: Label: phishing
Source: https://b45032.com/getcatlist/224	Avira URL Cloud: Label: phishing
Source: https://b45032.com/getegame?platform%5B%5D=202&page=1&gamename=&gameid=	Avira URL Cloud: Label: phishing
Source: https://b45032.com/getegame?platform%5B%5D=224&page=1&gamename=&gameid=	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://b45032.com/#	Joe Sandbox AI: Score: 9 Reasons: The brand 'bet365' is a well-known online gambling company., The legitimate domain for bet365 is 'bet365.com'., The provided URL 'b45032.com' does not match the legitimate domain name., The URL 'b45032.com' contains numbers and does not resemble the brand name, which is a common tactic in phishing., There is no clear association between the URL and the brand 'bet365'. DOM: 2.0.pages.csv
Source: https://b45032.com/#	Joe Sandbox AI: Score: 9 Reasons: The brand 'bet365' is a well-known online gambling company., The legitimate domain for bet365 is 'bet365.com'., The provided URL 'b45032.com' does not match the legitimate domain name., The URL 'b45032.com' contains numbers and does not resemble the brand name, which is a common tactic in phishing., There is no clear association between the URL and the brand 'bet365'. DOM: 2.1.pages.csv
Source: https://b45032.com/egame/224	Joe Sandbox AI: Score: 9 Reasons: The brand 'bet365' is a well-known online gambling company., The legitimate domain for bet365 is 'bet365.com'., The provided URL 'b45032.com' does not match the legitimate domain name., The URL 'b45032.com' contains numbers and does not resemble the brand name, which is suspicious., There is no clear association between the URL and the brand 'bet365'. DOM: 3.4.pages.csv
Source: https://b45032.com/egame/224	Joe Sandbox AI: Score: 9 Reasons: The brand 'bet365' is a well-known online gambling company., The legitimate domain for bet365 is 'bet365.com'., The provided URL 'b45032.com' does not match the legitimate domain name., The URL 'b45032.com' contains numbers and does not resemble the brand name, which is a common tactic in phishing., There is no clear association between the URL and the brand 'bet365'. DOM: 3.6.pages.csv

AI detected suspicious Javascript

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://b45032.com/... The provided JavaScript snippet appears to be a malicious script that attempts to decrypt and execute encrypted code. The use of the `cryptoJsAesDecrypt` function, which is likely a custom decryption function, along with the large amount of obfuscated data being decrypted, indicates a high risk of malicious behavior. This script demonstrates behaviors associated with dynamic code execution, data exfiltration, and the use of suspicious domains, all of which are considered high-risk indicators according to the provided scoring matrix.
Source: 0.73.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://b45032.com/egame/224... The provided JavaScript snippet appears to be a highly suspicious and potentially malicious script. It contains several high-risk indicators, including dynamic code execution via the `cryptoJsAesDecrypt` function, which could be used to execute remote or obfuscated code. Additionally, the script appears to be sending sensitive data (potentially including user credentials or other personal information) to an unknown external domain, which is a clear indicator of data exfiltration. The heavy obfuscation of the code and the use of multiple fallback domains further contribute to the high-risk assessment. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.

Source: https://b45032.com/#	HTTP Parser: Title: bet365 does not match URL
Source: https://b45032.com/egame/224	HTTP Parser: Title: bet365 does not match URL
Source: https://b45032.com/egame/202	HTTP Parser: Title: bet365 does not match URL

Source: https://b45032.com/js/www/decrypt.js

HTTP Parser: function cryptojsaesdecrypt(encrypted, pass) { var key = cryptojs.sha256(pass); var ivandciphertext = cryptojs.enc.base64.parse(encrypted); var iv = cryptojs.lib.wordarray.create(ivandciphertext.words.slice(0, 4)); var ciphertext = cryptojs.lib.wordarray.create(ivandciphertext.words.slice(4)); var decrypted = cryptojs.aes.decrypt({ ciphertext: ciphertext }, key, { iv: iv, padding: cryptojs.pad.pkcs7, mode: cryptojs.mode.cbc }); return decrypted.tostring(cryptojs.enc.utf8);}

Source: https://b45032.com/#	HTTP Parser: <input type="password" .../> found
Source: https://b45032.com/egame/224	HTTP Parser: <input type="password" .../> found
Source: https://b45032.com/egame/202	HTTP Parser: <input type="password" .../> found

Source: https://b45032.com/#	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="author".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="author".. found

Source: https://b45032.com/#	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/#	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/224	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="copyright".. found
Source: https://b45032.com/egame/202	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.34
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.34
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: b45032.com
Source: global traffic	DNS traffic detected: DNS query: 5getfab.segrft.com
Source: global traffic	DNS traffic detected: DNS query: hm.baidu.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 12 Jan 2025 23:47:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAlt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1Cache-Control: no-cache, privateSet-Cookie: XSRF-TOKEN=eyJpdiI6InZQYnZrbHRNY3ZwWHNwTU5DRHpRd2c9PSIsInZhbHVlIjoieE1Kb3cwWHVIb2Roc0pBcnNyOVRcLzNnalluWWxOREpENFV5TTNwVjFFbjdsalwvVU5XTHNFQit4bWRKSFZrSWZUSklYNDBcL3FVRVBPV3lKVkM3RFdIZ3c9PSIsIm1hYyI6ImU5OWRiNmNkMWQ0YTk5NzdiYmJjODkwZjFiMjZkNjZlNTljNzViZGE1Zjg5MTBiYTVjZmY2NTcyMGM4YmQyMDkifQ%3D%3D; expires=Mon, 13-Jan-2025 01:47:53 GMT; Max-Age=7200; path=/; secure; samesite=noneSet-Cookie: vanguard_session=eyJpdiI6Ik1vMzBOMWtcL1ZTZ3ZHQ3BqREs1SFB3PT0iLCJ2YWx1ZSI6Ill0NVlqZk5SdTQ1WGVuTWtrUkdxSEV4XC9DbWYrS0k2b01PVWkxenF3d0wxWUl4bVlrZDVNUTJ2NWNUVGVPZFp6VXJCS2pWSHlhdCt0MEZLMVwvZ3ppTUE9PSIsIm1hYyI6ImZkODJkNTUwOGQyYWQ0ZWRiZjhhYWM3ODQ5ODkzNjFiYjljNTVlMTY4OTMwYTdlZWI0YTEzODdjMzNkM2M5N2IifQ%3D%3D; expires=Mon, 13-Jan-2025 01:47:53 GMT; Max-Age=7200; path=/; secure; httponly; samesite=noneServer: nginx
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 12 Jan 2025 23:48:19 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, privateServer: CDNoh
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 12 Jan 2025 23:48:21 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAlt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1Cache-Control: no-cache, privateSet-Cookie: XSRF-TOKEN=eyJpdiI6Imo0XC9uRGZFczNsdG9ZaVpVcGZEREV3PT0iLCJ2YWx1ZSI6InVLTE9qUVdINlVYMlNPODJtYXFDbUtGZjVZbmpHNkZoUFwvYUwyVGhLUG5ybDVnT05aS0E5TVhFVUg0cUZwSk83OThJQllmUElkWUdpU012WTdWRnRvUT09IiwibWFjIjoiYWJlNTg2MmY2NGUwY2QyMjdkMGMyMmY2MGM5Y2YxNTU5NThmY2RjYTBiMDU1Zjc3MmE3NmMzZGJhNDBkNjZiNiJ9; expires=Mon, 13-Jan-2025 01:48:21 GMT; Max-Age=7200; path=/; secure; samesite=noneSet-Cookie: vanguard_session=eyJpdiI6IlBpRDBtQXdWbzRNZzAxYnNYcTVWbGc9PSIsInZhbHVlIjoiTW05T0llbjJiM1F6a1d6QzVuZkJGQ0dSRHVCMCswbW8xZWJvZWxXeUNWdmlyZ290bFJlb2pBNHVTQmJBUHBqWHh2U1FrandDMmQ0S2JxdjAwT2Fvcmc9PSIsIm1hYyI6IjEyMGIwZjc5NWI5MGY0NmU5Y2ZmNGFmNGFiZjhkY2RiOWFkYTdmY2NiMjRmODQ2ZTg2NDNlOWVhNTJiN2ZjMzUifQ%3D%3D; expires=Mon, 13-Jan-2025 01:48:21 GMT; Max-Age=7200; path=/; secure; httponly; samesite=noneServer: nginx
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 12 Jan 2025 23:48:42 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, privateServer: CDNoh
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 12 Jan 2025 23:48:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAlt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1Cache-Control: no-cache, privateSet-Cookie: XSRF-TOKEN=eyJpdiI6InFOakFHbWdqSmpqRlR4WEtYXC9salhRPT0iLCJ2YWx1ZSI6IlwvNXBzcXpOdmFoSWxQNEJqOWlzdmlyRGpTTjZJUGlsbk95NHVVVllwQmp4YmtZRFlOaTJwMGdkXC9Gd2wrM08wK2VxNjBObklCTTFDSTZCVDd5RmdISUE9PSIsIm1hYyI6Ijk1YTBhNzFhN2U1YzAxYTM1ZjBhN2FiYzZkYjAyYjEwOTRlNGQ4MDZiY2FiMTMwNjZmMzM0NzM3MDg3YmQ5ZjEifQ%3D%3D; expires=Mon, 13-Jan-2025 01:48:49 GMT; Max-Age=7200; path=/; secure; samesite=noneSet-Cookie: vanguard_session=eyJpdiI6ImhNU1VRb01aR0RzMFVaeXBqbThaT2c9PSIsInZhbHVlIjoiaW4yNXppeE1wSGlZQzNiVVgwS1ZaMGNMV2EzbFRjWG52NUNydWFJQmN0em9LejFKdzIwbWpWeXpDNEV2Sk9HSW55MWJkWGRodE1hZ1krSklzcjJcL0FRPT0iLCJtYWMiOiJmMjhjMTQxOWEwYjAwZGM1M2ZhMTJkZmVhNzA3Y2UyN2YzODI1MWY1MjljNDliOTEzOTI4NmNkNzYwNGM3NTc4In0%3D; expires=Mon, 13-Jan-2025 01:48:49 GMT; Max-Age=7200; path=/; secure; httponly; samesite=noneServer: nginx

Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html
Source: chromecache_354.2.dr, chromecache_356.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_300.2.dr, chromecache_241.2.dr, chromecache_483.2.dr, chromecache_371.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_265.2.dr, chromecache_468.2.dr	String found in binary or memory: http://kjur.github.com/jsrsasign/license
Source: chromecache_265.2.dr, chromecache_468.2.dr	String found in binary or memory: http://kjur.github.io/jsrsasign/license/
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/add-inverted-param/
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/define-locale/
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/dst-shifted/
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/js-date/
Source: chromecache_334.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/min-max/
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/zone/
Source: chromecache_422.2.dr, chromecache_431.2.dr	String found in binary or memory: http://momentjs.com/timezone/docs/#/data-loading/.
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://stackoverflow.com/questions/181348/instantiating-a-javascript-object-by-calling-prototype-con
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript
Source: chromecache_226.2.dr	String found in binary or memory: http://tongji.baidu.com/hm-web/welcome/ico
Source: chromecache_265.2.dr, chromecache_468.2.dr	String found in binary or memory: http://www-cs-students.stanford.edu/~tjw/jsbn/
Source: chromecache_266.2.dr, chromecache_307.2.dr	String found in binary or memory: http://www.idangero.us/swiper/
Source: chromecache_226.2.dr	String found in binary or memory: https://fclog.baidu.com/log/ocpcagl?type=behavior&emd=euc
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: https://github.com/dordille/moment-isoduration/blob/master/moment.isoduration.js
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/1423
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/2166
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/2978
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: https://github.com/moment/moment/pull/1871
Source: chromecache_226.2.dr	String found in binary or memory: https://goutong.baidu.com/site/
Source: chromecache_226.2.dr	String found in binary or memory: https://hmcdn.baidu.com/static
Source: chromecache_226.2.dr	String found in binary or memory: https://hmcdn.baidu.com/static/tongji/plugins/
Source: chromecache_270.2.dr, chromecache_334.2.dr	String found in binary or memory: https://nodejs.org/dist/latest/docs/api/util.html#util_custom_inspect_function_on_objects
Source: chromecache_265.2.dr, chromecache_468.2.dr	String found in binary or memory: https://npmcdn.com/jsencrypt
Source: chromecache_286.2.dr, chromecache_423.2.dr	String found in binary or memory: https://ssl.captcha.qq.com/TCaptcha.js

