Edit tour

Windows Analysis Report
http://www.3659vip4.com/

Overview

General Information

Sample URL:	http://www.3659vip4.com/
Analysis ID:	1521838
Tags:	openphish
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on image similarity)

Detected non-DNS traffic on DNS port

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1996,i,5446206276293811278,6709323947082100458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.3659vip4.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /visitor.ashx?siteId=65000584 HTTP/1.1Host: 09i32g.uuie34661.comConnection: keep-aliveContent-Length: 69sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://www.3659vip4.com:8989Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.3659vip4.com:8989/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	LLM: Score: 9 Reasons: The brand 'bet365' is well-known and associated with the domain 'bet365.com'., The provided URL 'www.3659vip4.com' does not match the legitimate domain 'bet365.com'., The URL contains suspicious elements such as extra numbers and characters ('3659vip4')., The input fields are labeled as 'unknown', which is unusual and suspicious. DOM: 33.14.pages.csv
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	LLM: Score: 9 Reasons: The legitimate domain for Bet365 is bet365.com., The provided URL (www.3659vip4.com) does not match the legitimate domain., The URL contains suspicious elements such as numbers and unusual characters which are not associated with the legitimate Bet365 domain., The input fields are labeled as 'unknown', which is unusual and suspicious for a well-known brand like Bet365. DOM: 33.27.pages.csv

Source: https://www.3659vip4.com:8989/	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.3659vip4.com:8989/about.html#?id=484	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.3659vip4.com:8989/	HTTP Parser: Title: bet365 - does not match URL
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: Title: bet365 - does not match URL
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: Title: bet365 - does not match URL
Source: https://www.3659vip4.com:8989/about.html#?id=484	HTTP Parser: Title: bet365 - does not match URL

Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="author".. found
Source: https://www.3659vip4.com:8989/about.html#?id=484	HTTP Parser: No <meta name="author".. found

Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/sports.html?apiId=37	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true	HTTP Parser: No <meta name="copyright".. found
Source: https://www.3659vip4.com:8989/about.html#?id=484	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.3659vip4.com
Source: global traffic	DNS traffic detected: DNS query: _8989._https.www.3659vip4.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dxext9.innittapp.com
Source: global traffic	DNS traffic detected: DNS query: lwesoes.qute89uupg.com
Source: global traffic	DNS traffic detected: DNS query: a8rmire3rz.mf6gaikb.com
Source: global traffic	DNS traffic detected: DNS query: tstdmn.cc
Source: global traffic	DNS traffic detected: DNS query: 09i32g.uuie34661.com
Source: global traffic	DNS traffic detected: DNS query: sb-hk.bc.bangbanged.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:05 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:07 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:20 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:21 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:38 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:40 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:44 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:31:56 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 29 Sep 2024 02:32:09 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 02:30:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 552Connection: keep-aliveX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: chromecache_630.2.dr, chromecache_416.2.dr, chromecache_365.2.dr, chromecache_593.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_374.2.dr, chromecache_545.2.dr	String found in binary or memory: http://nicescroll.areaaperta.com
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: http://u80033.cc
Source: chromecache_302.2.dr, chromecache_249.2.dr, chromecache_407.2.dr	String found in binary or memory: http://www.idangero.us/swiper/
Source: chromecache_566.2.dr, chromecache_344.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_536.2.dr	String found in binary or memory: https://09i32g.uuie34661.com
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://3115ww.cc:8989/verify-page/index.html
Source: chromecache_515.2.dr	String found in binary or memory: https://3115yy.cc:8989/promo.html
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://3115yy.cc:8989/verify-page/index.html
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://3115zz.cc:8989/verify-page/index.html
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://365p-app.net/android_down.html
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://365p-app.net/ios_down.html
Source: chromecache_603.2.dr, chromecache_332.2.dr, chromecache_582.2.dr, chromecache_536.2.dr	String found in binary or memory: https://9j91gbh.uuie34661.com/fileservice/v1
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://a01.metacgp.com/
Source: chromecache_603.2.dr, chromecache_582.2.dr	String found in binary or memory: https://a8rmire3rz.mf6gaikb.com
Source: chromecache_566.2.dr, chromecache_344.2.dr	String found in binary or memory: https://appelsiini.net/projects/lazyload
Source: chromecache_248.2.dr, chromecache_467.2.dr	String found in binary or memory: https://developer.matomo.org/api-reference/tracking-javascript
Source: chromecache_248.2.dr, chromecache_467.2.dr	String found in binary or memory: https://developer.matomo.org/guides/tracking-javascript-guide#multiple-piwik-trackers
Source: chromecache_248.2.dr, chromecache_467.2.dr	String found in binary or memory: https://github.com/matomo-org/matomo/blob/master/js/piwik.js
Source: chromecache_531.2.dr	String found in binary or memory: https://imagemagick.org
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://join.skype.com/invite/ud7TKcEseUWc
Source: chromecache_332.2.dr, chromecache_536.2.dr	String found in binary or memory: https://lwesoes.qute89uupg.com
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://me-qr.com/l/okpay
Source: chromecache_603.2.dr, chromecache_332.2.dr, chromecache_582.2.dr, chromecache_536.2.dr	String found in binary or memory: https://n3igha.uuie34661.com
Source: chromecache_248.2.dr, chromecache_467.2.dr	String found in binary or memory: https://piwik.org
Source: chromecache_248.2.dr, chromecache_467.2.dr	String found in binary or memory: https://piwik.org/free-software/bsd/
Source: chromecache_576.2.dr, chromecache_380.2.dr	String found in binary or memory: https://sb-hk.bc.bangbanged.com/#/sport/?lang=zhh
Source: chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/2w_ATepK00b_djHvuR0ZTl7NV8nI3IsLbLu6mECMfsGkw4
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/6xprJORdH0WsgCu8fJ6nr0LIADohJDIHg4ykkCJXpyfORk
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/I0z27HGPZnyV89czDW21cv5HN-AotzTEJfSaka_nv4_EqN
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/IwNfwxHwJpqDA5aLgv5SZWPXGJLRGTJDDDq4jE6_A4zlpW
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/NiLaKD1wW1Ie7aK8wZtqgi62H2u4W-sX6cwGB7pZUodsn9
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/Ryk7i6TVe4S9edzi1YowK5FM7yoLVtVPCUsj1e52NYTylA
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/TdLDTL-mrv6fupZ63Lp6NigW9jMLQyIy0mLapWcyzEx6h0
Source: chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/d23PItQm4AYF7E9paWEKGxhqb-jAwrtgwKe3EVqY_rZhbm
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/dAw2s_1ILzrBimvuufisfFiZNV6_IVcyE2ELPNnfJ-vD2I
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/giU3MSo9yABon3uH1h1EELHS2WHeAv2ZQzZt15UeS8aZQi
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/mthmaChmByAcVL7NGwXMwUVt21Oi__N4AujvKykJbwCQVB
Source: chromecache_496.2.dr, chromecache_515.2.dr	String found in binary or memory: https://www.livehelp100-file.com/fileservice/v1/files/xAhrBUln6DOkQzcRpAg0fSy9RM8dFi6jXvpJnWXou705PL

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1996,i,5446206276293811278,6709323947082100458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.3659vip4.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1996,i,5446206276293811278,6709323947082100458,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
http://www.idangero.us/swiper/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
d34q2tfh9x1bdu.cloudfront.net	3.160.150.108	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
l5-global.gslb.ksyuncdn.com	103.155.16.134	true	false	unknown
www.google.com	142.250.186.100	true	false	unknown
site.b3jx.com	52.184.8.29	true	false	unknown
d3u63bha7c9iam.cloudfront.net	18.245.86.17	true	false	unknown
a48d7a3baeaba2a67.awsglobalaccelerator.com	99.83.207.187	true	false	unknown
tstdmn.cc	34.92.211.102	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
a8rmire3rz.mf6gaikb.com	unknown	unknown	true	unknown
www.3659vip4.com	unknown	unknown	true	unknown
lwesoes.qute89uupg.com	unknown	unknown	true	unknown
sb-hk.bc.bangbanged.com	unknown	unknown	true	unknown
_8989._https.www.3659vip4.com	unknown	unknown	true	unknown
dxext9.innittapp.com	unknown	unknown	true	unknown
09i32g.uuie34661.com	unknown	unknown	true	unknown

