Edit tour

Windows Analysis Report
http://www.bet3656001.com/

Overview

General Information

Sample URL:	http://www.bet3656001.com/
Analysis ID:	1501490
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

HTML body contains password input but no form action

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3180 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2224,i,1193979751757000105,8827828435452596855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.bet3656001.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /visitor.ashx?siteId=60003589 HTTP/1.1Host: 09i32g.uuie34661.comConnection: keep-aliveContent-Length: 69sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://www.bet3656001.com:8989Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.bet3656001.com:8989/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: http://www.bet3656001.com/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://www.bet3656001.com/	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.bet3656001.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: _8989._https.www.bet3656001.com
Source: global traffic	DNS traffic detected: DNS query: o1tyg6.innittapp.com
Source: global traffic	DNS traffic detected: DNS query: psowoexvd.n2vu8zpu2f6.com
Source: global traffic	DNS traffic detected: DNS query: 09i32g.uuie34661.com
Source: global traffic	DNS traffic detected: DNS query: vue.livehelp100servicestandby.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: kngx/1.10.2Date: Thu, 29 Aug 2024 22:39:44 GMTContent-Type: text/htmlContent-Length: 570Connection: closeKs-Deny-Reason: secure-time-arg-time-not-foundX-Cdn-Request-ID: cd45cddd33bf9d32c0317864cfa7e96fx-link-via: xjp21:443;
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Thu, 29 Aug 2024 22:40:05 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Thu, 29 Aug 2024 22:40:06 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found, conatact supportServer: CloudFrontDate: Thu, 29 Aug 2024 22:40:08 GMTContent-Length: 0Connection: closeX-Cache: FunctionGeneratedResponse from cloudfrontVia: 1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P6X-Amz-Cf-Id: FUZtW48uhEN0XdiJPaLy8VTNw09n_ESMjB4BE-Kp8eg8yvA8TPDNdA==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8Content-Length: 552Connection: closeServer: Default-server-KS-CLOUD-XJP-FOREIGN-12-01Date: Thu, 29 Aug 2024 22:40:43 GMTAccess-Control-Allow-Origin: *X-Frame-Options: SAMEORIGINx-link-via: xjp21:443;xjp12:80;x-b2f-cs-cache: no-cacheX-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-01X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-21-02X-Cdn-Request-ID: 754914cd0391a81c6c88d01a4dd8b55d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Thu, 29 Aug 2024 22:40:55 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found, conatact supportServer: CloudFrontDate: Thu, 29 Aug 2024 22:41:01 GMTContent-Length: 0Connection: closeX-Cache: FunctionGeneratedResponse from cloudfrontVia: 1.1 dc85053069397a282d87170bb1bcab4a.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P6X-Amz-Cf-Id: LEtVeWaDhrrvHYc388-s_SNl4eSSPRDPJ3XeMFCUZ6vtkHhqK9tVlg==
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Thu, 29 Aug 2024 22:41:01 GMTContent-Type: text/htmlContent-Length: 520Connection: close