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2320,i,16585267306971853294,6447281845026543591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://b45032.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2320,i,16585267306971853294,6447281845026543591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://5getfab.segrft.com/plus/js/custom/login_custom.js?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/gdrbc1kqj7gr4.png?ver=1731898048	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/173_egame_logo.png?ver=1698829779	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/76_egame_logo.png?ver=1606790110	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_treasureHeroes.png?ver=1712128601	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/main/favicon.ico?ver=1606790107	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/221_egame_logo.png?ver=1606790110	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images/dc_hot.gif?ver=1606790076	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/other/banner2.jpg?ver=1606891698	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/footer/footer-GamCare.png?ver=1606790107	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/xkbfobaryz7xs.png?ver=1731898048	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/196_egame_logo.png?ver=1673578660	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plugins/jquery-ui/jquery-ui.min.css?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/js/unite/encforms.js?ver=1723544858	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/en/202_egame_icon.png?1736725718963	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/sky/sw_dhcf.png?ver=1691141966	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/index/g04.jpg?ver=1606793375	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plugins/jquery-ui/images/ui-icons_555555_256x240.png	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/css/unite/prizedraw_pop_unite.css?ver=1733883988	0%	Avira URL Cloud	safe
https://b45032.com/images_plus/other/en/right3.jpg	100%	Avira URL Cloud	phishing
https://5getfab.segrft.com/common/storage/game/egame/joker/z7k6mqf3z495a.png?ver=1673334591	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_seven7s.png?ver=1712128601	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/js/www/login.js?ver=1606790076	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/css/custom/header_custom.css?ver=1685593131	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/other/en/p-img1.png	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/en/224_egame_icon.png?1736725697344	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_TreasureBowls.png?ver=1728355170	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/159_egame_logo.png?ver=1713931261	0%	Avira URL Cloud	safe
https://b45032.com/gdcode_1736725694	100%	Avira URL Cloud	phishing
https://5getfab.segrft.com/plus/plugin/js/swiper.min.js?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/plugin/js/jquery.min.js?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/ue8mt39rhzpps.png?ver=1673334591	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/yoplay/YP801.png?ver=1664356226	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/217_egame_logo.png?ver=1692209012	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/js/unite/jsencrypt.min.js?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/header/common/spiler.png	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/o39k3h9o685xq.png?ver=1733369194	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/187_egame_logo.png?ver=1688355077	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/css/custom/egame_custom.css?ver=1736392866	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_FaFaFortune.png?ver=1728355170	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/mg/SMG_sharkPlatinum.png?ver=1720576306	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/136_egame_logo.png?ver=1606790110	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_tikiMania.png?ver=1712128601	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/mur8wje4dccb1.png?ver=1673334590	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plugins/jquery-ui/images/ui-icons_777777_256x240.png	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/ww3a8wsu4de7c.png?ver=1673334591	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_risingRoyals.png?ver=1712128601	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/js/custom/main.js?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/202_egame_icon.png?1736725718963	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/cms/cms_1051.png?ver=1611754184	0%	Avira URL Cloud	safe
https://b45032.com/common/storage/cms/cms_1045.png?v=1611754636	100%	Avira URL Cloud	phishing
https://5getfab.segrft.com/common/storage/game/egame/joker/zhh6mqf3z495a.png?ver=1734681327	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/index/sec-nav-bg-grad.gif	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/plugin/css/sweetalert.css?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/common/search.png	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/other/banner4.jpg?ver=1606891699	0%	Avira URL Cloud	safe
https://b45032.com/images_plus/other/en/right2.jpg	100%	Avira URL Cloud	phishing
https://5getfab.segrft.com/assets/js/caller.js?ver=1675418257	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/footer/footer_spiler.png	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/j9nzkkbjfaz1a.png?ver=1673334590	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/89_egame_logo.png?ver=1699847425	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/cz3wgrounyetc.png?ver=1673334590	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/css/custom/float_customer.css?ver=1606988918	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/fcg/21003.png?ver=1659683708	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/css/unite/login_unite.css?ver=1614680240	0%	Avira URL Cloud	safe
http://tongji.baidu.com/hm-web/welcome/ico	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/197_egame_logo.png?ver=1673578619	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/tocki7xk7xwq1.png?ver=1673334591	0%	Avira URL Cloud	safe
https://b45032.com/getcatlist/224	100%	Avira URL Cloud	phishing
https://5getfab.segrft.com/common/storage/game/egame/joker/fmjyoi4wkifrs.png?ver=1727844915	0%	Avira URL Cloud	safe
https://b45032.com/getegame?platform%5B%5D=202&page=1&gamename=&gameid=	100%	Avira URL Cloud	phishing
https://5getfab.segrft.com/images/dc_new.gif?ver=1606790076	0%	Avira URL Cloud	safe
https://b45032.com/getegame?platform%5B%5D=224&page=1&gamename=&gameid=	100%	Avira URL Cloud	phishing
https://5getfab.segrft.com/images_plus/footer/footer-gt.png?ver=1606790107	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/joker/3yfmucpss64mk.png?ver=1673334590	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/59_egame_logo.png?ver=1606790110	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/cms/cms_1052.jpg?ver=1611754797	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_stumpyMcDoodles.png?ver=1712128601	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/172_egame_logo.png?ver=1669192658	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/common/storage/game/egame/jdb/9020.png?ver=1715740152	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/plus/js/custom/moment-timezone.js?ver=1606790105	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/egame/nav/224_egame_icon.png?1736725697344	0%	Avira URL Cloud	safe
https://5getfab.segrft.com/images_plus/footer/footer-18plus.png?ver=1606790107	0%	Avira URL Cloud	safe

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: b45032.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/js/unite/crypto-js.min.js HTTP/1.1Host: b45032.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /js/www/decrypt.js HTTP/1.1Host: b45032.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /plus/js/unite/crypto-js.min.js HTTP/1.1Host: b45032.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /js/www/decrypt.js HTTP/1.1Host: b45032.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /plus/plugin/css/to_bootstrap.css?ver=1606790105 HTTP/1.1Host: b45032.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/bootstrap.min.js?ver=1606790105 HTTP/1.1Host: b45032.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /plus/plugin/css/sweetalert.css?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/css/font-awesome.min.css?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/common/bet365_style.css?ver=1684314915 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/css/jquery-ui.min.css?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/css/swiper.min.css?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/common/index.css?ver=1700473959 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/unite/prizedraw_pop_unite.css?ver=1733883988 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/custom/prizedraw_pop_custom.css?ver=1663905027 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/unite/float_unite.css?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/custom/float_customer.css?ver=1606988918 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/unite/login_modal_unite.css?ver=1726133380 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/custom/login_modal_custom.css?ver=1726649910 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/bootstrap.min.js?ver=1606790105 HTTP/1.1Host: b45032.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /plus/css/unite/login_unite.css?ver=1614680240 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/custom/login_custom.css?ver=1663905027 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/unite/header_unite.css?ver=1618279364 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/css/custom/header_custom.css?ver=1685593131 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plugins/jquery-ui/jquery-ui.min.css?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/jquery.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plugins/jquery-ui/jquery-ui.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/js/custom/checkinput.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/swiper.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/sweetalert.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/jquery-migrate.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/jquery-ui.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/js/custom/main.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/js/unite/share_unite.js?ver=1661222874 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gdcode_1736725656 HTTP/1.1Host: b45032.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
Source: global traffic	HTTP traffic detected: GET /js/www/login.js?ver=1606790076 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b45032.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/jquery.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/jquery-migrate.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/js/custom/checkinput.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /plus/plugin/js/sweetalert.min.js?ver=1606790105 HTTP/1.1Host: 5getfab.segrft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

IP	Domain	Country	ASN	ASN Name	Malicious
154.86.18.4	b45032.com	Seychelles	40065	CNSERVERSUS	true
111.45.3.198	hm.e.shifen.com	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
20.255.122.93	azcloud.g.tuf3a353.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
154.86.18.242	unknown	Seychelles	40065	CNSERVERSUS	false
14.215.183.79	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false

IP
192.168.2.4
192.168.2.6

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589661
Start date and time:	2025-01-13 00:46:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://b45032.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@18/499@18/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://b45032.com/egame/224 Browse: https://b45032.com/egame/202