Name	Malicious	Reputation
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/images/body_bg.png?wsSecret=4d4dbb58704f4e8d03e86cd47163ecac&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-03.png?wsSecret=ed8dbd38c79b942dd52b46349a610d84&wsTime=1727577070	false	unknown
http://www.3659vip4.com/	true	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-02.png?wsSecret=cf1da9664b28ea48cfbb08fcd3738795&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/images/hongbao/hongbao_type2.png?wsSecret=db0af81cf5142a0ec446103c97e9b281&wsTime=1727577084	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/images/favicon/favicon_141.png?wsSecret=7949dc013ea5d44e2dabae2c0f3a14c3&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/sport-pic-188.jpg?wsSecret=55011dd1ea1a3444fab517a7110550bc&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-03.png?wsSecret=6662e4c4d09c63b0a05f6d99fc9ffcb0&wsTime=1727577084	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/index-lottery.jpg?wsSecret=3bd3d9abb68f92eb6dba5bf8a12b9e31&wsTime=1727577048	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/images/inco2.png?wsSecret=9ff7b7529da0028f1543d242943ef057&wsTime=1727577084	false	unknown
https://tstdmn.cc/matomo.php?action_name=www.3659vip4.com%2Fbet365%20-%20%E5%AE%98%E6%96%B9%E7%9B%B4%E8%90%A5&idsite=4&rec=1&r=540086&h=22&m=31&s=29&url=https%3A%2F%2Fwww.3659vip4.com%3A8989%2Fpromo.html%3Fpid%3Dnew1711350464154%26plist%3Dundefined%26v3%3Dtrue&_id=&_idn=1&send_image=0&_refts=0&pv_id=Tcm2Wl&pf_net=0&pf_srv=644&pf_tfr=216&pf_dm1=7848&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/style/bootstrap-dialog.min.css	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/hb/css/pc.css	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-06.png?wsSecret=3bd2ea2b7d1ed51cf56145d819b87517&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/carousel/10381/1713759163183.jpeg?wsSecret=0af18f3bfd931eef022224e95c37a91c&wsTime=1727577048	false	unknown
http://www.3659vip4.com/favicon.ico	true	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/sport-pic-xy.jpg?wsSecret=a374b75ebb6e9d6f42a6d4b570a8d4e8&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-07.png?wsSecret=8f75535902f8d5a1be3969147a899d49&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-07.png?wsSecret=cf45530616f4012dbff6e058a09d4222&wsTime=1727577084	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-02.png?wsSecret=306a750ac91ba69fda08985554c8e387&wsTime=1727577084	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/logo-foot.png?wsSecret=9f3ad06f2f5d7b412ba8774db41bdf20&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/headImage/1/1726078814933.jpg?wsSecret=2694d90ac1680545b1e978511b2d7bdd&wsTime=1727577086	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/images/arrow.png?wsSecret=a0826010c76bb836559c03cfeef89068&wsTime=1727577048	false	unknown
https://www.3659vip4.com:8989/about.html#?id=484	true	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-07.png?wsSecret=e8d8d043b45aee8f709db7b38d758e57&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/js/idangerous.swiper.min.js	false	unknown
https://www.3659vip4.com:8989/sports.html?apiId=37	true	unknown
https://dxext9.innittapp.com/ftl/commonPage/images/favicon/favicon_141.png?wsSecret=509e7282a6a93f389f642436b43598fe&wsTime=1727577048	false	unknown
https://tstdmn.cc/matomo.php?action_name=www.3659vip4.com%2Fbet365%20-%20%E5%AE%98%E6%96%B9%E7%9B%B4%E8%90%A5&idsite=4&rec=1&r=595844&h=22&m=31&s=16&url=https%3A%2F%2Fwww.3659vip4.com%3A8989%2Fsports.html%3FapiId%3D37&_id=&_idn=1&send_image=0&_refts=0&pv_id=5D7j39&pf_net=0&pf_srv=670&pf_tfr=300&pf_dm1=8056&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/images/bg-products.gif?wsSecret=ad666f3f41a04bfa0434adbd94cd9429&wsTime=1727577048	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/js/lazyload.js	false	unknown
https://tstdmn.cc/matomo.js	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/images/hongbao/hongbao_type2_hover.png?wsSecret=96ab644312ddcd94e9e921b536d9cc7f&wsTime=1727577084	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/carousel/10531/1726075524852.jpg?wsSecret=870fde36b3cd3c69d3748a413d2ba947&wsTime=1727577048	false	unknown