Source: chromecache_490.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_323.2.dr, chromecache_526.2.dr	String found in binary or memory: http://nicescroll.areaaperta.com
Source: chromecache_544.2.dr, chromecache_546.2.dr	String found in binary or memory: http://www.idangero.us/
Source: chromecache_544.2.dr, chromecache_546.2.dr	String found in binary or memory: http://www.idangero.us/sliders/swiper/
Source: chromecache_476.2.dr, chromecache_493.2.dr, chromecache_567.2.dr	String found in binary or memory: http://www.idangero.us/swiper/
Source: chromecache_390.2.dr	String found in binary or memory: http://www.imagehover.io
Source: chromecache_390.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_394.2.dr	String found in binary or memory: https://09i32g.uuie34661.com
Source: chromecache_557.2.dr, chromecache_318.2.dr	String found in binary or memory: https://365kkf.cc/
Source: chromecache_557.2.dr, chromecache_318.2.dr	String found in binary or memory: https://365pina.cc:8989/
Source: chromecache_257.2.dr, chromecache_394.2.dr	String found in binary or memory: https://9j91gbh.uuie34661.com/fileservice/v1
Source: chromecache_557.2.dr, chromecache_318.2.dr	String found in binary or memory: https://b.3656azjul11.cc:8989/verify-page/index.html
Source: chromecache_557.2.dr, chromecache_318.2.dr	String found in binary or memory: https://b.365jul10.com:8989/
Source: chromecache_557.2.dr, chromecache_318.2.dr	String found in binary or memory: https://get365kapp.xyz/android_down.html
Source: chromecache_557.2.dr, chromecache_318.2.dr	String found in binary or memory: https://get365kapp.xyz/ios_down.html
Source: chromecache_257.2.dr, chromecache_394.2.dr	String found in binary or memory: https://n3igha.uuie34661.com
Source: chromecache_257.2.dr, chromecache_394.2.dr	String found in binary or memory: https://psowoexvd.n2vu8zpu2f6.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2224,i,1193979751757000105,8827828435452596855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.bet3656001.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2224,i,1193979751757000105,8827828435452596855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/images/api-tabs-sprite-black.png	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_bb.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-02.jpg.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-silver.png.base64	0%	Avira URL Cloud	safe
http://www.idangero.us/swiper/	0%	URL Reputation	safe
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_hb.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/en04.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-gray01.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/381250/1700806657810.jpg.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/es20.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_jk.png.base64	0%	Avira URL Cloud	safe
https://b.365jul10.com:8989/	0%	Avira URL Cloud	safe
https://9j91gbh.uuie34661.com/fileservice/v1	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/bet365-627/images/index-chess.jpg.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/icon-sprite-desktop.svg?v=2.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/themes/gui-skin-default.css	0%	Avira URL Cloud	safe
https://psowoexvd.n2vu8zpu2f6.com/livechat.ashx?siteId=60003589	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/js/theme/default/layer.css?v=3.1.0	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/900301/1652422420039.jpg.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery-1.11.3.min.js	0%	Avira URL Cloud	safe
https://psowoexvd.n2vu8zpu2f6.com/visitorside/js/bundle.f68cefcd.js	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/betNow.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-white.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/js/gui-base.js	0%	Avira URL Cloud	safe
https://09i32g.uuie34661.com	0%	Avira URL Cloud	safe
https://365pina.cc:8989/	100%	Avira URL Cloud	malware
https://n3igha.uuie34661.com	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/js/layer.js	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/inco2.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/js/float.js	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-03.png.base64	0%	Avira URL Cloud	safe
https://09i32g.uuie34661.com/campaign.ashx?siteId=60003589&campaignId=847d9721-1d78-4b66-ad51-16bcd1ada948&lastUpdateTime=0000000014B30040	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/es06.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery.nicescroll.min.js	0%	Avira URL Cloud	safe
https://get365kapp.xyz/ios_down.html	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/jquery.raty.css	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10248/1705841616831.png.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-title-03.gif.base64	0%	Avira URL Cloud	safe
https://o1tyg6.innittapp.com/fserver/files/gb/627/floatImage/230/1724015131450.gif.base64	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
d2fbug8oy6zx3g.cloudfront.net	13.225.78.58	true	false	unknown
l5-global.gslb.ksyuncdn.com	103.155.16.134	true	false	unknown
cluster91f2e088.hysjs168.com	20.239.97.157	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
a48d7a3baeaba2a67.awsglobalaccelerator.com	75.2.42.240	true	false	unknown
d30ye5lgbv8wkd.cloudfront.net	108.138.7.4	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
o1tyg6.innittapp.com	unknown	unknown	false	unknown
_8989._https.www.bet3656001.com	unknown	unknown	false	unknown
vue.livehelp100servicestandby.com	unknown	unknown	false	unknown
www.bet3656001.com	unknown	unknown	false	unknown
09i32g.uuie34661.com	unknown	unknown	false	unknown
psowoexvd.n2vu8zpu2f6.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/images/api-tabs-sprite-black.png	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/es20.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-02.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_bb.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-silver.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/381250/1700806657810.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-gray01.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_hb.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_jk.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/en04.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/index-chess.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/icon-sprite-desktop.svg?v=2.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/theme/default/layer.css?v=3.1.0	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/900301/1652422420039.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/gui-skin-default.css	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery-1.11.3.min.js	false	Avira URL Cloud: safe	unknown
https://psowoexvd.n2vu8zpu2f6.com/livechat.ashx?siteId=60003589	false	Avira URL Cloud: safe	unknown
https://psowoexvd.n2vu8zpu2f6.com/visitorside/js/bundle.f68cefcd.js	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-white.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/betNow.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/gui-base.js	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/layer.js	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/inco2.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/float.js	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-03.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery.nicescroll.min.js	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/es06.png.base64	false	Avira URL Cloud: safe	unknown
https://09i32g.uuie34661.com/campaign.ashx?siteId=60003589&campaignId=847d9721-1d78-4b66-ad51-16bcd1ada948&lastUpdateTime=0000000014B30040	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/jquery.raty.css	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10248/1705841616831.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/floatImage/230/1724015131450.gif.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-title-03.gif.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl//commonPage/themes/images/hongbao/icon-close-1.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_jdb.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/EVOPLAY/1/5491_zh_CN.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/380486/1621613384540.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/images/icon-arrow-down.png	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery.super-marquee.js	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/100587/1599462927104.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/body-bg.gif.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-brown01.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/bg-products.gif.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-04.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/play.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-title-02.gif.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/style/common.css	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/images/arrows-double.png	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_sg.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/hb/css/pc.css	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10369/1718644154338.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/favicon/favicon_627.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/fish_btn.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/Casino-banner-img1.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/icon_match_prev.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_mg.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10383/1695644169263.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-01.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/380519/1624595396453.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/en13.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/logo-foot.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/061410/rcenter/common/static/js/gb.validation.min.js?v=1724659635643	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/idangerous.swiper.css	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/game-casino.css	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/index-game.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/31979/1677753036394.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_mw.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-title-01.gif.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/100623/1605258801510.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/api_logo/logo_2x/logo_evoplay.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/90209/1554724775565.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/Casino-banner-img2.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-06.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-04.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10182/1694949241591.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/fr01.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/31946/8629_zh_CN.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/31975/1675680008313.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-gold.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/31973/1675673289569.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/floatImage/225/1704100920201.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/en01.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/Casino-banner-img1.gif.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/sports-infos-bg.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/90902/1599114871838.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-07.png.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/moment.js	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/casino-banner-03.jpg.base64	false	Avira URL Cloud: safe	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/0/game/EVOPLAY/1/296_zh_CN.jpg.base64	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://9j91gbh.uuie34661.com/fileservice/v1	chromecache_257.2.dr, chromecache_394.2.dr	false	Avira URL Cloud: safe	unknown
https://b.365jul10.com:8989/	chromecache_557.2.dr, chromecache_318.2.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_390.2.dr	false	URL Reputation: safe	unknown
https://09i32g.uuie34661.com	chromecache_394.2.dr	false	Avira URL Cloud: safe	unknown
https://365pina.cc:8989/	chromecache_557.2.dr, chromecache_318.2.dr	false	Avira URL Cloud: malware	unknown
https://n3igha.uuie34661.com	chromecache_257.2.dr, chromecache_394.2.dr	false	Avira URL Cloud: safe	unknown
https://get365kapp.xyz/ios_down.html	chromecache_557.2.dr, chromecache_318.2.dr	false	Avira URL Cloud: safe	unknown
https://b.3656azjul11.cc:8989/verify-page/index.html	chromecache_557.2.dr, chromecache_318.2.dr	false	Avira URL Cloud: safe	unknown
http://www.idangero.us/sliders/swiper/	chromecache_544.2.dr, chromecache_546.2.dr	false	Avira URL Cloud: safe	unknown
http://www.idangero.us/swiper/	chromecache_476.2.dr, chromecache_493.2.dr, chromecache_567.2.dr	false	URL Reputation: safe	unknown
http://www.imagehover.io	chromecache_390.2.dr	false	Avira URL Cloud: safe	unknown
http://nicescroll.areaaperta.com	chromecache_323.2.dr, chromecache_526.2.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501490
Start date and time:	2024-08-30 00:38:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.bet3656001.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@19/542@26/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.bet3656001.com:8989/chess.html?apiType=5&apiId=111 Browse: https://www.bet3656001.com:8989/casino.html?apiType=2&apiId=-1&gameTag=RecommendGame