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
azcloud.g.tuf3a353.com	20.255.122.93	true	false	unknown
b45032.com	154.86.18.4	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.100	true	false	high
hm.e.shifen.com	111.45.3.198	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
5getfab.segrft.com	unknown	unknown	true	unknown
hm.baidu.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://5getfab.segrft.com/images_plus/main/favicon.ico?ver=1606790107	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/76_egame_logo.png?ver=1606790110	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/173_egame_logo.png?ver=1698829779	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images/dc_hot.gif?ver=1606790076	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/footer/footer-GamCare.png?ver=1606790107	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/221_egame_logo.png?ver=1606790110	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_treasureHeroes.png?ver=1712128601	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/gdrbc1kqj7gr4.png?ver=1731898048	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/other/banner2.jpg?ver=1606891698	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/js/custom/login_custom.js?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plugins/jquery-ui/jquery-ui.min.css?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/js/unite/encforms.js?ver=1723544858	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/196_egame_logo.png?ver=1673578660	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/xkbfobaryz7xs.png?ver=1731898048	false	Avira URL Cloud: safe	unknown
https://b45032.com/images_plus/other/en/right3.jpg	true	Avira URL Cloud: phishing	unknown
https://hm.baidu.com/hm.js?947ea0365dd8ab01fc51bd9439b42930	false		high
https://5getfab.segrft.com/plugins/jquery-ui/images/ui-icons_555555_256x240.png	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/css/unite/prizedraw_pop_unite.css?ver=1733883988	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/index/g04.jpg?ver=1606793375	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/sky/sw_dhcf.png?ver=1691141966	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/en/202_egame_icon.png?1736725718963	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/js/www/login.js?ver=1606790076	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/css/custom/header_custom.css?ver=1685593131	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_seven7s.png?ver=1712128601	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/z7k6mqf3z495a.png?ver=1673334591	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/159_egame_logo.png?ver=1713931261	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_TreasureBowls.png?ver=1728355170	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/en/224_egame_icon.png?1736725697344	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/other/en/p-img1.png	false	Avira URL Cloud: safe	unknown
https://b45032.com/	true		unknown
https://5getfab.segrft.com/plus/plugin/js/swiper.min.js?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://b45032.com/gdcode_1736725694	true	Avira URL Cloud: phishing	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/ue8mt39rhzpps.png?ver=1673334591	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/yoplay/YP801.png?ver=1664356226	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/plugin/js/jquery.min.js?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/js/unite/jsencrypt.min.js?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/217_egame_logo.png?ver=1692209012	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/css/custom/egame_custom.css?ver=1736392866	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/187_egame_logo.png?ver=1688355077	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_FaFaFortune.png?ver=1728355170	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/header/common/spiler.png	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/o39k3h9o685xq.png?ver=1733369194	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/136_egame_logo.png?ver=1606790110	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_risingRoyals.png?ver=1712128601	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_tikiMania.png?ver=1712128601	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/mg/SMG_sharkPlatinum.png?ver=1720576306	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plugins/jquery-ui/images/ui-icons_777777_256x240.png	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/mur8wje4dccb1.png?ver=1673334590	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/js/custom/main.js?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/ww3a8wsu4de7c.png?ver=1673334591	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/202_egame_icon.png?1736725718963	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/cms/cms_1051.png?ver=1611754184	false	Avira URL Cloud: safe	unknown
https://b45032.com/common/storage/cms/cms_1045.png?v=1611754636	true	Avira URL Cloud: phishing	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/zhh6mqf3z495a.png?ver=1734681327	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/plugin/css/sweetalert.css?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://b45032.com/#	true		unknown
https://5getfab.segrft.com/images_plus/index/sec-nav-bg-grad.gif	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/common/search.png	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/other/banner4.jpg?ver=1606891699	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/j9nzkkbjfaz1a.png?ver=1673334590	false	Avira URL Cloud: safe	unknown
https://b45032.com/images_plus/other/en/right2.jpg	true	Avira URL Cloud: phishing	unknown
https://5getfab.segrft.com/images_plus/footer/footer_spiler.png	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/assets/js/caller.js?ver=1675418257	false	Avira URL Cloud: safe	unknown
https://b45032.com/egame/202	true		unknown
https://5getfab.segrft.com/images_plus/egame/nav/89_egame_logo.png?ver=1699847425	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/cz3wgrounyetc.png?ver=1673334590	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/css/custom/float_customer.css?ver=1606988918	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/fcg/21003.png?ver=1659683708	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/css/unite/login_unite.css?ver=1614680240	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/197_egame_logo.png?ver=1673578619	false	Avira URL Cloud: safe	unknown
https://b45032.com/getcatlist/224	true	Avira URL Cloud: phishing	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/tocki7xk7xwq1.png?ver=1673334591	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/fmjyoi4wkifrs.png?ver=1727844915	false	Avira URL Cloud: safe	unknown
https://b45032.com/getegame?platform%5B%5D=202&page=1&gamename=&gameid=	true	Avira URL Cloud: phishing	unknown
https://5getfab.segrft.com/common/storage/game/egame/joker/3yfmucpss64mk.png?ver=1673334590	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/footer/footer-gt.png?ver=1606790107	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images/dc_new.gif?ver=1606790076	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/cms/cms_1052.jpg?ver=1611754797	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/jdb/9020.png?ver=1715740152	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/172_egame_logo.png?ver=1669192658	false	Avira URL Cloud: safe	unknown
https://b45032.com/getegame?platform%5B%5D=224&page=1&gamename=&gameid=	true	Avira URL Cloud: phishing	unknown
https://5getfab.segrft.com/images_plus/egame/nav/59_egame_logo.png?ver=1606790110	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/common/storage/game/egame/upg/UPG_stumpyMcDoodles.png?ver=1712128601	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/plus/js/custom/moment-timezone.js?ver=1606790105	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/egame/nav/224_egame_icon.png?1736725697344	false	Avira URL Cloud: safe	unknown
https://5getfab.segrft.com/images_plus/footer/footer-18plus.png?ver=1606790107	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/moment/moment/issues/1423	chromecache_270.2.dr, chromecache_334.2.dr	false		high
http://stackoverflow.com/questions/181348/instantiating-a-javascript-object-by-calling-prototype-con	chromecache_270.2.dr, chromecache_334.2.dr	false		high
http://getbootstrap.com)	chromecache_354.2.dr, chromecache_356.2.dr	false		high
http://momentjs.com/guides/#/warnings/zone/	chromecache_270.2.dr, chromecache_334.2.dr	false		high
http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html	chromecache_270.2.dr, chromecache_334.2.dr	false		high
https://hmcdn.baidu.com/static/tongji/plugins/	chromecache_226.2.dr	false		high
http://www.idangero.us/swiper/	chromecache_266.2.dr, chromecache_307.2.dr	false		high
http://momentjs.com/timezone/docs/#/data-loading/.	chromecache_422.2.dr, chromecache_431.2.dr	false		high
http://momentjs.com/guides/#/warnings/min-max/	chromecache_334.2.dr	false		high
https://hmcdn.baidu.com/static	chromecache_226.2.dr	false		high
https://npmcdn.com/jsencrypt	chromecache_265.2.dr, chromecache_468.2.dr	false		high
http://tongji.baidu.com/hm-web/welcome/ico	chromecache_226.2.dr	false	Avira URL Cloud: safe	unknown
http://momentjs.com/guides/#/warnings/define-locale/	chromecache_270.2.dr, chromecache_334.2.dr	false		high
https://goutong.baidu.com/site/	chromecache_226.2.dr	false		high

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality", baseline, precision 8, 84x23, components 3
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	7.462189069615817
Encrypted:	false
SSDEEP:	24:O7A+di9YMWQo0XxDuLHeOWXG4OZ7DAJuLHenX3YSXO2+LPfAd+Ja/T513:GAmi9YMSuERA+EOdLnW+k/dp
MD5:	79E10E2C746DC4235797D4CAEC14B6D5
SHA1:	8F3EBD8EE436A01AD107D73FEA52E75403C91F85
SHA-256:	94312664736804B8E136136A55D983A6F11C36FA922F713A7D4442F7016D0CE3
SHA-512:	8EC2D6E154CE1977582926B36800579587BFBF7938946F074EA818170EE9008BD72ADB8BB95D5021FEA2D04E0E9B74C47C8B3A29220A6277938A51B26A86F2A0
Malicious:	false
Reputation:	low
URL:	https://b45032.com/gdcode_1736725694
Preview:	......JFIF.....`.`.....>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........T.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....FX..9.l..C...X.X.+....o.ZB.\|....gu.......'..8....t..)SR].O.r.vf\|Z....%c6.@Ll..~.....s..5.\t.\....tS.......rf.fwR...0....k...5....B.3.q3.M+.....:.ocw...&.s<c9.........=.WN.k.$....fV@s.....Z.. ...B..u0...O...5.H.....G........y..-......s.......[G.\M.Q...`..4.u....V...A..~,#.]KQ.H-.-.#...8_S.?Jo..e