https://a8rmire3rz.mf6gaikb.com/livechat.ashx?siteId=65000584	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/images/hongbao/hongbao_type2.png?wsSecret=401088624baadfe5ecfb3c5827d82d89&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/carousel/10316/1659084716430.png?wsSecret=701b0b80a72b8b84f8a271115606fbf7&wsTime=1727577048	false	unknown
https://09i32g.uuie34661.com/visitor.ashx?siteId=65000584	false	unknown
https://tstdmn.cc/matomo.php?action_name=www.3659vip4.com%2Fbet365%20-%20%E5%AE%98%E6%96%B9%E7%9B%B4%E8%90%A5&idsite=4&rec=1&r=183065&h=22&m=31&s=0&url=https%3A%2F%2Fwww.3659vip4.com%3A8989%2F&urlref=http%3A%2F%2Fwww.3659vip4.com%2F&_id=&_idn=1&send_image=0&_refts=0&pv_id=toikcE&pf_net=1718&pf_srv=749&pf_tfr=474&pf_dm1=10485&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-04.png?wsSecret=c3f07c05ff16ce2cafd5faa02cda338b&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/images/head1.jpg?wsSecret=88b17430469648d21575581a6b5e36e1&wsTime=1727577048	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/images/favicon/favicon_141.png?wsSecret=079571ca8c8e4de41f4e4ee33b76e650&wsTime=1727577084	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/sports-aside-infos-ill-02.jpg?wsSecret=2bf3e4f89c4741d774cc50bdf8174acf&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/index-game.jpg?wsSecret=ec4cf2018fa103769b95c58aeda6fdfb&wsTime=1727577048	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/images/hongbao/hongbao_type2_hover.png?wsSecret=77bdf91dfc64c2b5b243a555588b50a4&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/logo.png?wsSecret=0c02415bd0eb12f88e630ffab2987b54&wsTime=1727577123	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/style/swiper-4.3.3.min.css	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/images/sports-infos-bg.png?wsSecret=2bedda2a8c926764ceee92a808ee4804&wsTime=1727577048	false	unknown
https://09i32g.uuie34661.com/campaign.ashx?siteId=65000584&campaignId=10b42444-f030-4724-9472-c5b49997c716&lastUpdateTime=868EA7EF	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/floatImage/273/1721313755310.png?wsSecret=487964cce8b257372be4cce60aa5f434&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/gui-layer.css	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/js/websocket/CometMarathon.js	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/js/gui-base.js	false	unknown
https://tstdmn.cc/matomo.php?action_name=www.3659vip4.com%2Fbet365%20-%20%E5%AE%98%E6%96%B9%E7%9B%B4%E8%90%A5&idsite=4&rec=1&r=914966&h=22&m=31&s=16&url=https%3A%2F%2Fwww.3659vip4.com%3A8989%2Fsports.html%3FapiId%3D37&_id=&_idn=1&send_image=0&_refts=0&pv_id=9iaSmQ&pf_net=0&pf_srv=670&pf_tfr=300&pf_dm1=8056&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/carousel/10459/1720827887987.jpg?wsSecret=2b38272e5d4426666d7f7473176b2dbd&wsTime=1727577048	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/gui-skin-default.css	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/headImage/1/1726078904574.jpg?wsSecret=413bcc749ea305051c7ffd274ad910b0&wsTime=1727577086	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-01.png?wsSecret=1bb4b3cf301af92fcfc0db93eb999dd8&wsTime=1727577123	false	unknown
https://lwesoes.qute89uupg.com/visitorside/js/bundle.dbff9911.js	false	unknown
https://tstdmn.cc/matomo.php?action_name=www.3659vip4.com%2Fbet365%20-%20%E5%AE%98%E6%96%B9%E7%9B%B4%E8%90%A5&idsite=4&rec=1&r=993931&h=22&m=31&s=29&url=https%3A%2F%2Fwww.3659vip4.com%3A8989%2Fpromo.html%3Fpid%3Dnew1711350464154%26plist%3Dundefined%26v3%3Dtrue&_id=&_idn=1&send_image=0&_refts=0&pv_id=vjrZVO&pf_net=0&pf_srv=644&pf_tfr=216&pf_dm1=7848&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024	false	unknown
https://a8rmire3rz.mf6gaikb.com/visitorside/js/common.14cb3f7d.js	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-05.png?wsSecret=9b5b8521f489542a2abe8aadeca7a9c9&wsTime=1727577084	false	unknown
https://www.3659vip4.com:8989/	true	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-01.png?wsSecret=1a15f3fb0dc3392960b3155aa477442a&wsTime=1727577084	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/logo-foot.png?wsSecret=8678966368de0b438c5d0883b8f4e619&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/partner-logo-01.png?wsSecret=d65017f4b2ad36ee7132ede85074d345&wsTime=1727577070	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/sport-pic-ai.jpg?wsSecret=100953b27c9979c502ec0cd410ea0de3&wsTime=1727577070	false	unknown