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 21:39:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9796890837209427
Encrypted:	false
SSDEEP:	48:8WdQTU7wzHRidAKZdA19ehwiZUklqeh9y+3:8hvHey
MD5:	D431CA240ADFA160651041EC1EFDFEC5
SHA1:	D6B37104764FB67EE2627A2BE5749B19A38F522E
SHA-256:	83C50F75E0F1A68D06D55354C0AAA0F3E9A034EE1DA8844DAB186D20395921A0
SHA-512:	AC735011828ED8E007167A3B6BE70BD8E037CE550B4F83D5F3E4DF5BBF8A6F4D353D179D989B9245DBFF9901948F9C38D52B7F95A7C5A14ACA607FD798A3155D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....dAKd...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=.E......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 30, 2024 00:39:22.713751078 CEST	192.168.2.5	1.1.1.1	0x2abd	Standard query (0)	www.bet3656001.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:22.713892937 CEST	192.168.2.5	1.1.1.1	0x5fbf	Standard query (0)	www.bet3656001.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:23.627433062 CEST	192.168.2.5	1.1.1.1	0xb013	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:23.627665043 CEST	192.168.2.5	1.1.1.1	0x263f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:24.008560896 CEST	192.168.2.5	1.1.1.1	0x854b	Standard query (0)	www.bet3656001.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:24.008704901 CEST	192.168.2.5	1.1.1.1	0xb5e2	Standard query (0)	_8989._https.www.bet3656001.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:26.288712025 CEST	192.168.2.5	1.1.1.1	0x5c91	Standard query (0)	o1tyg6.innittapp.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:26.288913012 CEST	192.168.2.5	1.1.1.1	0x2a7c	Standard query (0)	o1tyg6.innittapp.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:27.333847046 CEST	192.168.2.5	1.1.1.1	0x78bb	Standard query (0)	www.bet3656001.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:27.334623098 CEST	192.168.2.5	1.1.1.1	0x85e4	Standard query (0)	_8989._https.www.bet3656001.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:29.242489100 CEST	192.168.2.5	1.1.1.1	0x614c	Standard query (0)	o1tyg6.innittapp.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:29.242835999 CEST	192.168.2.5	1.1.1.1	0xa058	Standard query (0)	o1tyg6.innittapp.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:48.161683083 CEST	192.168.2.5	1.1.1.1	0xecaf	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:48.161875010 CEST	192.168.2.5	1.1.1.1	0x8578	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:50.063496113 CEST	192.168.2.5	1.1.1.1	0xec5c	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:50.064584970 CEST	192.168.2.5	1.1.1.1	0xd3c4	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	65	IN (0x0001)	false
Aug 30, 2024 00:39:56.324273109 CEST	192.168.2.5	1.1.1.1	0x6787	Standard query (0)	09i32g.uuie34661.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:56.328366041 CEST	192.168.2.5	1.1.1.1	0xf300	Standard query (0)	09i32g.uuie34661.com	65	IN (0x0001)	false
Aug 30, 2024 00:40:03.242706060 CEST	192.168.2.5	1.1.1.1	0x4250	Standard query (0)	09i32g.uuie34661.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:03.242921114 CEST	192.168.2.5	1.1.1.1	0xb4d1	Standard query (0)	09i32g.uuie34661.com	65	IN (0x0001)	false
Aug 30, 2024 00:40:07.925208092 CEST	192.168.2.5	1.1.1.1	0x1682	Standard query (0)	vue.livehelp100servicestandby.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:07.925648928 CEST	192.168.2.5	1.1.1.1	0x318e	Standard query (0)	vue.livehelp100servicestandby.com	65	IN (0x0001)	false
Aug 30, 2024 00:40:55.485569954 CEST	192.168.2.5	1.1.1.1	0x83a2	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:55.486013889 CEST	192.168.2.5	1.1.1.1	0xf17c	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	65	IN (0x0001)	false
Aug 30, 2024 00:41:00.609555960 CEST	192.168.2.5	1.1.1.1	0x6540	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:41:00.609813929 CEST	192.168.2.5	1.1.1.1	0x8198	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 30, 2024 00:39:23.074318886 CEST	1.1.1.1	192.168.2.5	0x2abd	No error (0)	www.bet3656001.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:23.074318886 CEST	1.1.1.1	192.168.2.5	0x2abd	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:23.074318886 CEST	1.1.1.1	192.168.2.5	0x2abd	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:23.074318886 CEST	1.1.1.1	192.168.2.5	0x2abd	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:23.094089031 CEST	1.1.1.1	192.168.2.5	0x5fbf	No error (0)	www.bet3656001.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:23.094089031 CEST	1.1.1.1	192.168.2.5	0x5fbf	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:23.659246922 CEST	1.1.1.1	192.168.2.5	0xb013	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:23.659404993 CEST	1.1.1.1	192.168.2.5	0x263f	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 30, 2024 00:39:24.264710903 CEST	1.1.1.1	192.168.2.5	0x854b	No error (0)	www.bet3656001.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:24.264710903 CEST	1.1.1.1	192.168.2.5	0x854b	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:24.264710903 CEST	1.1.1.1	192.168.2.5	0x854b	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:24.264710903 CEST	1.1.1.1	192.168.2.5	0x854b	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:24.574105978 CEST	1.1.1.1	192.168.2.5	0xb5e2	Name error (3)	_8989._https.www.bet3656001.com	none	none	65	IN (0x0001)	false
Aug 30, 2024 00:39:26.975344896 CEST	1.1.1.1	192.168.2.5	0x2a7c	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:26.975344896 CEST	1.1.1.1	192.168.2.5	0x2a7c	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:27.143086910 CEST	1.1.1.1	192.168.2.5	0x5c91	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:27.143086910 CEST	1.1.1.1	192.168.2.5	0x5c91	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:27.143086910 CEST	1.1.1.1	192.168.2.5	0x5c91	No error (0)	l5-global.gslb.ksyuncdn.com		103.155.16.134	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:27.342118979 CEST	1.1.1.1	192.168.2.5	0x78bb	No error (0)	www.bet3656001.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:27.342118979 CEST	1.1.1.1	192.168.2.5	0x78bb	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:27.342118979 CEST	1.1.1.1	192.168.2.5	0x78bb	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:27.342118979 CEST	1.1.1.1	192.168.2.5	0x78bb	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:27.835103989 CEST	1.1.1.1	192.168.2.5	0x85e4	Name error (3)	_8989._https.www.bet3656001.com	none	none	65	IN (0x0001)	false
Aug 30, 2024 00:39:29.690782070 CEST	1.1.1.1	192.168.2.5	0xa058	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:29.690782070 CEST	1.1.1.1	192.168.2.5	0xa058	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:29.717294931 CEST	1.1.1.1	192.168.2.5	0x614c	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:29.717294931 CEST	1.1.1.1	192.168.2.5	0x614c	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:29.717294931 CEST	1.1.1.1	192.168.2.5	0x614c	No error (0)	l5-global.gslb.ksyuncdn.com		103.155.16.134	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:33.763103008 CEST	1.1.1.1	192.168.2.5	0x4c08	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:33.763103008 CEST	1.1.1.1	192.168.2.5	0x4c08	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:47.711483955 CEST	1.1.1.1	192.168.2.5	0x8910	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:47.711483955 CEST	1.1.1.1	192.168.2.5	0x8910	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:48.206089973 CEST	1.1.1.1	192.168.2.5	0x8578	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:48.206089973 CEST	1.1.1.1	192.168.2.5	0x8578	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:48.230792046 CEST	1.1.1.1	192.168.2.5	0xecaf	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:48.230792046 CEST	1.1.1.1	192.168.2.5	0xecaf	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:48.230792046 CEST	1.1.1.1	192.168.2.5	0xecaf	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.58	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:48.230792046 CEST	1.1.1.1	192.168.2.5	0xecaf	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.62	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:48.230792046 CEST	1.1.1.1	192.168.2.5	0xecaf	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.122	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:48.230792046 CEST	1.1.1.1	192.168.2.5	0xecaf	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.104	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:50.098527908 CEST	1.1.1.1	192.168.2.5	0xd3c4	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:50.098527908 CEST	1.1.1.1	192.168.2.5	0xd3c4	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:50.108022928 