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 00:47:31.728765011 CET	192.168.2.4	1.1.1.1	0xc946	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:31.728876114 CET	192.168.2.4	1.1.1.1	0xe008	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 13, 2025 00:47:35.395634890 CET	192.168.2.4	1.1.1.1	0xccfd	Standard query (0)	b45032.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:35.395813942 CET	192.168.2.4	1.1.1.1	0xd98a	Standard query (0)	b45032.com	65	IN (0x0001)	false
Jan 13, 2025 00:47:38.315021992 CET	192.168.2.4	1.1.1.1	0xf41b	Standard query (0)	b45032.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:38.315176964 CET	192.168.2.4	1.1.1.1	0x7e3b	Standard query (0)	b45032.com	65	IN (0x0001)	false
Jan 13, 2025 00:47:40.356372118 CET	192.168.2.4	1.1.1.1	0xba84	Standard query (0)	5getfab.segrft.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:40.356508970 CET	192.168.2.4	1.1.1.1	0x3fec	Standard query (0)	5getfab.segrft.com	65	IN (0x0001)	false
Jan 13, 2025 00:47:46.594727039 CET	192.168.2.4	1.1.1.1	0xb06e	Standard query (0)	5getfab.segrft.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:46.594922066 CET	192.168.2.4	1.1.1.1	0xc5f8	Standard query (0)	5getfab.segrft.com	65	IN (0x0001)	false
Jan 13, 2025 00:47:54.472861052 CET	192.168.2.4	1.1.1.1	0x9672	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:54.473138094 CET	192.168.2.4	1.1.1.1	0x84da	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
Jan 13, 2025 00:47:57.270467043 CET	192.168.2.4	1.1.1.1	0x8938	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:57.270865917 CET	192.168.2.4	1.1.1.1	0xcb8d	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
Jan 13, 2025 00:48:40.815124989 CET	192.168.2.4	1.1.1.1	0x399e	Standard query (0)	b45032.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:40.815380096 CET	192.168.2.4	1.1.1.1	0xef32	Standard query (0)	b45032.com	65	IN (0x0001)	false
Jan 13, 2025 00:48:44.554743052 CET	192.168.2.4	1.1.1.1	0x47e9	Standard query (0)	b45032.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:44.555349112 CET	192.168.2.4	1.1.1.1	0xb20e	Standard query (0)	b45032.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 00:47:31.735970974 CET	1.1.1.1	192.168.2.4	0xc946	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:31.736490011 CET	1.1.1.1	192.168.2.4	0xe008	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 13, 2025 00:47:35.457871914 CET	1.1.1.1	192.168.2.4	0xccfd	No error (0)	b45032.com		154.86.18.4	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:35.457871914 CET	1.1.1.1	192.168.2.4	0xccfd	No error (0)	b45032.com		154.86.18.242	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:35.457871914 CET	1.1.1.1	192.168.2.4	0xccfd	No error (0)	b45032.com		154.86.30.135	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:38.327980042 CET	1.1.1.1	192.168.2.4	0xf41b	No error (0)	b45032.com		154.86.18.4	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:38.327980042 CET	1.1.1.1	192.168.2.4	0xf41b	No error (0)	b45032.com		154.86.30.135	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:38.327980042 CET	1.1.1.1	192.168.2.4	0xf41b	No error (0)	b45032.com		154.86.18.242	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:40.797478914 CET	1.1.1.1	192.168.2.4	0x3fec	No error (0)	5getfab.segrft.com	azcloud.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:40.797478914 CET	1.1.1.1	192.168.2.4	0x3fec	No error (0)	azcloud.tuf3a353.com	azcloud.g.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:40.872189999 CET	1.1.1.1	192.168.2.4	0xba84	No error (0)	5getfab.segrft.com	azcloud.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:40.872189999 CET	1.1.1.1	192.168.2.4	0xba84	No error (0)	azcloud.tuf3a353.com	azcloud.g.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:40.872189999 CET	1.1.1.1	192.168.2.4	0xba84	No error (0)	azcloud.g.tuf3a353.com		20.255.122.93	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:40.872189999 CET	1.1.1.1	192.168.2.4	0xba84	No error (0)	azcloud.g.tuf3a353.com		20.2.192.47	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:44.169862032 CET	1.1.1.1	192.168.2.4	0x7a89	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:44.169862032 CET	1.1.1.1	192.168.2.4	0x7a89	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:46.290513992 CET	1.1.1.1	192.168.2.4	0xb455	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:46.290513992 CET	1.1.1.1	192.168.2.4	0xb455	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:47.275798082 CET	1.1.1.1	192.168.2.4	0xc5f8	No error (0)	5getfab.segrft.com	azcloud.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:47.275798082 CET	1.1.1.1	192.168.2.4	0xc5f8	No error (0)	azcloud.tuf3a353.com	azcloud.g.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:47.275866032 CET	1.1.1.1	192.168.2.4	0xb06e	No error (0)	5getfab.segrft.com	azcloud.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:47.275866032 CET	1.1.1.1	192.168.2.4	0xb06e	No error (0)	azcloud.tuf3a353.com	azcloud.g.tuf3a353.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:47.275866032 CET	1.1.1.1	192.168.2.4	0xb06e	No error (0)	azcloud.g.tuf3a353.com		20.255.122.93	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:47.275866032 CET	1.1.1.1	192.168.2.4	0xb06e	No error (0)	azcloud.g.tuf3a353.com		20.2.192.47	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:54.480041981 CET	1.1.1.1	192.168.2.4	0x9672	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:54.480041981 CET	1.1.1.1	192.168.2.4	0x9672	No error (0)	hm.e.shifen.com		111.45.3.198	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:54.480041981 CET	1.1.1.1	192.168.2.4	0x9672	No error (0)	hm.e.shifen.com		14.215.183.79	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:54.480041981 CET	1.1.1.1	192.168.2.4	0x9672	No error (0)	hm.e.shifen.com		183.240.98.228	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:54.480041981 CET	1.1.1.1	192.168.2.4	0x9672	No error (0)	hm.e.shifen.com		111.45.11.83	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:54.480041981 CET	1.1.1.1	192.168.2.4	0x9672	No error (0)	hm.e.shifen.com		14.215.182.140	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:54.480151892 CET	1.1.1.1	192.168.2.4	0x84da	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:57.417467117 CET	1.1.1.1	192.168.2.4	0xcb8d	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:57.417546034 CET	1.1.1.1	192.168.2.4	0x8938	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:57.417546034 CET	1.1.1.1	192.168.2.4	0x8938	No error (0)	hm.e.shifen.com		14.215.183.79	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:57.417546034 CET	1.1.1.1	192.168.2.4	0x8938	No error (0)	hm.e.shifen.com		111.45.11.83	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:57.417546034 CET	1.1.1.1	192.168.2.4	0x8938	No error (0)	hm.e.shifen.com		111.45.3.198	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:57.417546034 CET	1.1.1.1	192.168.2.4	0x8938	No error (0)	hm.e.shifen.com		183.240.98.228	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:57.417546034 CET	1.1.1.1	192.168.2.4	0x8938	No error (0)	hm.e.shifen.com		14.215.182.140	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:47:59.669929028 CET	1.1.1.1	192.168.2.4	0x7c79	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:47:59.669929028 CET	1.1.1.1	192.168.2.4	0x7c79	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:23.399581909 CET	1.1.1.1	192.168.2.4	0x13e6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:48:23.399581909 CET	1.1.1.1	192.168.2.4	0x13e6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:40.876698971 CET	1.1.1.1	192.168.2.4	0x399e	No error (0)	b45032.com		154.86.18.4	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:40.876698971 CET	1.1.1.1	192.168.2.4	0x399e	No error (0)	b45032.com		154.86.18.242	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:40.876698971 CET	1.1.1.1	192.168.2.4	0x399e	No error (0)	b45032.com		154.86.30.135	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:43.068718910 CET	1.1.1.1	192.168.2.4	0x550b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 00:48:43.068718910 CET	1.1.1.1	192.168.2.4	0x550b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:44.572443962 CET	1.1.1.1	192.168.2.4	0x47e9	No error (0)	b45032.com		154.86.18.242	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:44.572443962 CET	1.1.1.1	192.168.2.4	0x47e9	No error (0)	b45032.com		154.86.30.135	A (IP address)	IN (0x0001)	false
Jan 13, 2025 00:48:44.572443962 CET	1.1.1.1	192.168.2.4	0x47e9	No error (0)	b45032.com		154.86.18.4	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:36 UTC	653	OUT	GET / HTTP/1.1 Host: b45032.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:37 UTC	1112	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Alt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1 Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; expires=Mon, 13-Jan-2025 01:47:37 GMT; Max-Age=7200; path=/; secure; samesite=none Set-Cookie: vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D; expires=Mon, 13-Jan-2025 01:47:37 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none Server: nginx
2025-01-12 23:47:37 UTC	15272	IN	Data Raw: 62 62 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 35 67 65 74 66 61 62 2e 73 65 67 72 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 73 5f 70 6c 75 73 2f 6d 61 69 6e 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 76 65 72 3d 31 36 30 36 37 39 30 31 30 37 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 70 6c 75 73 2f 6a 73 2f 75 6e 69 74 65 2f 63 72 79 70 74 6f 2d 6a 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 Data Ascii: bb4<!DOCTYPE html><html><head><title></title><meta charset="utf-8"><link rel="shortcut icon" href="//5getfab.segrft.com/images_plus/main/favicon.ico?ver=1606790107"><script type="text/javascript" src="/plus/js/unite/crypto-js.min.js"></script><script ty
2025-01-12 23:47:37 UTC	16384	IN	Data Raw: 35 2b 49 6d 2f 6c 49 58 6f 42 4f 4d 63 58 6e 50 0d 0a 66 66 38 0d 0a 4b 38 56 6b 44 35 5a 6c 4b 34 5a 6a 75 72 6d 4f 55 76 72 62 51 59 56 69 4f 37 2b 4b 50 36 68 32 36 46 39 74 62 54 45 39 73 41 44 58 6b 57 4e 4c 4a 4d 77 65 77 36 4e 6d 43 34 76 2b 64 58 39 73 39 36 75 4b 31 37 72 6e 35 59 31 47 44 43 6e 41 39 36 41 37 53 52 6d 53 4f 47 30 52 6c 45 4d 47 48 53 70 49 7a 4f 50 54 68 35 7a 7a 4e 72 31 64 45 76 67 61 45 57 69 30 49 42 7a 55 4a 38 6a 67 77 4f 35 66 79 41 53 4e 4b 38 64 47 33 66 7a 32 73 72 69 6e 39 69 46 77 6b 76 4c 71 52 58 52 56 35 31 79 58 61 61 6f 32 55 37 37 71 39 68 6f 47 70 2f 51 51 70 49 35 34 32 5a 58 68 38 61 47 5a 48 37 71 4e 55 77 6d 76 79 6b 4d 52 42 79 58 70 33 7a 4e 38 55 53 32 61 43 43 72 66 53 61 59 51 64 67 39 53 30 38 43 6b Data Ascii: 5+Im/lIXoBOMcXnPff8K8VkD5ZlK4ZjurmOUvrbQYViO7+KP6h26F9tbTE9sADXkWNLJMwew6NmC4v+dX9s96uK17rn5Y1GDCnA96A7SRmSOG0RlEMGHSpIzOPTh5zzNr1dEvgaEWi0IBzUJ8jgwO5fyASNK8dG3fz2srin9iFwkvLqRXRV51yXaao2U77q9hoGp/QQpI542ZXh8aGZH7qNUwmvykMRByXp3zN8US2aCCrfSaYQdg9S08Ck
2025-01-12 23:47:37 UTC	16384	IN	Data Raw: 31 46 6e 2b 33 34 56 34 2f 31 32 51 66 69 71 0d 0a 31 66 66 38 0d 0a 49 6f 36 4a 72 64 6e 6e 2b 53 77 4d 6a 58 57 41 64 76 6e 6c 58 78 48 76 2b 4b 66 46 59 4a 74 2b 7a 4f 46 2f 58 41 73 54 61 51 73 63 75 32 38 55 39 70 33 41 77 77 45 30 76 2f 66 61 4a 66 78 4a 41 7a 46 56 37 76 45 70 34 72 2b 54 33 74 34 6f 38 2b 64 64 51 34 50 6b 52 6e 70 75 49 36 50 71 6b 4e 71 4d 45 66 42 74 2f 2f 62 2f 4d 46 43 32 50 32 47 67 61 67 71 32 53 79 30 70 4c 4b 78 42 2b 52 67 58 35 5a 68 2b 42 39 41 50 70 4c 39 72 36 50 59 52 68 2f 4a 4e 48 75 5a 6f 6f 69 43 56 4b 48 70 63 63 46 54 73 6d 43 31 69 4b 63 50 31 63 30 39 6f 75 6a 6a 79 62 41 38 4e 65 75 6a 53 5a 75 2b 2b 36 2f 79 4b 57 48 2f 4f 55 75 5a 4c 4c 56 35 64 56 57 4e 32 41 42 68 65 6c 62 30 6e 66 58 46 57 70 4b 42 5a Data Ascii: 1Fn+34V4/12Qfiq1ff8Io6Jrdnn+SwMjXWAdvnlXxHv+KfFYJt+zOF/XAsTaQscu28U9p3AwwE0v/faJfxJAzFV7vEp4r+T3t4o8+ddQ4PkRnpuI6PqkNqMEfBt//b/MFC2P2Ggagq2Sy0pLKxB+RgX5Zh+B9APpL9r6PYRh/JNHuZooiCVKHpccFTsmC1iKcP1c09oujjybA8NeujSZu++6/yKWH/OUuZLLV5dVWN2ABhelb0nfXFWpKBZ
2025-01-12 23:47:37 UTC	16384	IN	Data Raw: 46 76 51 67 38 35 45 50 66 6b 42 58 7a 68 70 70 57 79 4a 46 72 66 36 6f 30 36 68 61 6f 31 54 72 48 2f 31 33 47 38 34 44 7a 5a 6a 73 69 46 64 49 41 30 35 75 4b 36 30 4d 52 56 57 39 69 35 55 64 67 58 6c 6f 53 66 6a 74 48 35 65 63 4a 61 36 37 57 6c 41 54 5a 75 66 55 5a 58 6f 35 74 55 52 45 39 5a 52 31 69 59 78 39 33 45 6a 4d 69 79 67 42 2b 55 73 64 66 34 4e 41 73 6b 74 6e 6d 56 46 4d 68 47 4d 65 32 38 45 79 6d 30 4e 50 52 47 58 42 30 77 77 4f 75 7a 43 67 49 66 59 44 4f 46 56 79 56 38 2f 31 56 66 46 73 6f 72 4c 6f 69 35 72 6f 64 6f 58 4f 50 6d 4c 2f 59 67 71 33 74 49 76 4b 50 63 5a 6b 30 69 32 62 44 63 49 57 51 63 6c 47 4e 45 65 45 58 39 5a 67 41 68 4d 71 59 77 79 7a 73 43 30 54 6d 52 4b 49 71 68 71 4a 37 4a 53 67 6c 54 6e 53 53 6b 33 65 51 4c 2b 53 44 61 56 Data Ascii: FvQg85EPfkBXzhppWyJFrf6o06hao1TrH/13G84DzZjsiFdIA05uK60MRVW9i5UdgXloSfjtH5ecJa67WlATZufUZXo5tURE9ZR1iYx93EjMiygB+Usdf4NAsktnmVFMhGMe28Eym0NPRGXB0wwOuzCgIfYDOFVyV8/1VfFsorLoi5rodoXOPmL/Ygq3tIvKPcZk0i2bDcIWQclGNEeEX9ZgAhMqYwyzsC0TmRKIqhqJ7JSglTnSSk3eQL+SDaV
2025-01-12 23:47:37 UTC	16384	IN	Data Raw: 52 6e 64 47 6a 35 73 4e 49 37 39 2b 52 46 65 75 48 71 38 4e 72 72 37 4d 75 50 6f 57 52 53 75 6e 4d 6c 67 75 61 51 32 37 6a 2f 6f 31 64 4f 4f 33 6e 66 43 31 52 55 4b 4b 57 74 58 4e 52 51 77 79 62 73 6b 35 66 72 75 6d 2b 6a 6f 57 66 6f 4b 54 5a 75 37 4e 4c 67 4a 65 62 55 70 55 43 47 43 43 50 58 56 76 57 36 75 58 54 47 6e 75 69 37 2f 5a 50 41 70 36 76 2f 70 59 69 70 52 71 64 6c 4a 63 42 50 5a 75 6e 2b 48 4c 48 5a 4f 30 4e 69 30 52 6c 75 4b 6a 67 30 37 51 31 53 33 52 78 53 42 53 77 39 62 2b 58 79 47 6a 4d 38 5a 41 2b 32 30 58 35 76 2b 4d 49 71 31 43 37 6f 71 69 59 45 61 63 75 4b 68 64 50 5a 4f 55 6a 53 79 74 52 36 48 68 74 31 6f 6d 65 42 6b 34 4f 51 4a 49 42 47 5a 59 4f 69 33 48 6d 34 54 69 42 6d 4a 61 49 35 73 6c 35 58 54 34 44 55 4b 34 6f 6a 33 4d 30 36 6d Data Ascii: RndGj5sNI79+RFeuHq8Nrr7MuPoWRSunMlguaQ27j/o1dOO3nfC1RUKKWtXNRQwybsk5frum+joWfoKTZu7NLgJebUpUCGCCPXVvW6uXTGnui7/ZPAp6v/pYipRqdlJcBPZun+HLHZO0Ni0RluKjg07Q1S3RxSBSw9b+XyGjM8ZA+20X5v+MIq1C7oqiYEacuKhdPZOUjSytR6Hht1omeBk4OQJIBGZYOi3Hm4TiBmJaI5sl5XT4DUK4oj3M06m
2025-01-12 23:47:37 UTC	16384	IN	Data Raw: 4a 36 55 77 49 4c 2b 34 4b 64 4a 33 77 49 51 73 41 47 4f 4d 56 63 33 6f 6d 41 74 78 63 49 7a 52 68 66 33 62 72 67 5a 39 68 6e 4e 72 34 5a 68 59 64 51 6f 44 4c 43 54 4f 68 51 45 45 72 42 66 63 44 6b 75 42 75 4e 32 5a 44 43 30 46 49 74 56 58 57 2b 46 66 53 4b 6b 34 6f 7a 73 38 77 71 4c 62 49 55 6b 50 73 64 36 73 64 7a 61 30 6c 75 2f 55 6b 71 38 42 33 50 47 66 4b 39 48 34 35 66 38 2f 78 38 75 46 72 74 38 73 67 68 42 75 38 33 46 33 61 73 45 6e 47 44 67 47 64 59 69 48 36 41 6f 2f 62 54 76 48 53 79 67 71 52 2f 2b 43 6b 53 47 44 6b 58 4e 4d 65 66 37 77 50 79 70 31 44 33 66 6a 4e 2b 51 55 6b 73 41 72 75 7a 59 46 51 6a 53 34 6b 32 77 63 46 45 4d 39 44 53 4e 4a 46 37 53 75 50 43 38 46 57 53 45 52 6c 38 72 69 36 55 73 6a 59 4a 32 77 58 4a 6f 4b 68 45 69 37 59 63 2f Data Ascii: J6UwIL+4KdJ3wIQsAGOMVc3omAtxcIzRhf3brgZ9hnNr4ZhYdQoDLCTOhQEErBfcDkuBuN2ZDC0FItVXW+FfSKk4ozs8wqLbIUkPsd6sdza0lu/Ukq8B3PGfK9H45f8/x8uFrt8sghBu83F3asEnGDgGdYiH6Ao/bTvHSygqR/+CkSGDkXNMef7wPyp1D3fjN+QUksAruzYFQjS4k2wcFEM9DSNJF7SuPC8FWSERl8ri6UsjYJ2wXJoKhEi7Yc/
2025-01-12 23:47:37 UTC	16384	IN	Data Raw: 74 44 47 2f 6c 4f 66 72 2f 4b 75 50 43 74 6e 72 43 78 45 51 54 66 4a 43 32 6a 70 63 78 56 62 53 77 58 4e 78 71 5a 51 78 62 49 75 36 4e 44 42 62 62 4c 70 6e 75 48 33 53 39 47 34 38 55 30 62 4d 43 66 32 6c 54 79 58 50 4a 51 67 64 6d 52 45 44 4c 6c 4e 33 64 78 4b 2f 45 57 59 63 63 5a 39 70 4b 41 6d 54 64 76 30 4e 4f 69 7a 65 37 45 53 52 4b 50 49 32 6b 75 70 39 74 57 4c 52 4d 4b 63 63 47 68 32 74 74 56 32 69 47 62 62 4e 66 6d 43 47 70 54 52 6b 55 6a 51 45 6c 71 56 49 47 31 70 57 4b 56 6c 46 75 69 6d 62 5a 4a 58 53 35 33 4b 54 51 76 6e 5a 74 36 52 66 41 6e 75 79 6d 6f 4d 57 52 6e 55 4b 37 69 6e 39 38 2b 44 6d 56 73 47 76 52 59 38 35 30 51 57 38 53 51 48 77 36 50 66 42 65 34 59 4f 61 65 38 31 6c 46 71 6d 2f 51 2f 39 63 70 68 38 53 76 35 55 51 7a 30 6d 47 37 45 Data Ascii: tDG/lOfr/KuPCtnrCxEQTfJC2jpcxVbSwXNxqZQxbIu6NDBbbLpnuH3S9G48U0bMCf2lTyXPJQgdmREDLlN3dxK/EWYccZ9pKAmTdv0NOize7ESRKPI2kup9tWLRMKccGh2ttV2iGbbNfmCGpTRkUjQElqVIG1pWKVlFuimbZJXS53KTQvnZt6RfAnuymoMWRnUK7in98+DmVsGvRY850QW8SQHw6PfBe4YOae81lFqm/Q/9cph8Sv5UQz0mG7E
2025-01-12 23:47:37 UTC	10768	IN	Data Raw: 5a 4b 52 43 79 71 57 4b 6c 6c 6c 46 56 61 51 0d 0a 32 39 66 32 0d 0a 4a 45 57 6d 6a 4d 4f 69 54 66 56 38 49 6f 65 67 6c 62 7a 31 51 77 6b 59 4c 41 30 63 55 46 4a 74 73 72 56 5a 4b 43 76 41 64 45 77 52 6f 49 76 57 39 41 4e 6f 66 48 70 4e 37 31 7a 4d 72 36 6e 45 49 34 66 34 6b 77 77 30 39 65 74 47 45 41 73 6f 55 6c 46 2b 73 50 6d 65 48 4a 46 4c 62 48 33 37 6d 46 72 44 73 4e 4f 4f 71 42 68 6e 45 68 53 69 4b 66 34 59 67 64 4e 62 79 54 58 36 68 78 78 57 74 54 4c 45 74 78 4a 50 6b 4d 70 72 62 59 73 57 65 6c 54 76 69 75 30 47 35 6e 48 71 4e 45 49 55 6f 67 6c 35 58 64 77 4d 59 39 66 30 56 67 54 34 4d 63 70 66 6b 68 63 57 65 50 67 49 36 75 34 33 6c 73 35 33 71 6f 45 4a 71 38 51 32 79 2f 4f 32 58 72 34 70 6e 51 4b 47 6a 61 63 35 6b 78 55 73 74 43 68 57 5a 6f 6a 6d Data Ascii: ZKRCyqWKlllFVaQ29f2JEWmjMOiTfV8Ioeglbz1QwkYLA0cUFJtsrVZKCvAdEwRoIvW9ANofHpN71zMr6nEI4f4kww09etGEAsoUlF+sPmeHJFLbH37mFrDsNOOqBhnEhSiKf4YgdNbyTX6hxxWtTLEtxJPkMprbYsWelTviu0G5nHqNEIUogl5XdwMY9f0VgT4McpfkhcWePgI6u43ls53qoEJq8Q2y/O2Xr4pnQKGjac5kxUstChWZojm