https://lwesoes.qute89uupg.com/visitorside/js/vendor.0ace2e6c.js	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/js/moment.js	false	unknown
https://dxext9.innittapp.com/061410/rcenter/common/static/css/gb.validation.min.css	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/js/websocket/PopUp.js	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/themes/images/btn.png?wsSecret=1239907e49d9d2ff74b4a85db07ccad8&wsTime=1727577048	false	unknown
https://dxext9.innittapp.com/fserver/files/gb/141/carousel/10289/1706612387565.jpg?wsSecret=a6786acdd4de17b695aff828a6fba87d&wsTime=1727577048	false	unknown
https://a8rmire3rz.mf6gaikb.com/visitorside/js/Button.4a980e7e.js	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/themes/images/hongbao/hongbao_type2_hover.png?wsSecret=b9d56a487f5d8c0d16dc8b57d7a703c4&wsTime=1727577070	false	unknown
https://lwesoes.qute89uupg.com/livechat.ashx?siteId=65000584	false	unknown
https://dxext9.innittapp.com/ftl/commonPage/js/theme/default/layer.css?v=3.1.0	false	unknown
https://dxext9.innittapp.com/ftl/bet365-141-2/images/sport-pic-cr.jpg?wsSecret=a2a681b620226606ee423eba30d8ecbd&wsTime=1727577070	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://lwesoes.qute89uupg.com	chromecache_332.2.dr, chromecache_536.2.dr	false		unknown
https://piwik.org/free-software/bsd/	chromecache_248.2.dr, chromecache_467.2.dr	false		unknown
https://9j91gbh.uuie34661.com/fileservice/v1	chromecache_603.2.dr, chromecache_332.2.dr, chromecache_582.2.dr, chromecache_536.2.dr	false		unknown
https://imagemagick.org	chromecache_531.2.dr	false		unknown
https://join.skype.com/invite/ud7TKcEseUWc	chromecache_496.2.dr, chromecache_515.2.dr	false		unknown
https://www.livehelp100-file.com/fileservice/v1/files/dAw2s_1ILzrBimvuufisfFiZNV6_IVcyE2ELPNnfJ-vD2I	chromecache_496.2.dr, chromecache_515.2.dr	false		unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_566.2.dr, chromecache_344.2.dr	false	URL Reputation: safe	unknown
https://developer.matomo.org/guides/tracking-javascript-guide#multiple-piwik-trackers	chromecache_248.2.dr, chromecache_467.2.dr	false		unknown
https://github.com/matomo-org/matomo/blob/master/js/piwik.js	chromecache_248.2.dr, chromecache_467.2.dr	false		unknown
https://09i32g.uuie34661.com	chromecache_536.2.dr	false		unknown
https://n3igha.uuie34661.com	chromecache_603.2.dr, chromecache_332.2.dr, chromecache_582.2.dr, chromecache_536.2.dr	false		unknown
https://me-qr.com/l/okpay	chromecache_496.2.dr, chromecache_515.2.dr	false		unknown
https://developer.matomo.org/api-reference/tracking-javascript	chromecache_248.2.dr, chromecache_467.2.dr	false		unknown
https://365p-app.net/android_down.html	chromecache_496.2.dr, chromecache_515.2.dr	false		unknown
http://www.idangero.us/swiper/	chromecache_302.2.dr, chromecache_249.2.dr, chromecache_407.2.dr	false	URL Reputation: safe	unknown
https://appelsiini.net/projects/lazyload	chromecache_566.2.dr, chromecache_344.2.dr	false		unknown
https://365p-app.net/ios_down.html	chromecache_496.2.dr, chromecache_515.2.dr	false		unknown
https://www.livehelp100-file.com/fileservice/v1/files/TdLDTL-mrv6fupZ63Lp6NigW9jMLQyIy0mLapWcyzEx6h0	chromecache_496.2.dr, chromecache_515.2.dr	false		unknown
https://www.livehelp100-file.com/fileservice/v1/files/mthmaChmByAcVL7NGwXMwUVt21Oi__N4AujvKykJbwCQVB	chromecache_496.2.dr, chromecache_515.2.dr	false		unknown
https://3115yy.cc:8989/promo.html	chromecache_515.2.dr	false		unknown
http://nicescroll.areaaperta.com	chromecache_374.2.dr, chromecache_545.2.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521838
Start date and time:	2024-09-29 04:29:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.3659vip4.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@21/620@41/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.3659vip4.com:8989/sports.html?apiId=37 Browse: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Browse: https://www.3659vip4.com:8989/about.html#?id=484