CEST	1.1.1.1	192.168.2.5	0xec5c	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:50.108022928 CEST	1.1.1.1	192.168.2.5	0xec5c	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:50.108022928 CEST	1.1.1.1	192.168.2.5	0xec5c	No error (0)	d2fbug8oy6zx3g.cloudfront.net		18.245.175.17	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:50.108022928 CEST	1.1.1.1	192.168.2.5	0xec5c	No error (0)	d2fbug8oy6zx3g.cloudfront.net		18.245.175.81	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:50.108022928 CEST	1.1.1.1	192.168.2.5	0xec5c	No error (0)	d2fbug8oy6zx3g.cloudfront.net		18.245.175.89	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:50.108022928 CEST	1.1.1.1	192.168.2.5	0xec5c	No error (0)	d2fbug8oy6zx3g.cloudfront.net		18.245.175.97	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:56.537698030 CEST	1.1.1.1	192.168.2.5	0x6787	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:39:56.537698030 CEST	1.1.1.1	192.168.2.5	0x6787	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		75.2.42.240	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:56.537698030 CEST	1.1.1.1	192.168.2.5	0x6787	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		99.83.207.187	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:39:56.538223028 CEST	1.1.1.1	192.168.2.5	0xf300	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:03.785475016 CEST	1.1.1.1	192.168.2.5	0x4250	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:03.785475016 CEST	1.1.1.1	192.168.2.5	0x4250	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		75.2.42.240	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:03.785475016 CEST	1.1.1.1	192.168.2.5	0x4250	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		99.83.207.187	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:03.785702944 CEST	1.1.1.1	192.168.2.5	0xb4d1	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:07.958892107 CEST	1.1.1.1	192.168.2.5	0x318e	No error (0)	vue.livehelp100servicestandby.com	d30ye5lgbv8wkd.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:07.961690903 CEST	1.1.1.1	192.168.2.5	0x1682	No error (0)	vue.livehelp100servicestandby.com	d30ye5lgbv8wkd.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:07.961690903 CEST	1.1.1.1	192.168.2.5	0x1682	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.4	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:07.961690903 CEST	1.1.1.1	192.168.2.5	0x1682	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.54	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:07.961690903 CEST	1.1.1.1	192.168.2.5	0x1682	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.65	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:07.961690903 CEST	1.1.1.1	192.168.2.5	0x1682	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.52	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:13.992155075 CEST	1.1.1.1	192.168.2.5	0x9f0f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:13.992155075 CEST	1.1.1.1	192.168.2.5	0x9f0f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:34.793483019 CEST	1.1.1.1	192.168.2.5	0x466e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:34.793483019 CEST	1.1.1.1	192.168.2.5	0x466e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:55.513993979 CEST	1.1.1.1	192.168.2.5	0xf17c	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:55.513993979 CEST	1.1.1.1	192.168.2.5	0xf17c	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:55.514729977 CEST	1.1.1.1	192.168.2.5	0x83a2	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:55.514729977 CEST	1.1.1.1	192.168.2.5	0x83a2	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:40:55.514729977 CEST	1.1.1.1	192.168.2.5	0x83a2	No error (0)	d2fbug8oy6zx3g.cloudfront.net		65.9.86.2	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:55.514729977 CEST	1.1.1.1	192.168.2.5	0x83a2	No error (0)	d2fbug8oy6zx3g.cloudfront.net		65.9.86.5	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:55.514729977 CEST	1.1.1.1	192.168.2.5	0x83a2	No error (0)	d2fbug8oy6zx3g.cloudfront.net		65.9.86.88	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:40:55.514729977 CEST	1.1.1.1	192.168.2.5	0x83a2	No error (0)	d2fbug8oy6zx3g.cloudfront.net		65.9.86.125	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:41:00.659416914 CEST	1.1.1.1	192.168.2.5	0x8198	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:41:00.659416914 CEST	1.1.1.1	192.168.2.5	0x8198	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:41:00.667598963 CEST	1.1.1.1	192.168.2.5	0x6540	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:41:00.667598963 CEST	1.1.1.1	192.168.2.5	0x6540	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 00:41:00.667598963 CEST	1.1.1.1	192.168.2.5	0x6540	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.58	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:41:00.667598963 CEST	1.1.1.1	192.168.2.5	0x6540	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.122	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:41:00.667598963 CEST	1.1.1.1	192.168.2.5	0x6540	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.62	A (IP address)	IN (0x0001)	false
Aug 30, 2024 00:41:00.667598963 CEST	1.1.1.1	192.168.2.5	0x6540	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.104	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 00:39:23.111320019 CEST	433	OUT	GET / HTTP/1.1 Host: www.bet3656001.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Aug 30, 2024 00:39:24.001236916 CEST	242	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=utf-8 Location: https://www.bet3656001.com:8989/ Date: Thu, 29 Aug 2024 22:39:23 GMT Content-Length: 67 Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 65 74 33 36 35 36 30 30 31 2e 63 6f 6d 3a 38 39 38 39 2f 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://www.bet3656001.com:8989/">Moved Permanently</a>.
Aug 30, 2024 00:40:09.008368969 CEST	6	OUT	Data Raw: 00 Data Ascii:
Aug 30, 2024 00:40:54.104790926 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-29 22:39:27 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=125846 Date: Thu, 29 Aug 2024 22:39:27 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:28 UTC	575	OUT	GET /ftl/commonPage/themes/gui-base.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.bet3656001.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:28 UTC	696	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 17137 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-05 ETag: W/"66bc0c2d-145e6" Date: Wed, 14 Aug 2024 14:51:32 GMT Last-Modified: Wed, 14 Aug 2024 01:45:17 GMT Expires: Fri, 13 Sep 2024 14:51:32 GMT Age: 1324076 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-213 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-05 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-16 X-Cdn-Request-ID: 66375777945096c8a28b93a2dd7202a6
2024-08-29 22:39:28 UTC	15688	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 79 93 e4 c6 75 e7 ff fa 14 50 33 18 9c 21 ab 8a 00 ea ee 0a 4e 88 94 ad 23 2c d9 5e 51 d6 1e 14 83 81 02 b2 aa c0 41 01 25 00 d5 07 3b ca a1 f0 5a 22 ad b5 0e cb b2 b4 3a bc a2 7c 2d ad 90 e4 db 26 45 4a fe 32 ec 99 e1 5f fe 0a ce 1b 79 bc 44 a1 7b 64 ef 76 93 d3 55 99 bf 7c f9 f2 bd 97 2f ef cc 67 9f fe f0 87 bc a7 bd 8f 47 5b f4 42 71 f1 3b 9f ec bf 10 55 c8 bb 73 fd c3 9f 3f fc d1 17 3f f8 9f 6f 5d bf f1 e5 bb 04 70 86 ca 2a 2d 72 2f 18 f8 83 39 09 78 7e 5f 6f 8a f2 d4 7b b1 46 67 28 27 21 bf 16 d5 c8 db 16 49 ba 4a 51 e2 85 7e 30 ed fb f3 be 1f e2 b8 67 3f f4 ec d3 de c3 9f ff d9 f5 1f 7e e9 c1 9b ff 72 fd de d7 49 d0 47 d2 ed ae 28 6b 6f 5f 66 77 4e 36 45 be 5e 46 c5 20 ae aa 93 bb 0b 02 bf fe d2 5b d7 7f f7 c5 eb Data Ascii: }yuP3!N#,^QA%;Z":\|-&EJ2_yD{dvU\|/gG[Bq;Us??o]p*-r/9x~_o{Fg('!IJQ~0g?~rIG(ko_fwN6E^F [
2024-08-29 22:39:28 UTC	1449	IN	Data Raw: b0 22 de 9c df 4e 75 f3 26 d2 63 75 13 12 2b af a6 06 8f b8 fd df a7 7d fc 2f ee d6 28 9a ef 2b ab e2 9e 0a 12 ad 88 d7 b9 74 10 fb 78 08 fe 9f c9 87 6e 15 64 fc ff 1f 9d e3 6d f5 6a 08 e6 3f 4b a9 d8 81 fa d6 e0 05 bb 5d e6 75 57 78 e0 bb 79 f0 f5 6f be ff ee 3f 3f f8 fa 37 3e f8 f2 37 ff ed bd ef 11 b7 cb fa 24 fd 3a dd e9 be d6 f7 e7 2b b4 92 1e 7f 48 6e ac 50 fa 41 0b 55 11 ea d0 93 21 d5 de 05 3f 98 ad dd 89 42 5b 05 45 5e a4 c0 0d 27 83 28 c3 7e 4d ba 2a df d3 a3 95 0b 46 9a ab 45 3c be b5 47 87 7a 3b 68 2c 00 0f 6f f4 84 03 fc 8f b4 96 db 12 89 14 7b 55 07 37 6a a7 85 ca ab 25 6f fa 85 ec fc 82 da 19 ae 91 c9 58 1d 93 8d e8 37 6a 6f 64 12 53 f4 b3 fb 2c 5c cc 4c 10 35 fa 52 8d e4 b3 35 f0 75 b0 24 8e 8f 48 c6 ec 51 b0 9a 92 ed e2 b1 6d 84 1a e7 fb Data Ascii: "Nu&cu+}/(+txndmj?K]uWxyo??7>7$:+HnPAU!?B[E^'(~M*FE<Gz;h,o{U7j%oX7jodS,\L5R5u$HQm