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:37 UTC	1131	OUT	GET /plus/js/unite/crypto-js.min.js HTTP/1.1 Host: b45032.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
2025-01-12 23:47:38 UTC	416	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:37 GMT Content-Type: application/javascript Content-Length: 47992 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Alt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1 Last-Modified: Thu, 13 Jan 2022 09:57:13 GMT ETag: "61dff779-bb78" X-Cache-Status: HIT Server: nginx Accept-Ranges: bytes
2025-01-12 23:47:38 UTC	15968	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a 2c 56 2c 47 2c 4a Data Ascii: !function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J
2025-01-12 23:47:38 UTC	16384	IN	Data Raw: 32 34 7c 72 3e 3e 3e 38 29 2c 74 2e 73 69 67 42 79 74 65 73 3d 34 2a 28 65 2e 6c 65 6e 67 74 68 2b 31 29 2c 74 68 69 73 2e 5f 70 72 6f 63 65 73 73 28 29 3b 66 6f 72 28 76 61 72 20 6e 3d 74 68 69 73 2e 5f 68 61 73 68 2c 6f 3d 6e 2e 77 6f 72 64 73 2c 73 3d 30 3b 73 3c 35 3b 73 2b 2b 29 7b 76 61 72 20 63 3d 6f 5b 73 5d 3b 6f 5b 73 5d 3d 31 36 37 31 31 39 33 35 26 28 63 3c 3c 38 7c 63 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 63 3c 3c 32 34 7c 63 3e 3e 3e 38 29 7d 72 65 74 75 72 6e 20 6e 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 6c 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 2c 73 2e 52 49 Data Ascii: 24\|r>>>8),t.sigBytes=4*(e.length+1),this._process();for(var n=this._hash,o=n.words,s=0;s<5;s++){var c=o[s];o[s]=16711935&(c<<8\|c>>>24)\|4278255360&(c<<24\|c>>>8)}return n},clone:function(){var t=l.clone.call(this);return t._hash=this._hash.clone(),t}}),s.RI
2025-01-12 23:47:38 UTC	15640	IN	Data Raw: 72 52 65 73 65 74 21 3d 3d 74 68 69 73 2e 5f 6b 65 79 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 6b 65 79 50 72 69 6f 72 52 65 73 65 74 3d 74 68 69 73 2e 5f 6b 65 79 2c 65 3d 74 2e 77 6f 72 64 73 2c 72 3d 74 2e 73 69 67 42 79 74 65 73 2f 34 2c 69 3d 34 2a 28 31 2b 28 74 68 69 73 2e 5f 6e 52 6f 75 6e 64 73 3d 36 2b 72 29 29 2c 6e 3d 74 68 69 73 2e 5f 6b 65 79 53 63 68 65 64 75 6c 65 3d 5b 5d 2c 6f 3d 30 3b 6f 3c 69 3b 6f 2b 2b 29 6f 3c 72 3f 6e 5b 6f 5d 3d 65 5b 6f 5d 3a 28 61 3d 6e 5b 6f 2d 31 5d 2c 6f 25 72 3f 36 3c 72 26 26 6f 25 72 3d 3d 34 26 26 28 61 3d 68 5b 61 3e 3e 3e 32 34 5d 3c 3c 32 34 7c 68 5b 61 3e 3e 3e 31 36 26 32 35 35 5d 3c 3c 31 36 7c 68 5b 61 3e 3e 3e 38 26 32 35 35 5d 3c 3c 38 7c 68 5b 32 35 35 26 61 5d 29 3a 28 61 3d 68 5b Data Ascii: rReset!==this._key){for(var t=this._keyPriorReset=this._key,e=t.words,r=t.sigBytes/4,i=4*(1+(this._nRounds=6+r)),n=this._keySchedule=[],o=0;o<i;o++)o<r?n[o]=e[o]:(a=n[o-1],o%r?6<r&&o%r==4&&(a=h[a>>>24]<<24\|h[a>>>16&255]<<16\|h[a>>>8&255]<<8\|h[255&a]):(a=h[

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:39 UTC	1118	OUT	GET /js/www/decrypt.js HTTP/1.1 Host: b45032.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
2025-01-12 23:47:40 UTC	390	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:40 GMT Content-Type: application/javascript Content-Length: 531 Connection: close Vary: Accept-Encoding Alt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1 Last-Modified: Fri, 17 Nov 2023 09:01:26 GMT ETag: "65572be6-213" X-Cache-Status: HIT Server: nginx Accept-Ranges: bytes
2025-01-12 23:47:40 UTC	531	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 63 72 79 70 74 6f 4a 73 41 65 73 44 65 63 72 79 70 74 28 65 6e 63 72 79 70 74 65 64 2c 20 70 61 73 73 29 20 7b 0a 20 20 20 20 76 61 72 20 6b 65 79 20 3d 20 43 72 79 70 74 6f 4a 53 2e 53 48 41 32 35 36 28 70 61 73 73 29 3b 0a 20 20 20 20 76 61 72 20 69 76 41 6e 64 43 69 70 68 65 72 74 65 78 74 20 3d 20 43 72 79 70 74 6f 4a 53 2e 65 6e 63 2e 42 61 73 65 36 34 2e 70 61 72 73 65 28 65 6e 63 72 79 70 74 65 64 29 3b 0a 20 20 20 20 76 61 72 20 69 76 20 3d 20 43 72 79 70 74 6f 4a 53 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2e 63 72 65 61 74 65 28 69 76 41 6e 64 43 69 70 68 65 72 74 65 78 74 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 2c 20 34 29 29 3b 0a 20 20 20 20 76 61 72 20 63 69 70 68 65 72 74 65 78 74 20 3d 20 43 72 79 70 74 6f 4a Data Ascii: function cryptoJsAesDecrypt(encrypted, pass) { var key = CryptoJS.SHA256(pass); var ivAndCiphertext = CryptoJS.enc.Base64.parse(encrypted); var iv = CryptoJS.lib.WordArray.create(ivAndCiphertext.words.slice(0, 4)); var ciphertext = CryptoJ