Input	Output
URL: https://www.3659vip4.com:8989/ Model: jbxai

URL: https://www.3659vip4.com:8989/sports.html?apiId=37 Model: jbxai

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai

URL: https://www.3659vip4.com:8989/sports.html?apiId=37 Model: jbxai

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai

URL: https://www.3659vip4.com:8989/ Model: jbxai

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai

URL: https://www.3659vip4.com:8989/sports.html?apiId=37 Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":true, "trigger_text":"Click here to view document", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/ Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":true, "trigger_text":"Sign into X Sign in with Google Sign in with Apple Phone, email, or username Next Forgot password? Dont have an account? Sign up", "prominent_button_name":"Sign in", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":true, "trigger_text":"88888", "prominent_button_name":"", "text_input_field_labels":[""], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":true, "trigger_text":"bet365", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "brand":["bet365"], "contains_trigger_text":false, "trigger_text":null, "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "phishing_score":9, "brands":"bet365", "legit_domain":"bet365.com", "classification":"wellknown", "reasons":["The brand 'bet365' is well-known and associated with the domain 'bet365.com'.", "The provided URL 'www.3659vip4.com' does not match the legitimate domain 'bet365.com'.", "The URL contains suspicious elements such as extra numbers and characters ('3659vip4').", "The input fields are labeled as 'unknown', which is unusual and suspicious."], "brand_matches":[false], "url_match":false, "brand_input":"bet365", "input_fields":"u, n, k, n, o, w, n"}