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.bet3656001.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 223

Chrome Cache Entry: 225

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Windows Analysis Report
http://www.bet3656001.com/

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:28 UTC	583	OUT	GET /ftl/commonPage/themes/gui-skin-default.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.bet3656001.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:28 UTC	693	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 6253 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-06 ETag: W/"64ad1569-7b6e" Date: Tue, 06 Aug 2024 16:13:43 GMT Last-Modified: Tue, 11 Jul 2023 08:40:09 GMT Expires: Thu, 05 Sep 2024 16:13:43 GMT Age: 2010345 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-206 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-06 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-05 X-Cdn-Request-ID: 9544204a19bc3ebec13462ed28736c7f
2024-08-29 22:39:28 UTC	6253	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 8f 1c c7 71 df f5 2b c6 14 08 de f1 6e 96 b3 cf bb dd 05 0f 3e 92 47 8a 72 68 4b 7c 58 24 65 7d 98 9d e9 dd 1d 71 76 66 31 33 cb bb e3 e2 00 05 49 04 2b 8e f3 70 92 0f 81 23 20 8c 11 c3 5f ec 0f 09 02 24 91 6d fd 97 c0 a4 c4 4f fe 0b e9 e7 4c 3f 6a 1e 7b 52 00 11 d0 1d a5 9b ed ae ae ae aa ae ae ae ae ae e9 fd e3 67 9f 5f b9 fc 9d 37 ac cb d6 2d 77 81 ae c5 27 0f 6e db f7 9e 04 91 7d 03 4d dd 55 98 59 5b af 7e f1 d7 2f ff e5 b7 af fe ec 57 2f 7e fc f1 1f 7f fb c9 ff 7e f4 0f f8 df 17 ff f4 bb 2f 3f f9 f7 2f fe e3 33 56 4b da 3f 45 49 1a c4 91 d5 6e 39 ad 21 29 38 5c 65 f3 38 19 59 f7 32 f4 14 45 a4 e4 86 9b 21 6b 11 fb c1 34 40 be d5 71 da 7b b6 33 b4 3b 6d 5c 77 85 50 71 35 ff b1 fc 24 5e fa f1 71 94 5a 7f f8 af 9f Data Ascii: =kq+n>GrhK\|X$e}qvf13I+p# _$mOL?j{Rg_7-w'n}MUY[~/W/~~/?/3VK?EIn9!)8\e8Y2E!k4@q{3;m\wPq5$^qZ

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:28 UTC	579	OUT	GET /ftl/bet365-627/themes/style/common.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.bet3656001.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:28 UTC	677	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 55877 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: "6327fe95-da45" Date: Sat, 17 Aug 2024 08:35:38 GMT Last-Modified: Mon, 19 Sep 2022 05:31:01 GMT Expires: Mon, 16 Sep 2024 08:35:38 GMT Age: 1087430 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-212 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-20 X-Cdn-Request-ID: 61aceabcd6b63ee89aac11ada7df3005
2024-08-29 22:39:28 UTC	15707	IN	Data Raw: ef bb bf 2f 2a 21 0a 20 2a 20 42 65 74 33 36 35 0a 20 2a 20 41 75 74 68 6f 72 3a 20 53 74 65 76 65 6e 0a 20 2a 20 55 70 64 61 74 65 20 62 79 20 32 30 31 37 2d 30 32 2d 32 30 0a 20 2a 2f 0a 0a 2f 2a 20 e7 a6 81 e7 94 a8 e5 93 8d e5 ba 94 20 2a 2f 0a 2e 63 6f 6e 74 61 69 6e 65 72 2d 66 6c 75 69 64 2c 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 31 30 30 70 78 7d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 39 39 30 70 78 29 7b 0a 09 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 33 33 35 70 78 3b 7d 0a 7d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 0a 09 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 33 33 35 70 78 3b 7d 0a 7d 0a 2e 73 63 72 65 65 6e 2d 6c 67 20 2e 63 6f 6e 74 61 69 6e Data Ascii: /! Bet365 * Author: Steven * Update by 2017-02-20 // */.container-fluid,.container{width:1100px}@media (min-width:990px){.container{width:1335px;}}@media (min-width:1200px){.container{width:1335px;}}.screen-lg .contain
2024-08-29 22:39:28 UTC	16384	IN	Data Raw: 7b 63 6f 6c 6f 72 3a 23 46 46 44 46 31 42 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 33 3b 7d 0a 0a 2f 2a 20 69 6e 64 65 78 2d 73 6c 69 64 65 20 2a 2f 0a 2e 69 6e 64 65 78 2d 77 72 61 70 20 2e 6d 61 69 6e 2d 77 72 61 70 7b 77 69 64 74 68 3a 38 36 30 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 33 33 3b 70 61 64 64 69 6e 67 3a 35 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 3b 7d 0a 2e 69 6e 64 65 78 2d 73 6c 69 64 65 7b 77 69 64 74 68 3a 38 34 34 70 78 3b 68 65 69 67 68 74 3a 32 32 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 36 33 36 33 36 33 3b 6d 61 72 67 69 6e 3a 35 Data Ascii: {color:#FFDF1B;background-color:#333;}/* index-slide */.index-wrap .main-wrap{width:860px;float:left;background:#333;padding:5px;overflow:hidden;margin-bottom:0;}.index-slide{width:844px;height:220px;position:relative;border:3px solid #636363;margin:5
2024-08-29 22:39:28 UTC	16384	IN	Data Raw: 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 6e 61 76 69 20 61 2e 69 63 6f 32 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 37 31 70 78 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 6e 61 76 69 20 61 2e 69 63 6f 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 32 32 38 70 78 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 61 64 62 6f 78 20 69 6d 67 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 61 64 62 6f 78 20 69 6d 67 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 31 39 39 65 39 65 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 6c 69 73 74 20 75 6c 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 7d 0a Data Ascii: nt;color:#fff;}.casino-navi a.ico2{background-position:0 -171px;}.casino-navi a.ico3{background-position:0 -228px;}.casino-adbox img{border:1px solid #000;width:100%;}.casino-adbox img:hover{border-color:#199e9e;}.casino-list ul{padding:0;margin:0;}
2024-08-29 22:39:28 UTC	7402	IN	Data Raw: 64 65 72 2d 70 61 6e 65 6c 20 2e 6d 65 6d 62 65 72 73 2d 64 72 6f 70 64 6f 77 6e 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 33 33 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 62 62 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 29 3b 63 6f 6c 6f 72 3a 23 33 33 33 3b 7d 0a 2e 68 65 61 64 65 72 2d 70 61 6e 65 6c 20 2e 6d 65 6d 62 65 72 73 2d 64 72 6f 70 64 6f 77 6e 3e 6c 69 7b 6d 61 72 67 69 6e 3a 33 70 78 20 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 2e 68 65 61 64 65 72 2d 70 61 6e 65 6c 20 2e 6d 65 6d 62 65 72 73 2d 64 72 6f 70 64 6f Data Ascii: der-panel .members-dropdown{margin-top:0;padding:0;border:1px solid #333;border-radius:4px;background-color:#bbb;box-shadow:0 0 10px rgba(0,0,0,.3);color:#333;}.header-panel .members-dropdown>li{margin:3px 0;font-size:12px;}.header-panel .members-dropdo