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	947	OUT	GET /js/www/decrypt.js HTTP/1.1 Host: b45032.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
2025-01-12 23:47:41 UTC	390	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:41 GMT Content-Type: application/javascript Content-Length: 531 Connection: close Vary: Accept-Encoding Alt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1 Last-Modified: Fri, 17 Nov 2023 09:01:26 GMT ETag: "65572be6-213" X-Cache-Status: HIT Server: nginx Accept-Ranges: bytes
2025-01-12 23:47:41 UTC	531	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 63 72 79 70 74 6f 4a 73 41 65 73 44 65 63 72 79 70 74 28 65 6e 63 72 79 70 74 65 64 2c 20 70 61 73 73 29 20 7b 0a 20 20 20 20 76 61 72 20 6b 65 79 20 3d 20 43 72 79 70 74 6f 4a 53 2e 53 48 41 32 35 36 28 70 61 73 73 29 3b 0a 20 20 20 20 76 61 72 20 69 76 41 6e 64 43 69 70 68 65 72 74 65 78 74 20 3d 20 43 72 79 70 74 6f 4a 53 2e 65 6e 63 2e 42 61 73 65 36 34 2e 70 61 72 73 65 28 65 6e 63 72 79 70 74 65 64 29 3b 0a 20 20 20 20 76 61 72 20 69 76 20 3d 20 43 72 79 70 74 6f 4a 53 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2e 63 72 65 61 74 65 28 69 76 41 6e 64 43 69 70 68 65 72 74 65 78 74 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 2c 20 34 29 29 3b 0a 20 20 20 20 76 61 72 20 63 69 70 68 65 72 74 65 78 74 20 3d 20 43 72 79 70 74 6f 4a Data Ascii: function cryptoJsAesDecrypt(encrypted, pass) { var key = CryptoJS.SHA256(pass); var ivAndCiphertext = CryptoJS.enc.Base64.parse(encrypted); var iv = CryptoJS.lib.WordArray.create(ivAndCiphertext.words.slice(0, 4)); var ciphertext = CryptoJ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://b45032.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Windows Analysis Report
https://b45032.com/

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	1162	OUT	GET /plus/plugin/css/to_bootstrap.css?ver=1606790105 HTTP/1.1 Host: b45032.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
2025-01-12 23:47:42 UTC	366	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:41 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Alt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1 Last-Modified: Tue, 01 Dec 2020 02:35:05 GMT ETag: W/"5fc5abd9-2dc4a" Content-Encoding: gzip X-Cache-Status: HIT Server: nginx
2025-01-12 23:47:42 UTC	16018	IN	Data Raw: 37 35 31 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 6b 8f 23 c9 91 20 f8 7d 81 fd 0f 31 55 18 74 b5 a6 c8 4e 32 df 39 68 9d e6 b4 8b 9d 01 46 f3 e1 76 0e 58 a0 d5 37 08 92 c1 24 55 4c 92 22 99 f5 e8 ba db df 7e e6 6e 8f f0 97 b9 7b 30 b3 5a 33 03 a9 5a 52 17 c3 cd dc de 66 fe 1e 9f 76 ff 36 db ed 4e c7 d3 a1 dd 37 5f ff eb 7f 69 9a 1f 7e f3 37 f0 7f bf 69 fe 4f f9 f9 e3 e5 f8 72 7c db bc 5b 9d 4e fb 87 1f 7e 78 ec 4e 02 32 9e ef 9e be b7 cd 7f bf db 7f 39 ac 1f 57 a7 66 7a 31 99 8c e0 7f 6e 9a 7f fd b4 3e 9d ba c3 fb e6 9f b6 f3 b1 6d f5 cf eb 79 b7 3d 76 8b e6 79 bb e8 0e cd 1f fe e9 5f 11 ed d1 e0 5d 9f 56 cf 33 83 f1 87 d3 a7 d9 f1 07 e9 e4 87 d9 66 37 fb e1 a9 3d 02 ae 1f fe f9 9f 7e ff df ff e5 7f fe 77 db e9 0f 44 6f b3 dd 1d 9e da cd fa 97 6e 3c Data Ascii: 7517k# }1UtN29hFvX7$UL"~n{0Z3ZRfv6N7_i~7iOr\|[N~xN29Wfz1n>my=vy_]V3f7=~wDon<
2025-01-12 23:47:42 UTC	13970	IN	Data Raw: 67 97 27 92 a8 b9 5e fa 6a 8c 59 e2 9e be 49 cc 22 c1 09 60 9c 15 cc e8 dd 6d 86 53 3b a5 c6 d8 ca bc a2 90 b7 28 fb dd 6b 4c 7f b1 6c 78 73 04 23 1c 4a a4 0d e9 b4 db 6d 20 b8 a2 b7 f8 60 ca ac a6 9d c1 64 30 9d 4a b7 45 8e 75 69 67 a7 3f 5d 26 6a fc 80 a1 73 1e e8 b7 a9 a1 05 b0 45 d4 78 b2 c9 89 06 ed 83 3c 0d ee 96 79 f7 b0 5c 1f 60 1c 3e 5f ad 37 8b ef 1f ec 2f 9b d6 ff a1 0f be 78 d3 07 5d 67 ca 53 30 34 fd 9e ae 56 c4 cd d9 b9 9c ee 12 6a 1d 8e e4 1c 92 21 7f 61 05 27 a3 f7 44 fa 4d b4 48 1b a9 27 d2 5e 76 48 98 c3 ee f7 39 ef 02 8d 48 a2 45 29 c7 f0 28 af be 6a b0 19 2b cb 82 c9 88 5e 83 32 07 43 6d dc e5 1e 61 63 c2 23 1d 91 31 78 0c f1 32 4e 9d 09 50 57 8e 78 b5 4e 1e 7a 95 14 14 20 b6 ea fa 44 12 6d a0 2a 8f 8f 6f 67 5c c4 73 cf 4f 2c 69 d5 cb Data Ascii: g'^jYI"`mS;(kLlxs#Jm `d0JEuig?]&jsEx<y\`>_7/x]gS04Vj!a'DMH'^vH9HE)(j+^2Cmac#1x2NPWxNz Dm*og\sO,i

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	1147	OUT	GET /plus/plugin/js/bootstrap.min.js?ver=1606790105 HTTP/1.1 Host: b45032.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlQ5TG5DTmYzQ250YWc5Zm0xMTF6NWc9PSIsInZhbHVlIjoiMUU0dWNhMTJHV3BiXC81MTF6dGZ1TTh5UWJCMHlXbXBXUFlQUFM2dzMxVmUxc2lTODBxcmh5ajd0d0k5ZE0zbmZ5MkVLTmVEaWRXVVFvUEo4OWhRaGt3PT0iLCJtYWMiOiIwYzg3ZGU4MTY2MDI0Nzk3MDM3YzJjMzIzMTk4MGYyYzM4Yjg5N2JhOGNkYmIwOTllODIxNDdhNDRhMzk1Njg3In0%3D; vanguard_session=eyJpdiI6InFvbEpjb3ltYnI5UHF4Y0IwMExEMGc9PSIsInZhbHVlIjoiZ3g1SGg1eEVkb3dUaGFBY1lKUnhWQUVLMEFDd0cwVXlPWlJnaVk5c2hHWTBFY0h2cmhZb2t6dWFwb3hxRDZuV1YrME5oSzVtbnQ2bHdHVFpvbGlZXC93PT0iLCJtYWMiOiIyODY3YzY0OTQ3ZDNjNDJiYTVhNjIxZmZhMzhiYzdjYTc1ZDU0ZGRkY2QzNWJjM2I4YTdkNjE3MTI4OTRjMTQ1In0%3D
2025-01-12 23:47:42 UTC	416	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:41 GMT Content-Type: application/javascript Content-Length: 37045 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Alt-Svc: h3="67e285f0.t74nx2b2.com:443";ma=604800;persist=1,h2="bt5.tuf3a353.com:443";ma=604800;persist=1 Last-Modified: Tue, 01 Dec 2020 02:35:05 GMT ETag: "5fc5abd9-90b5" X-Cache-Status: HIT Server: nginx Accept-Ranges: bytes
2025-01-12 23:47:42 UTC	15968	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 33 2e 37 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 36 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 2f 0a 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 6f 6f 74 73 74 72 61 70 27 73 20 4a 61 76 61 53 63 72 69 70 74 20 72 65 71 75 69 72 65 73 20 6a 51 75 65 72 79 22 29 3b 2b 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 62 3d 61 2e 66 6e 2e 6a 71 75 65 72 Data Ascii: /! Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under the MIT license */if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn.jquer
2025-01-12 23:47:42 UTC	16384	IN	Data Raw: 28 22 69 6e 22 29 2e 6f 66 66 28 22 63 6c 69 63 6b 2e 64 69 73 6d 69 73 73 2e 62 73 2e 6d 6f 64 61 6c 22 29 2e 6f 66 66 28 22 6d 6f 75 73 65 75 70 2e 64 69 73 6d 69 73 73 2e 62 73 2e 6d 6f 64 61 6c 22 29 2c 74 68 69 73 2e 24 64 69 61 6c 6f 67 2e 6f 66 66 28 22 6d 6f 75 73 65 64 6f 77 6e 2e 64 69 73 6d 69 73 73 2e 62 73 2e 6d 6f 64 61 6c 22 29 2c 61 2e 73 75 70 70 6f 72 74 2e 74 72 61 6e 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 68 61 73 43 6c 61 73 73 28 22 66 61 64 65 22 29 3f 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 6f 6e 65 28 22 62 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 22 2c 61 2e 70 72 6f 78 79 28 74 68 69 73 2e 68 69 64 65 4d 6f 64 61 6c 2c 74 68 69 73 29 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 Data Ascii: ("in").off("click.dismiss.bs.modal").off("mouseup.dismiss.bs.modal"),this.$dialog.off("mousedown.dismiss.bs.modal"),a.support.transition&&this.$element.hasClass("fade")?this.$element.one("bsTransitionEnd",a.proxy(this.hideModal,this)).emulateTransitionEnd
2025-01-12 23:47:42 UTC	4693	IN	Data Raw: 65 73 74 28 22 6c 69 2e 64 72 6f 70 64 6f 77 6e 22 29 2e 61 64 64 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 29 2c 64 2e 74 72 69 67 67 65 72 28 22 61 63 74 69 76 61 74 65 2e 62 73 2e 73 63 72 6f 6c 6c 73 70 79 22 29 7d 2c 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 61 28 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 29 2e 70 61 72 65 6e 74 73 55 6e 74 69 6c 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 74 61 72 67 65 74 2c 22 2e 61 63 74 69 76 65 22 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 7d 3b 76 61 72 20 64 3d 61 2e 66 6e 2e 73 63 72 6f 6c 6c 73 70 79 3b 61 2e 66 6e 2e 73 63 72 6f 6c 6c 73 70 79 3d 63 2c 61 2e 66 6e 2e 73 63 72 6f 6c 6c 73 70 79 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 62 2c Data Ascii: est("li.dropdown").addClass("active")),d.trigger("activate.bs.scrollspy")},b.prototype.clear=function(){a(this.selector).parentsUntil(this.options.target,".active").removeClass("active")};var d=a.fn.scrollspy;a.fn.scrollspy=c,a.fn.scrollspy.Constructor=b,