URL: https://www.3659vip4.com:8989/promo.html?pid=new1711350464154&plist=undefined&v3=true Model: jbxai	{ "phishing_score":9, "brands":"bet365", "legit_domain":"bet365.com", "classification":"wellknown", "reasons":["The legitimate domain for Bet365 is bet365.com.", "The provided URL (www.3659vip4.com) does not match the legitimate domain.", "The URL contains suspicious elements such as numbers and unusual characters which are not associated with the legitimate Bet365 domain.", "The input fields are labeled as 'unknown', which is unusual and suspicious for a well-known brand like Bet365."], "brand_matches":[false], "url_match":false, "brand_input":"bet365", "input_fields":"u, n, k, n, o, w, n"}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 01:30:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9803295854277736
Encrypted:	false
SSDEEP:	48:8Ld8sTJtKH2ZidAKZdA19ehwiZUklqehiy+3:8msrvrpy
MD5:	F949FF4E24DD487B451162066CC7088C
SHA1:	18B0A657039658C5927875A9EE7EB5D6514A477E
SHA-256:	828921CDD279FB1DBB2F086B7B7F0B91FF2F4994F46556ACD937783CEB747F25
SHA-512:	52F784F8BD9CA55799FB34F731A47CDD62B2A8F601C756A9128A726CC472E80930BFF4887AE589D62539ADF3A1AE3672E53801357651A9F6351036D22886EA45
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....V......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I=Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V=Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V=Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V=Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V=Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........{bR......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 29, 2024 04:30:36.375358105 CEST	192.168.2.5	1.1.1.1	0x5ab	Standard query (0)	www.3659vip4.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:36.375608921 CEST	192.168.2.5	1.1.1.1	0x3522	Standard query (0)	www.3659vip4.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:38.311131954 CEST	192.168.2.5	1.1.1.1	0x2fa5	Standard query (0)	www.3659vip4.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:38.311798096 CEST	192.168.2.5	1.1.1.1	0xeb70	Standard query (0)	_8989._https.www.3659vip4.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:39.198844910 CEST	192.168.2.5	1.1.1.1	0x3575	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:39.199157953 CEST	192.168.2.5	1.1.1.1	0x5aa4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:40.970963001 CEST	192.168.2.5	1.1.1.1	0x8d6e	Standard query (0)	dxext9.innittapp.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:40.971183062 CEST	192.168.2.5	1.1.1.1	0x98ba	Standard query (0)	dxext9.innittapp.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:41.677156925 CEST	192.168.2.5	1.1.1.1	0x3587	Standard query (0)	www.3659vip4.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:41.678524971 CEST	192.168.2.5	1.1.1.1	0xf487	Standard query (0)	_8989._https.www.3659vip4.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:43.727597952 CEST	192.168.2.5	1.1.1.1	0x37fe	Standard query (0)	dxext9.innittapp.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:43.727736950 CEST	192.168.2.5	1.1.1.1	0xc2c3	Standard query (0)	dxext9.innittapp.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:58.279326916 CEST	192.168.2.5	1.1.1.1	0xd945	Standard query (0)	lwesoes.qute89uupg.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.279567003 CEST	192.168.2.5	1.1.1.1	0xd613	Standard query (0)	lwesoes.qute89uupg.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:58.279969931 CEST	192.168.2.5	1.1.1.1	0x366a	Standard query (0)	a8rmire3rz.mf6gaikb.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.280124903 CEST	192.168.2.5	1.1.1.1	0x9233	Standard query (0)	a8rmire3rz.mf6gaikb.com	65	IN (0x0001)	false
Sep 29, 2024 04:30:58.751085043 CEST	192.168.2.5	1.1.1.1	0x9196	Standard query (0)	tstdmn.cc	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.751225948 CEST	192.168.2.5	1.1.1.1	0x7ca0	Standard query (0)	tstdmn.cc	65	IN (0x0001)	false
Sep 29, 2024 04:31:00.256903887 CEST	192.168.2.5	1.1.1.1	0x394d	Standard query (0)	lwesoes.qute89uupg.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.257817030 CEST	192.168.2.5	1.1.1.1	0xb762	Standard query (0)	lwesoes.qute89uupg.com	65	IN (0x0001)	false
Sep 29, 2024 04:31:00.818231106 CEST	192.168.2.5	1.1.1.1	0x7f89	Standard query (0)	a8rmire3rz.mf6gaikb.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.818372965 CEST	192.168.2.5	1.1.1.1	0xd4e9	Standard query (0)	a8rmire3rz.mf6gaikb.com	65	IN (0x0001)	false
Sep 29, 2024 04:31:01.503557920 CEST	192.168.2.5	1.1.1.1	0xe51f	Standard query (0)	tstdmn.cc	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:01.503844023 CEST	192.168.2.5	1.1.1.1	0xd7c0	Standard query (0)	tstdmn.cc	65	IN (0x0001)	false
Sep 29, 2024 04:31:01.884486914 CEST	192.168.2.5	1.1.1.1	0x184f	Standard query (0)	09i32g.uuie34661.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:01.884658098 CEST	192.168.2.5	1.1.1.1	0x22cb	Standard query (0)	09i32g.uuie34661.com	65	IN (0x0001)	false