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:28 UTC	593	OUT	GET /ftl/bet365-627/themes/style/bootstrap-dialog.min.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.bet3656001.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:28 UTC	675	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2780 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: "6156cab3-adc" Date: Sat, 17 Aug 2024 08:35:42 GMT Last-Modified: Fri, 01 Oct 2021 08:45:39 GMT Expires: Mon, 16 Sep 2024 08:35:42 GMT Age: 1087426 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-212 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-03 X-Cdn-Request-ID: 0fd7f2598b24d9662fa69f8a13f20f49
2024-08-29 22:39:28 UTC	2780	IN	Data Raw: 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 6d 6f 64 61 6c 2d 68 65 61 64 65 72 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 20 34 70 78 0a 7d 0a 0a 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 2d 74 69 74 6c 65 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 0a 7d 0a 0a 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 2d 6d 65 73 73 61 67 65 20 Data Ascii: .bootstrap-dialog .modal-header { border-top-left-radius: 4px; border-top-right-radius: 4px}.bootstrap-dialog .bootstrap-dialog-title { color: #fff; text-align: center; font-size: 18px}.bootstrap-dialog .bootstrap-dialog-message

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:28 UTC	589	OUT	GET /ftl/bet365-627/themes/style/swiper-4.3.3.min.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.bet3656001.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:28 UTC	693	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 19773 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-05 ETag: "615c2c2b-4d3d" Date: Sat, 17 Aug 2024 08:35:41 GMT Last-Modified: Tue, 05 Oct 2021 10:42:51 GMT Expires: Mon, 16 Sep 2024 08:35:41 GMT Age: 1087427 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-213 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-05 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-02 X-Cdn-Request-ID: 55cdec4dbf481a301fca6e6266aabd9e
2024-08-29 22:39:28 UTC	15691	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 53 77 69 70 65 72 20 34 2e 33 2e 33 0a 20 2a 20 4d 6f 73 74 20 6d 6f 64 65 72 6e 20 6d 6f 62 69 6c 65 20 74 6f 75 63 68 20 73 6c 69 64 65 72 20 61 6e 64 20 66 72 61 6d 65 77 6f 72 6b 20 77 69 74 68 20 68 61 72 64 77 61 72 65 20 61 63 63 65 6c 65 72 61 74 65 64 20 74 72 61 6e 73 69 74 69 6f 6e 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 69 64 61 6e 67 65 72 6f 2e 75 73 2f 73 77 69 70 65 72 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 2d 32 30 31 38 20 56 6c 61 64 69 6d 69 72 20 4b 68 61 72 6c 61 6d 70 69 64 69 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 6f 6e 3a 20 4a 75 6e 65 20 35 2c 20 32 30 31 Data Ascii: /** * Swiper 4.3.3 * Most modern mobile touch slider and framework with hardware accelerated transitions * http://www.idangero.us/swiper/ * * Copyright 2014-2018 Vladimir Kharlampidi * * Released under the MIT License * * Released on: June 5, 201
2024-08-29 22:39:28 UTC	4082	IN	Data Raw: 33 44 27 36 30 27 25 32 30 78 32 25 33 44 27 36 30 27 25 32 30 79 31 25 33 44 27 37 27 25 32 30 79 32 25 33 44 27 32 37 27 25 32 30 73 74 72 6f 6b 65 25 33 44 27 25 32 33 66 66 66 27 25 32 30 73 74 72 6f 6b 65 2d 77 69 64 74 68 25 33 44 27 31 31 27 25 32 30 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 25 33 44 27 72 6f 75 6e 64 27 25 32 46 25 33 45 25 33 43 25 32 46 64 65 66 73 25 33 45 25 33 43 67 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 32 37 27 25 32 46 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 32 37 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 Data Ascii: 3D'60'%20x2%3D'60'%20y1%3D'7'%20y2%3D'27'%20stroke%3D'%23fff'%20stroke-width%3D'11'%20stroke-linecap%3D'round'%2F%3E%3C%2Fdefs%3E%3Cg%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.27'%2F%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.27'%20transform%3D'r

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:28 UTC	572	OUT	GET /ftl/commonPage/js/jquery/jquery-1.11.3.min.js HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.bet3656001.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:28 UTC	708	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 33545 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: W/"5d848f4f-176d4" Date: Sun, 25 Aug 2024 17:34:07 GMT Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT Expires: Tue, 24 Sep 2024 17:34:07 GMT Age: 363921 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-206 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-02 X-Cdn-Request-ID: 1abb8eab4daaf3511e6245afc90f290e
2024-08-29 22:39:28 UTC	15676	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd 79 7b e3 c6 b1 2e fe ff f9 14 22 e2 43 03 c3 16 25 8e ed dc 13 70 20 3e b6 c7 8e ed 78 4b 66 1c 3b a1 68 3f d8 48 42 e2 26 92 1a 8d 2c 32 9f fd d6 5b d5 dd 68 2c 1c 3b e7 dc df f2 5c 27 23 62 69 f4 5a 5d 5b d7 72 f1 ac 73 76 f3 d7 fb 7c fb 78 f6 66 d0 1f 0c fa 1f 9c 1d ce fc 34 38 7b 7e 79 f9 91 a2 bf 83 8f cc fb cf d7 f7 ab 2c de 17 eb 95 3a fb 72 95 f6 a9 e0 cd 1d de f4 d7 db d9 c5 a2 48 f3 d5 2e 3f 7b 76 f1 1f 9d e9 fd 2a 45 39 3f 56 49 f0 e4 ad 93 9b 3c dd 7b 51 b4 7f dc e4 eb e9 d9 72 9d dd 2f f2 6e f7 c4 8b 7e fe 76 b3 de ee 77 a3 ea 6d 14 f7 b3 75 7a bf cc 57 fb 51 42 35 77 2e 83 b0 6c 28 78 2a a6 7e a7 2c 12 ec e7 db f5 c3 d9 2a 7f 38 fb 6c bb 5d 6f 7d 4f 8f 62 9b df dd 17 db 7c 77 16 9f 3d 14 ab 8c ca 3c 14 fb Data Ascii: y{."C%p >xKf;h?HB&,2[h,;\'#biZ][rsv\|xf48{~y,:rH.?{vE9?VI<{Qr/n~vwmuzWQB5w.l(x~,*8l]o}Ob\|w=<
2024-08-29 22:39:28 UTC	16384	IN	Data Raw: 79 bd cc ca 8b 3d 68 12 92 9c a8 76 7e bf 92 65 72 b9 96 aa c7 56 19 1f 47 b8 17 e8 0c c1 77 15 ab 78 a1 95 88 7e ed 49 5f 5a e7 43 2a fb 1d cc eb d4 ae 58 de 2f 2a 6e 90 5a 95 27 fb 3d 2f 35 b5 0e 15 82 d1 08 6b 2b 62 55 ec 5e e9 1a 38 a5 43 a5 55 c2 af c7 60 98 8d 6a 62 84 9f 9b ec ca 4d f5 b7 56 7c c0 59 ed 84 b4 94 36 f8 41 e0 4b 57 3f 14 b5 3a db 8c aa 03 04 af dd 52 0a 73 d9 e6 7a c3 46 75 f5 44 dc a5 e7 b7 1c 22 0d 2b be 36 b4 0a 5a 9d 11 4b 26 6a 18 f6 f3 a5 48 61 55 c7 1c 88 fa 01 06 22 43 68 25 2c 00 b8 4a c4 2b 29 3c f2 d9 cf 8f 8f 15 04 28 2b ab 60 62 34 b1 28 aa f9 1c 7e d0 9c df c8 86 82 b4 8f 1c 64 d3 7c 29 b3 55 42 16 58 f6 51 1c 87 89 89 e2 25 6d c2 3d dc 82 11 6f b4 44 87 47 b0 a4 3a 92 21 98 5b 68 fc 56 24 c3 8a 78 20 c6 3c 25 0b 07 55 Data Ascii: y=hv~erVGwx~I_ZCX/nZ'=/5k+bU^8CU`jbMV\|Y6AKW?:RszFuD"+6ZK&jHaU"Ch%,J+)<(+`b4(~d\|)UBXQ%m=oDG:![hV$x <%U
2024-08-29 22:39:28 UTC	1485	IN	Data Raw: 6c 03 b6 3a bd 60 32 1b f4 58 f8 11 56 f8 41 42 07 2c 92 20 45 5d 66 05 74 19 f1 c7 a2 ad 79 09 69 17 74 9e 93 c6 6c 15 0d 19 9b 99 35 23 00 d3 d9 85 c4 c3 01 f3 94 c2 f4 79 15 ed 11 8f 15 69 21 dd c4 69 05 c3 4a e3 3e 5f 1d cd 17 eb 23 6c 23 e6 9c 4f 68 0a 76 2a 9c 92 54 18 a8 ec 91 be 82 84 bc 0a 6a 9e 38 65 fb 9d 1a b7 f8 79 97 02 4c 12 f3 f0 c2 c9 2d 1b 93 f5 41 fb 54 86 96 d9 44 bc 9a d8 b9 87 7f fc ba 33 61 4e dd 24 ad 5d 80 17 0b a7 fc 18 81 ac 23 c3 0e f2 7c 42 46 69 1d c1 bc 45 4f 3c 0f f4 c4 5b 8d a0 b4 22 2e 60 3b ab a9 7c 12 75 5c 30 f5 21 c6 e6 10 7a 70 dc 3c b4 61 c5 c6 d9 b0 68 80 55 c4 e0 8e 47 09 07 06 28 36 04 2b 5e 2e f3 09 7f a1 e3 c7 e4 ae f8 2d 15 1a 9f 26 81 66 43 03 a6 0e 46 76 53 2d 27 55 67 08 3f 79 1e af 4a f3 6e 0a 71 fe c9 7a Data Ascii: l:`2XVAB, E]ftyitl5#yi!iJ>_#l#Ohv*Tj8eyL-ATD3aN$]#\|BFiEO<[".`;\|u\0!zp<ahUG(6+^.-&fCFvS-'Ug?yJnqz