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	571	OUT	GET /plus/plugin/css/sweetalert.css?ver=1606790105 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:42 UTC	290	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:42 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 01 Dec 2020 02:35:05 GMT ETag: W/"5fc5abd9-59ad" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT
2025-01-12 23:47:42 UTC	3806	IN	Data Raw: 31 32 31 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 1c 6b 93 db b6 f1 bb 7f 05 1a 4f c6 e7 cc 51 d6 f3 1e 6a 93 89 63 c7 ad 67 9a a6 33 f1 4c d3 49 fb 81 12 a9 13 6b 8a 54 49 9e cf 8e a7 fd ed dd 05 76 f1 20 00 89 3a 3b e9 2b b9 26 bd 03 81 c5 be 77 b1 5c 70 55 67 ef 46 6d 57 ef 93 76 dd d4 65 59 54 37 e2 fd 03 21 b6 79 71 b3 ed 96 62 32 1e 7f fa 6b f8 bb 7e 93 37 9b b2 be 5b 8a 6d 91 65 79 f5 6b f1 8f 07 0f 46 ed 5d 9e 77 09 3e 2b d3 77 72 dd 2a 5d bf be 69 ea db 2a 4b d6 75 59 37 4b b1 2a 61 08 41 3c f9 4c bc fc fa 4a 7c f6 04 7e 4f 76 6d b2 29 ca 2e 87 09 9f ec 9b fa a6 c8 96 cf bf 7f b9 4b 6f f2 57 4d 5a b5 9b ba d9 8d be 29 00 a5 b6 de 74 a3 a7 e5 7e 9b 9e 7d bb 4f d7 45 f7 ee f3 f9 f8 f1 27 7d 80 fe be cd cd 2a 3d 1b 9f 0b fa df 68 fe 18 d7 ec eb b6 Data Ascii: 121akOQjcg3LIkTIv :;+&w\pUgFmWveYT7!yqb2k~7[meykF]w>+wr]iKuY7KaA<LJ\|~Ovm).KoWMZ)t~}OE'}=h
2025-01-12 23:47:42 UTC	841	IN	Data Raw: f5 d5 1b 68 2e 81 5f e1 fd 26 40 79 b5 cd 05 36 4a b6 f2 71 05 0d a8 94 31 65 23 3d a3 68 61 5d 09 f3 60 12 7c 3f 05 df 90 c2 85 f7 f2 9d d8 e5 cd 4d 9e 81 d5 74 b5 50 df 02 92 1f 5d 19 ed 8a 6a f4 37 dc 15 be 04 74 b3 15 bf bd 2d f7 04 4c 26 19 72 43 1c 88 be 33 ce 31 1f 75 df 7f 73 fb 36 de 19 f4 f2 cd 33 f5 76 5d fc 45 5e e6 39 05 ae ac 39 48 95 08 03 a6 23 2b 43 06 8e 51 e9 ef 38 11 dc 95 f0 1e 34 c9 f5 89 12 7f 75 eb e5 18 c6 0c 04 5b 1a b8 17 80 5b 1b c2 18 0f 64 45 08 70 c9 e5 a4 30 64 8f 17 bf c2 77 e6 bf 07 b3 12 4f ef 72 a9 77 6f 20 e9 19 8d c5 d9 b6 eb f6 cb 27 4f 6e 8a 6e 7b bb 1a 65 a0 53 79 b9 4e 9b 0c be e7 34 02 9d 7d 82 b6 98 a4 6a d1 93 c7 08 e6 59 bd 7f a7 84 31 1d 4f 16 e2 b9 5c 22 9e a9 35 e2 37 5f aa 01 fa fb 0b b9 71 01 af fa 5b d0 Data Ascii: h._&@y6Jq1e#=ha]`\|?MtP]j7t-L&rC31us63v]E^99H#+CQ84u[[dEp0dwOrwo 'Onn{eSyN4}jY1O\"57_q[

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	577	OUT	GET /plus/plugin/css/font-awesome.min.css?ver=1606790105 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:42 UTC	290	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:42 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 01 Dec 2020 02:35:05 GMT ETag: W/"5fc5abd9-7187" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT
2025-01-12 23:47:42 UTC	3806	IN	Data Raw: 31 64 34 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5d 4d 8f dc 48 72 bd ef af 28 cf 60 2d 69 21 f6 14 d9 df 2d ac 3d 6b 1b 0b 0c 30 0b 1f 76 0f 3e f8 92 24 93 55 54 b3 48 8a 1f 5d 5d 12 f4 df fd 32 f9 82 45 4a 91 e5 31 30 07 2f 06 58 35 19 cc cf 97 11 91 11 2f b3 7e fa d3 3f fd 61 f3 a7 cd e6 af 4d 3d 6c fe 72 b4 7d 73 b0 9b 9b ab bb ab eb 4d 7a da fc 9c 9b 17 bb 33 75 7e da 44 9b fd 30 b4 4f 3f fd 54 40 d2 4c 82 57 65 83 e7 3f 2f 9e f8 b2 7e 2d 33 5b f7 36 f4 c9 4f 15 df bf 75 95 3e 6d fe fe cb af 9b ff fc eb af 9b f8 2a 7e bf f9 f7 bf ff fd 69 f3 b7 5f fe b1 61 21 ef 50 e2 4f be 86 a8 30 99 fd e2 ea c2 bf 0e 65 75 7a 7a e3 be 67 9b df 7c e8 bb ec 69 ec aa b7 6f ae ae 7c 1b fb 65 4b a3 a3 4d dd a7 57 b6 19 fe f5 e5 cf be 83 6f de fd 1f be f9 b1 b4 45 f9 Data Ascii: 1d46]MHr(`-i!-=k0v>$UTH]]2EJ10/X5/~?aM=lr}sMz3u~D0O?T@LWe?/~-3[6Ou>m*~i_a!PO0euzzg\|io\|eKMWoE
2025-01-12 23:47:42 UTC	3701	IN	Data Raw: b2 ed cb 3e 92 3d cb 0a 72 c2 6f 99 a5 b4 4c 14 ce 33 4d 1e 16 82 bc 61 df 2e 16 a6 cb 82 33 a8 75 51 58 2d 38 da 15 00 d1 8d 80 c8 91 4b 2f 55 48 28 4d 34 86 0b b1 fc 58 38 2d 95 c5 16 53 4f fb c4 37 e2 06 79 99 10 06 6e ce 90 01 f9 33 e8 c1 c6 37 d4 43 b0 cb 20 20 5d 12 24 66 b0 f6 ce 79 98 4b f2 c4 90 cf d4 5f 92 23 92 b0 a9 c5 ce 51 8b 56 c4 37 62 1e 9b 9d 8b ee 2c ba 3c 69 75 1f 7e 91 61 5d be 5e 41 48 d8 30 c3 54 ca bc d2 b4 32 e6 97 eb 12 a8 cb 58 c2 72 6d 6b 85 2c df af cb 21 4c ed 38 e7 1c fd f7 f8 5b 03 a2 b0 6a 76 a9 6a 13 85 4b 93 37 d8 98 4b 01 be bc b1 57 bd 0d 61 d5 74 30 3d b2 13 f3 f2 65 2d 9f af 9b 2b 9a b0 5e b9 03 dd 41 32 38 fe e3 d3 6c 52 fd 9f 1f e7 20 ee ba 2c aa c9 ce ed 94 d8 59 2f 8f 98 e5 b7 4f d4 0c 51 7c 4b f8 1f d7 41 d7 e7 Data Ascii: >=roL3Ma.3uQX-8K/UH(M4X8-SO7yn37C ]$fyK_#QV7b,<iu~a]^AH0T2Xrmk,!L8[jvjK7KWat0=e-+^A28lR ,Y/OQ\|KA

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	573	OUT	GET /plus/css/common/bet365_style.css?ver=1684314915 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:42 UTC	290	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:42 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Wed, 17 May 2023 09:15:15 GMT ETag: W/"64649b23-3e1e" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT
2025-01-12 23:47:42 UTC	3806	IN	Data Raw: 31 30 39 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 5b dd 6e 1b c7 15 be f7 53 6c 45 04 b6 03 2d 45 52 14 25 d1 80 d1 da b1 e2 00 76 5a d8 6e 83 02 05 84 25 b9 24 b7 5a ee b2 bb 4b cb b2 9a cb 5e f5 aa e8 65 df 21 7d 80 22 7d 9a 06 68 de a2 e7 cc f9 99 99 fd b1 e9 34 80 c2 04 11 67 67 67 ce cf 77 7e 67 f8 cb f9 3a 2a ca b8 0a 0e 76 d5 32 3c 3b 78 74 6f 96 2f 6e 6e ef 05 41 b0 cc b3 2a 2c 93 f7 f1 34 18 8e b6 ef 1e e1 58 b0 89 8a 55 92 4d 83 81 0c cc a2 f9 d5 aa c8 77 d9 62 1a f4 46 27 f8 e1 99 49 16 5e 27 8b 6a 0d af 0f 07 3a df ac ba 8c 36 49 7a 33 0d 0e 7e f8 f7 77 ff fd fe 9f 3f fe e3 2f 3f fe eb 6f 07 87 c1 c1 cb 64 5e e4 65 be ac 82 df 47 cf e3 04 87 7e f8 ee af ff f9 fe ef 40 d8 b7 f7 76 e9 61 9a 18 da 82 6d b4 58 24 d9 ca 21 a4 41 59 9a 94 40 7f 75 Data Ascii: 1097[nSlE-ER%vZn%$ZK^e!}"}h4gggw~g:v2<;xto/nnA,4XUMwbF'I^'j:6Iz3~w?/?od^eG~@vamX$!AY@u
2025-01-12 23:47:42 UTC	454	IN	Data Raw: f0 10 27 7f 0a ad 3c f7 f6 ae 84 49 cc 0d d1 63 20 eb 35 ce fb e0 94 2e 4c 4c c7 eb 01 25 51 e6 be 17 d0 89 b8 83 50 58 08 45 fd b1 a5 02 f8 51 93 bf 9c db 05 69 be 4d 54 20 0b da e2 f1 e8 b0 fe 5d 86 c5 a4 87 7c e4 58 67 cd 5b f1 31 30 7a d8 e0 de 9f 82 dd 09 22 b9 4d e6 28 82 6b a8 8b cd e5 19 73 95 4e fb c6 aa b8 47 46 b3 e2 a8 d0 bb d1 88 67 0d 76 58 ac a1 91 ad 08 52 fa 4b a3 1b d8 12 5b 88 44 db cf 05 53 e4 47 28 ed 90 a0 82 e3 85 73 34 c8 e2 87 73 17 b0 ea 8f 20 81 de f3 3a 99 41 4f b8 45 02 44 97 84 0d 2c ae 82 0f 21 8b d7 9b d2 7d 5a 92 07 e0 16 21 03 d7 69 ff 7c 40 d2 96 45 8d c7 dc 7b cd 34 82 df 4f 9a 93 b3 f6 d5 61 f1 26 6a 55 42 af f3 79 12 d5 8f d8 6c 96 a7 08 71 0c 9b 1d c0 e8 5c bd a3 10 4e c5 5c 87 c5 a2 fe df e0 6d 59 e9 a4 a9 d7 6f 36 Data Ascii: '<Ic 5.LL%QPXEQiMT ]\|Xg[10z"M(ksNGFgvXRK[DSG(s4s :AOED,!}Z!i\|@E{4Oa&jUBylq\N\mYo6

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	574	OUT	GET /plus/plugin/css/jquery-ui.min.css?ver=1606790105 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:42 UTC	290	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:42 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 01 Dec 2020 02:35:05 GMT ETag: W/"5fc5abd9-7d4c" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT
2025-01-12 23:47:42 UTC	3806	IN	Data Raw: 32 33 39 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 3d 69 73 ea 48 92 df e7 57 b0 dd d1 1d dd e3 27 1b c4 61 63 c7 db 0d b0 cd e1 0b 1b db 5c 5f 26 04 92 40 46 48 42 12 97 1d f3 df 37 eb 92 4a 52 95 f0 9b 5d 1c fd 1a 95 2a b3 f2 ae ac 93 b3 7f fe 57 e1 e3 65 63 f8 87 c2 7b b7 a0 14 b6 a5 d3 92 7a 5a 82 6f 6a b1 54 53 8a 75 a5 54 f9 c7 3f 0b 8b 30 f4 2e cf ce 3e d6 a8 e6 c6 3a 9d b9 2b 28 ed 3a 33 7b a3 1b c1 65 61 e6 fa c6 e9 2c 08 7e 14 b4 19 7c d7 2d d7 a1 8f 9b d0 85 ca 9e 6d 84 b4 c2 ca 70 36 e4 dd 74 13 86 ac de cc 75 42 df b5 e7 be bb f1 c8 db d9 c2 98 2d a7 ee de d7 00 1b 29 d2 b5 d0 f0 ac d9 d2 f0 e9 b3 a5 d9 ee 9c 7e f7 b5 f9 5c 9b da b4 15 df 08 ac cf f8 d1 f3 dd 39 14 05 53 8d 82 06 86 6d cc c2 b8 02 79 8e 69 0b 6c 4b 67 cd 04 ae cf d7 f4 2c c7 Data Ascii: 239c=isHW'ac\_&@FHB7JR]*Wec{zZojTSuT?0.>:+(:3{ea,~\|-mp6tuB-)~\9SmyilKg,
2025-01-12 23:47:42 UTC	4096	IN	Data Raw: 17 ab ad 41 eb e9 e6 65 d0 6c 3d 5a 95 5d 63 87 37 44 2c 4e 5e 5e ee f0 86 89 eb 1d ae 8e 61 1b 8d eb e5 78 f7 b4 1e f9 fa 75 55 bd 79 2d d6 b4 f3 c7 d6 a4 7b 52 69 75 9a d7 f7 ee 8d 31 bc 1f ad 0f ab e7 75 7b bd df de f9 a3 c9 f4 71 7f fe 16 ce 4e 76 f5 d1 fc 5d 6d 35 cb 76 ef f0 d2 1f de be a9 dd 56 db 7a af af 4a a6 7f 33 f0 f6 93 c9 ac 36 35 3b bb 6d 65 56 1a 8f 9e 6b cb d2 40 3f a8 75 b5 35 ad bd 2f 37 db 56 38 f2 b6 c3 d7 cf c6 49 e7 30 1b dd 75 de 47 56 7b dc b5 1e e7 6a bf 36 ac 54 eb 73 67 d8 36 3b 4f fa 47 77 7d 33 1c ac 8d 55 47 35 96 5e 6f 0a ff d9 9e 37 7c 5f 4f ac b5 5f 33 f4 f5 7a f8 d2 68 74 cd e5 ed f5 0b f0 f9 d2 08 30 73 d7 f3 06 f0 d7 68 78 af 8f f3 89 d3 36 b5 f5 6c 5e ba 55 37 9b cf 9b d5 aa f3 de ec 5f bc 58 76 bd ba b0 9e ef d7 43 Data Ascii: Ael=Z]c7D,N^^axuUy-{Riu1u{qNv]m5vVzJ365;meVk@?u5/7V8I0uGV{j6Tsg6;OGw}3UG5^o7\|_O_3zht0shx6l^U7_XvC
2025-01-12 23:47:42 UTC	1227	IN	Data Raw: 80 98 68 12 c0 31 76 3b d8 05 25 1c a4 10 a3 4c d6 f7 0d 2c 34 31 00 62 37 cd 47 b0 d8 98 26 ba 49 3a 5a cb 89 77 ad 61 96 d3 00 21 6c 28 0a 4c 74 b3 b0 c4 c5 15 62 81 49 ba 18 14 89 0e 52 50 6a 83 49 58 13 ee 71 81 f6 60 26 1f 5f d9 0c 17 b7 08 68 05 05 a1 76 63 05 51 28 bc 25 53 04 40 f5 93 04 d2 e1 aa 54 d8 a9 0a 57 ae 09 9a c0 29 4d ba 19 06 a1 4c c5 30 44 49 c9 56 d0 5d 91 e2 da 44 43 c9 da 2b cd b2 c9 99 6f 31 e7 54 4b 02 20 39 ef a8 72 9a 93 60 63 85 33 b8 2a 57 4c 19 d5 4c b2 15 f8 45 1f b9 b4 68 50 48 42 c0 5e e5 00 2e a0 16 8a 97 86 82 14 80 0f f7 58 4b ea 13 ff 4f d6 07 43 0b 16 92 fa c4 e9 93 f5 d1 d5 d7 70 8f b6 98 20 92 39 27 01 36 4e 1e 08 ed 97 93 20 53 d7 5d c2 74 ba c4 ed 69 6f 9c 04 09 65 51 85 76 bf c9 da 0b 77 25 56 1b 78 05 56 1c e7 Data Ascii: h1v;%L,41b7G&I:Zwa!l(LtbIRPjIXq`&_hvcQ(%S@TW)ML0DIV]DC+o1TK 9r`c3*WLLEhPHB^.XKOCp 9'6N S]tioeQvw%VxV

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	571	OUT	GET /plus/plugin/css/swiper.min.css?ver=1606790105 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:42 UTC	290	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:42 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 01 Dec 2020 02:35:05 GMT ETag: W/"5fc5abd9-4bef" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT
2025-01-12 23:47:42 UTC	3643	IN	Data Raw: 65 32 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 1c 6b 6f e3 b8 f1 fb fd 0a e1 8a 60 e3 3b d3 91 65 27 9b 95 d1 c3 5d ef ba 40 db bd 2f 6d 51 b4 1f 69 8b b6 79 91 25 43 92 e3 24 c6 fe f7 ce f0 25 4a 22 6d 39 8f 62 8b db 7b c4 32 39 9c 19 0e 87 c3 99 e1 c8 57 df 7d f7 4d f0 5d f0 8f 3d df b2 22 98 8e c6 a3 10 bf ff 9a 97 55 b0 c9 13 56 64 f0 31 e7 29 0b aa 7c b7 58 07 65 ca a1 31 a0 59 12 2c 0b ba 61 fb bc b8 0b f6 bc 5a 07 6b 5a 24 7b 5a b0 80 2e 16 2c 65 05 ad 58 12 54 05 cd 4a 5e f1 3c 2b 11 ed ba aa b6 f1 d5 d5 7e bf 1f f1 84 66 2b 56 e4 a3 5d 79 55 0a ea 57 00 81 40 3f e7 db c7 82 af d6 55 10 85 e3 29 81 3f b7 c1 bf 52 9a f0 0d 2f 82 bf 01 99 94 6e b6 3c e1 0a fc ef 40 8c 96 40 6b 97 21 67 d5 9a 05 bf fe e5 9f c1 27 be 60 59 c9 da 40 79 16 07 7f a5 d9 Data Ascii: e2fko`;e']@/mQiy%C$%J"m9b{29W}M]="UVd1)\|Xe1Y,aZkZ${Z.,eXTJ^<+~f+V]yUW@?U)?R/n<@@k!g'`Y@y

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:41 UTC	566	OUT	GET /plus/css/common/index.css?ver=1700473959 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:42 UTC	326	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:42 GMT Content-Type: text/css Content-Length: 2034 Connection: close Cteonnt-Length: 6749 Last-Modified: Mon, 20 Nov 2023 09:52:39 GMT ETag: "655b2c67-1a5d" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-12 23:47:42 UTC	2034	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 58 ef 6e db 36 10 ff 9e a7 e0 6a 14 48 0a cb 91 64 c9 76 5c 60 58 d3 b5 e8 87 02 1b b6 07 08 68 89 b6 b9 c8 a2 20 d1 49 da a2 1f f7 65 df f6 1e 7b ad be c7 8e 3c 92 12 25 d9 4b b1 14 2d 9a 23 ef ff dd ef 8e ba 7e c5 cb 9c 3d bd ba be f8 29 db d3 ba 61 92 bc 38 ca 6d b0 7a f1 fa 62 23 f2 4f 5f 2e 08 fc 5c bf 22 1b 9a dd ef 6a 71 2c f3 35 99 84 e1 f2 36 bd 25 c7 ba b8 bc e6 07 ba 63 cd 5d 55 1c 9b 6b 2d eb 5a f1 05 9b dd 6c c7 b7 57 a4 66 15 a3 32 78 7a 4d 40 87 92 e5 09 8a 92 55 98 be 7b ad 0f b6 a2 94 41 c3 3f b3 35 89 e2 ea e9 f5 c5 d7 8b 99 16 f8 81 d1 9c a0 21 7b c6 77 7b b9 26 cb 48 5d d0 e2 44 9d b3 3a 28 d8 16 c8 40 25 8d 28 78 4e 26 49 4a d3 d5 8d 77 a7 46 de f3 97 36 42 4a 71 38 7d ab 63 7d bd db 5c 2e a7 51 1c 4f Data Ascii: Xn6jHdv\`Xh Ie{<%K-#~=)a8mzb#O_.\"jq,56%c]Uk-ZlWf2xzM@U{A?5!{w{&H]D:(@%(xN&IJwF6BJq8}c}\.QO

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:43 UTC	579	OUT	GET /plus/css/unite/prizedraw_pop_unite.css?ver=1733883988 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:43 UTC	326	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:43 GMT Content-Type: text/css Content-Length: 1703 Connection: close Cteonnt-Length: 6938 Last-Modified: Wed, 11 Dec 2024 02:26:28 GMT ETag: "6758f854-1b1a" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-12 23:47:43 UTC	1703	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 58 6f 6f db 44 18 7f df 4f 71 5a 35 25 1d 71 ea b8 e9 da 3a 42 30 a4 a1 22 21 98 40 8c 97 d5 25 be 24 a7 3a 76 70 ae 49 69 84 04 9a 36 36 75 30 de b4 68 1a 1a 08 98 18 93 26 31 40 63 52 91 f6 5d 50 93 6e af f8 0a bb ff 76 6c c7 75 b2 ae 2f d6 3b 3f f7 3c bf fb 3d 7f af 6f 37 da 30 e8 21 02 ce ed 90 a6 b1 7e ae b6 50 0e 70 ab 4d b6 de c7 de f6 3b fe 2e 18 76 fd 1e 26 d8 f7 6c d0 c4 bb c8 a9 11 bf 6b 9b 35 2e 44 ff df 33 b0 e7 a0 5d 1b 6c d0 7f b5 2f e2 a7 cb 75 e2 19 0d d7 ef a1 a1 83 7b 5d 17 7e 6e 83 ba eb 37 b6 6b 03 ec 90 b6 0d 2a 6b dd dd 5a 1b 71 6d 62 11 da 83 f5 9e ef ee 10 24 8d 59 f4 a3 30 3e 69 b4 0e 1b db ad c0 df f1 1c 7b d1 34 cd 1a a8 fb 81 83 02 23 80 0e de e9 d9 60 d5 3c cf f6 76 8d 1e de c3 5e 8b 02 10 df Data Ascii: XooDOqZ5%q:B0"!@%$:vpIi66u0h&1@cR]Pnvlu/;?<=o70!~PpM;.v&lk5.D3]l/u{]~n7k*kZqmb$Y0>i{4#`<v^

Timestamp	Bytes transferred	Direction	Data
2025-01-12 23:47:43 UTC	581	OUT	GET /plus/css/custom/prizedraw_pop_custom.css?ver=1663905027 HTTP/1.1 Host: 5getfab.segrft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://b45032.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 23:47:43 UTC	320	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 23:47:43 GMT Content-Type: text/css Content-Length: 38 Connection: close Cteonnt-Length: 18 Last-Modified: Fri, 23 Sep 2022 03:50:27 GMT ETag: "632d2d03-12" Access-Control-Allow-Origin: * Content-Encoding: gzip Server: CDNoh X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-12 23:47:43 UTC	38	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 73 48 ce 48 2c 2a 4e 2d 51 50 2a 2d 49 d3 b5 50 b2 e6 02 00 82 e3 4b 94 12 00 00 00 Data Ascii: sHH,N-QP-IPK