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-29 22:39:28 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=125798 Date: Thu, 29 Aug 2024 22:39:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-29 22:39:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:29 UTC	605	OUT	GET /ftl/commonPage/themes/hongbao.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://o1tyg6.innittapp.com/ftl/commonPage/themes/gui-base.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:30 UTC	693	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5666 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-01 ETag: W/"64252e4f-d530" Date: Thu, 22 Aug 2024 22:32:25 GMT Last-Modified: Thu, 30 Mar 2023 06:38:07 GMT Expires: Sat, 21 Sep 2024 22:32:25 GMT Age: 605225 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-211 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-01 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-18 X-Cdn-Request-ID: e8987f5eac596870f86fbca792e5859f
2024-08-29 22:39:30 UTC	5666	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5d 7b 8f dc d6 75 ff df 9f 82 85 61 44 16 c4 59 92 b3 b3 4f a4 30 92 d8 a8 5b 20 30 da f4 81 fe b3 e0 ce 70 76 18 71 87 83 19 ae 56 6b 41 40 d2 d8 75 ad 2a 51 9b 36 51 9a c4 68 15 c4 8a 9a c2 8f c2 8e 65 2b 86 fd 65 34 fb f8 16 bd 7c 9f 4b de 7b 79 cf bd 77 bc 56 25 41 da 99 e1 f0 fc ce fb 9c 1f 39 a3 b5 ab af 7d fb e2 e1 cf 2f 1e fc 61 f9 f9 67 67 bf bf bf fc ec cb e5 bf de 39 fd af c7 cb cf ef d9 fb c1 41 38 bd ba f6 5c 6f 18 1f da fe e8 46 30 4f c2 45 70 18 4c 13 fb 78 ee cf 7a 91 7f 72 14 da e4 ef 60 6e dd b2 f6 fd e1 f5 83 79 7c 34 1d d9 c3 38 8a e7 3b d6 f3 e3 f1 d8 fa 93 f0 70 16 cf 13 7f 9a ec 5a b7 a5 4e 05 1f d8 8b 20 39 0e a7 f4 73 c3 28 5e 04 a9 c4 78 3e 4a 1f 16 d2 bc 51 fa 7b d7 6a 3e 66 49 25 ef 1e 85 8b 19 Data Ascii: ]{uaDYO0[ 0pvqVkA@u*Q6Qhe+e4\|K{ywV%A9}/agg9A8\oF0OEpLxzr`ny\|48;pZN 9s(^x>JQ{j>fI%

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:29 UTC	607	OUT	GET /ftl/commonPage/themes/gui-layer.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://o1tyg6.innittapp.com/ftl/commonPage/themes/gui-base.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:30 UTC	693	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 6923 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-01 ETag: W/"64ddd5e1-c760" Date: Thu, 22 Aug 2024 22:32:25 GMT Last-Modified: Thu, 17 Aug 2023 08:10:09 GMT Expires: Sat, 21 Sep 2024 22:32:25 GMT Age: 605225 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-211 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-01 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-17 X-Cdn-Request-ID: 67892002d7f9158bf98984f8107f9a22
2024-08-29 22:39:30 UTC	6923	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5d 7b 8f 23 c7 71 ff 5f 9f 62 b2 82 e0 3b eb 86 37 1c 92 bb cb 25 64 24 b6 7c 96 1c 2b 09 22 29 7e c1 20 86 64 93 1c 2d 39 43 cd 0c 6f 6f 45 08 f0 de 29 88 6c 39 b1 13 e4 22 cb b0 0d 39 39 c5 71 12 01 c2 39 81 57 51 f2 97 85 7c 8e 35 36 96 60 e9 f2 1d d2 8f e9 99 7e ce 8b 33 7b 7b 11 4f 77 f3 ec aa ae ae ae ae fa 75 75 cf ef 8f e7 4e 10 82 c8 d8 79 f1 85 1b e6 fe ce e0 b1 d6 c2 39 5e bb 26 fc 1b 04 c6 c6 18 fb 0b 3f 38 30 1e ef 74 3a 03 63 ea 7b 91 19 ba af 80 03 a3 dd 5d dd 1a 18 23 67 7c 38 0b fc b5 37 31 e3 07 a3 c0 f1 c2 95 13 00 2f 32 7e cf 5d ae fc 20 72 bc 68 60 bc ca 17 cc 9e 98 a3 c8 83 94 56 ce 64 e2 7a b3 03 c3 32 da bd d5 2d c3 b6 78 0a 90 89 e9 74 0a af f8 c1 04 bd e4 47 91 bf 34 17 60 1a 99 81 33 71 d7 e1 81 Data Ascii: ]{#q_b;7%d$\|+")~ d-9CooE)l9"99q9WQ\|56`~3{{OwuuNy9^&?80t:c{]#g\|871/2~] rh`Vdz2-xtG4`3q

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:30 UTC	389	OUT	GET /ftl/commonPage/js/jquery/jquery-1.11.3.min.js HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:31 UTC	708	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 33545 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: W/"5d848f4f-176d4" Date: Sun, 25 Aug 2024 17:34:07 GMT Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT Expires: Tue, 24 Sep 2024 17:34:07 GMT Age: 363924 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-206 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-02 X-Cdn-Request-ID: 5d71bf1caa58d45da919951cf754a7ea
2024-08-29 22:39:31 UTC	15676	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd 79 7b e3 c6 b1 2e fe ff f9 14 22 e2 43 03 c3 16 25 8e ed dc 13 70 20 3e b6 c7 8e ed 78 4b 66 1c 3b a1 68 3f d8 48 42 e2 26 92 1a 8d 2c 32 9f fd d6 5b d5 dd 68 2c 1c 3b e7 dc df f2 5c 27 23 62 69 f4 5a 5d 5b d7 72 f1 ac 73 76 f3 d7 fb 7c fb 78 f6 66 d0 1f 0c fa 1f 9c 1d ce fc 34 38 7b 7e 79 f9 91 a2 bf 83 8f cc fb cf d7 f7 ab 2c de 17 eb 95 3a fb 72 95 f6 a9 e0 cd 1d de f4 d7 db d9 c5 a2 48 f3 d5 2e 3f 7b 76 f1 1f 9d e9 fd 2a 45 39 3f 56 49 f0 e4 ad 93 9b 3c dd 7b 51 b4 7f dc e4 eb e9 d9 72 9d dd 2f f2 6e f7 c4 8b 7e fe 76 b3 de ee 77 a3 ea 6d 14 f7 b3 75 7a bf cc 57 fb 51 42 35 77 2e 83 b0 6c 28 78 2a a6 7e a7 2c 12 ec e7 db f5 c3 d9 2a 7f 38 fb 6c bb 5d 6f 7d 4f 8f 62 9b df dd 17 db 7c 77 16 9f 3d 14 ab 8c ca 3c 14 fb Data Ascii: y{."C%p >xKf;h?HB&,2[h,;\'#biZ][rsv\|xf48{~y,:rH.?{vE9?VI<{Qr/n~vwmuzWQB5w.l(x~,*8l]o}Ob\|w=<
2024-08-29 22:39:31 UTC	16384	IN	Data Raw: 79 bd cc ca 8b 3d 68 12 92 9c a8 76 7e bf 92 65 72 b9 96 aa c7 56 19 1f 47 b8 17 e8 0c c1 77 15 ab 78 a1 95 88 7e ed 49 5f 5a e7 43 2a fb 1d cc eb d4 ae 58 de 2f 2a 6e 90 5a 95 27 fb 3d 2f 35 b5 0e 15 82 d1 08 6b 2b 62 55 ec 5e e9 1a 38 a5 43 a5 55 c2 af c7 60 98 8d 6a 62 84 9f 9b ec ca 4d f5 b7 56 7c c0 59 ed 84 b4 94 36 f8 41 e0 4b 57 3f 14 b5 3a db 8c aa 03 04 af dd 52 0a 73 d9 e6 7a c3 46 75 f5 44 dc a5 e7 b7 1c 22 0d 2b be 36 b4 0a 5a 9d 11 4b 26 6a 18 f6 f3 a5 48 61 55 c7 1c 88 fa 01 06 22 43 68 25 2c 00 b8 4a c4 2b 29 3c f2 d9 cf 8f 8f 15 04 28 2b ab 60 62 34 b1 28 aa f9 1c 7e d0 9c df c8 86 82 b4 8f 1c 64 d3 7c 29 b3 55 42 16 58 f6 51 1c 87 89 89 e2 25 6d c2 3d dc 82 11 6f b4 44 87 47 b0 a4 3a 92 21 98 5b 68 fc 56 24 c3 8a 78 20 c6 3c 25 0b 07 55 Data Ascii: y=hv~erVGwx~I_ZCX/nZ'=/5k+bU^8CU`jbMV\|Y6AKW?:RszFuD"+6ZK&jHaU"Ch%,J+)<(+`b4(~d\|)UBXQ%m=oDG:![hV$x <%U
2024-08-29 22:39:31 UTC	1485	IN	Data Raw: 6c 03 b6 3a bd 60 32 1b f4 58 f8 11 56 f8 41 42 07 2c 92 20 45 5d 66 05 74 19 f1 c7 a2 ad 79 09 69 17 74 9e 93 c6 6c 15 0d 19 9b 99 35 23 00 d3 d9 85 c4 c3 01 f3 94 c2 f4 79 15 ed 11 8f 15 69 21 dd c4 69 05 c3 4a e3 3e 5f 1d cd 17 eb 23 6c 23 e6 9c 4f 68 0a 76 2a 9c 92 54 18 a8 ec 91 be 82 84 bc 0a 6a 9e 38 65 fb 9d 1a b7 f8 79 97 02 4c 12 f3 f0 c2 c9 2d 1b 93 f5 41 fb 54 86 96 d9 44 bc 9a d8 b9 87 7f fc ba 33 61 4e dd 24 ad 5d 80 17 0b a7 fc 18 81 ac 23 c3 0e f2 7c 42 46 69 1d c1 bc 45 4f 3c 0f f4 c4 5b 8d a0 b4 22 2e 60 3b ab a9 7c 12 75 5c 30 f5 21 c6 e6 10 7a 70 dc 3c b4 61 c5 c6 d9 b0 68 80 55 c4 e0 8e 47 09 07 06 28 36 04 2b 5e 2e f3 09 7f a1 e3 c7 e4 ae f8 2d 15 1a 9f 26 81 66 43 03 a6 0e 46 76 53 2d 27 55 67 08 3f 79 1e af 4a f3 6e 0a 71 fe c9 7a Data Ascii: l:`2XVAB, E]ftyitl5#yi!iJ>_#l#Ohv*Tj8eyL-ATD3aN$]#\|BFiEO<[".`;\|u\0!zp<ahUG(6+^.-&fCFvS-'Ug?yJnqz

Timestamp	Bytes transferred	Direction	Data
2024-08-29 22:39:31 UTC	553	OUT	GET /ftl/commonPage/js/float.js HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.bet3656001.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-29 22:39:31 UTC	722	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 1929 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-06 ETag: W/"612747ba-1b2f" Date: Sun, 25 Aug 2024 18:39:04 GMT Last-Modified: Thu, 26 Aug 2021 07:50:18 GMT Expires: Tue, 24 Sep 2024 18:39:04 GMT Age: 360027 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-205 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-06 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-18 X-Cdn-Request-ID: c3e0fbdf97f9b77e23d89fd79a4d9116
2024-08-29 22:39:31 UTC	1929	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 59 5b 6f 13 47 14 7e cf af 18 52 84 77 61 e3 38 54 b4 52 4c 5a ca a5 2a 12 15 55 8b d4 07 84 aa 8d 3d 4e b6 ac 77 a3 dd 75 12 44 23 45 22 a1 81 10 9c 16 28 24 10 c2 25 10 a0 e0 b4 e2 12 93 0b bf c6 b3 b6 ff 45 cf cc ec d5 f6 7a 1d da 48 9d 17 ef ec 9c 39 97 ef 5c e6 cc ba 77 ff fe 2e b4 1f 21 fb 6d 89 cc de 42 42 fd c1 7c ed d9 2b 52 7c 5d 29 5f 45 96 3e d2 df 77 28 25 32 8a 23 78 5c ce 8f a8 18 21 b4 57 e8 fe 44 c9 76 8b c9 af 55 5d b6 04 31 4d 09 8e 8c c8 86 9c 47 fa e0 cf a8 1f 5d 84 ad 3f 28 59 4c b7 4b 83 ba 65 e9 79 36 4d c8 05 4b 4f 48 39 ba ef 7b 65 68 d8 ea 4f fd d2 27 99 74 e9 90 94 51 75 13 f7 9b 58 c5 19 4b 37 26 80 69 6f d7 de 64 4e e3 62 d0 00 ca 15 b4 8c a5 e8 1a 12 40 8a 88 2e 76 81 2e 68 54 36 10 56 61 d5 Data Ascii: Y[oG~Rwa8TRLZ*U=NwuD#E"($%EzH9\w.!mBB\|+R\|])_E>w(%2#x\!WDvU]1MG]?(YLKey6MKOH9{ehO'tQuXK7&iodNb@.v.hT6Va