Sep 29, 2024 04:31:04.034784079 CEST	192.168.2.5	1.1.1.1	0x266f	Standard query (0)	09i32g.uuie34661.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:04.034954071 CEST	192.168.2.5	1.1.1.1	0x7c08	Standard query (0)	09i32g.uuie34661.com	65	IN (0x0001)	false
Sep 29, 2024 04:31:14.212549925 CEST	192.168.2.5	1.1.1.1	0x9f9c	Standard query (0)	sb-hk.bc.bangbanged.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:14.212549925 CEST	192.168.2.5	1.1.1.1	0xad16	Standard query (0)	sb-hk.bc.bangbanged.com	65	IN (0x0001)	false
Sep 29, 2024 04:31:14.392582893 CEST	192.168.2.5	1.1.1.1	0x6151	Standard query (0)	sb-hk.bc.bangbanged.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:27.541068077 CEST	192.168.2.5	1.1.1.1	0x7f2	Standard query (0)	sb-hk.bc.bangbanged.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:48.653454065 CEST	192.168.2.5	1.1.1.1	0xd3ef	Standard query (0)	sb-hk.bc.bangbanged.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.689450026 CEST	192.168.2.5	1.1.1.1	0x3cc5	Standard query (0)	lwesoes.qute89uupg.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.689662933 CEST	192.168.2.5	1.1.1.1	0xffe3	Standard query (0)	lwesoes.qute89uupg.com	65	IN (0x0001)	false
Sep 29, 2024 04:32:11.692303896 CEST	192.168.2.5	1.1.1.1	0xec8c	Standard query (0)	a8rmire3rz.mf6gaikb.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.692569017 CEST	192.168.2.5	1.1.1.1	0x1c30	Standard query (0)	a8rmire3rz.mf6gaikb.com	65	IN (0x0001)	false
Sep 29, 2024 04:32:12.849581957 CEST	192.168.2.5	1.1.1.1	0x32d7	Standard query (0)	a8rmire3rz.mf6gaikb.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:12.849746943 CEST	192.168.2.5	1.1.1.1	0xb100	Standard query (0)	a8rmire3rz.mf6gaikb.com	65	IN (0x0001)	false
Sep 29, 2024 04:32:12.895838976 CEST	192.168.2.5	1.1.1.1	0x6cff	Standard query (0)	lwesoes.qute89uupg.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:12.895944118 CEST	192.168.2.5	1.1.1.1	0xc90a	Standard query (0)	lwesoes.qute89uupg.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 29, 2024 04:30:36.953866005 CEST	1.1.1.1	192.168.2.5	0x3522	No error (0)	www.3659vip4.com	site.b3jx.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:37.000561953 CEST	1.1.1.1	192.168.2.5	0x5ab	No error (0)	www.3659vip4.com	site.b3jx.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:37.000561953 CEST	1.1.1.1	192.168.2.5	0x5ab	No error (0)	site.b3jx.com		52.184.8.29	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:39.039025068 CEST	1.1.1.1	192.168.2.5	0x2fa5	No error (0)	www.3659vip4.com	site.b3jx.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:39.039025068 CEST	1.1.1.1	192.168.2.5	0x2fa5	No error (0)	site.b3jx.com		52.184.8.29	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:39.172307014 CEST	1.1.1.1	192.168.2.5	0xeb70	Name error (3)	_8989._https.www.3659vip4.com	none	none	65	IN (0x0001)	false
Sep 29, 2024 04:30:39.205935001 CEST	1.1.1.1	192.168.2.5	0x3575	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:41.815567970 CEST	1.1.1.1	192.168.2.5	0x98ba	No error (0)	dxext9.innittapp.com	dxext9.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:41.815567970 CEST	1.1.1.1	192.168.2.5	0x98ba	No error (0)	dxext9.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:41.854366064 CEST	1.1.1.1	192.168.2.5	0x8d6e	No error (0)	dxext9.innittapp.com	dxext9.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:41.854366064 CEST	1.1.1.1	192.168.2.5	0x8d6e	No error (0)	dxext9.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:41.854366064 CEST	1.1.1.1	192.168.2.5	0x8d6e	No error (0)	l5-global.gslb.ksyuncdn.com		103.155.16.134	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:42.402168989 CEST	1.1.1.1	192.168.2.5	0xf487	Name error (3)	_8989._https.www.3659vip4.com	none	none	65	IN (0x0001)	false
Sep 29, 2024 04:30:42.461314917 CEST	1.1.1.1	192.168.2.5	0x3587	No error (0)	www.3659vip4.com	site.b3jx.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:42.461314917 CEST	1.1.1.1	192.168.2.5	0x3587	No error (0)	site.b3jx.com		52.184.8.29	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:44.051489115 CEST	1.1.1.1	192.168.2.5	0xc2c3	No error (0)	dxext9.innittapp.com	dxext9.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:44.051489115 CEST	1.1.1.1	192.168.2.5	0xc2c3	No error (0)	dxext9.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:44.671006918 CEST	1.1.1.1	192.168.2.5	0x37fe	No error (0)	dxext9.innittapp.com	dxext9.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:44.671006918 CEST	1.1.1.1	192.168.2.5	0x37fe	No error (0)	dxext9.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:44.671006918 CEST	1.1.1.1	192.168.2.5	0x37fe	No error (0)	l5-global.gslb.ksyuncdn.com		103.155.16.134	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:49.817576885 CEST	1.1.1.1	192.168.2.5	0x3a07	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:49.817576885 CEST	1.1.1.1	192.168.2.5	0x3a07	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:50.480288029 CEST	1.1.1.1	192.168.2.5	0x4d5a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:50.480288029 CEST	1.1.1.1	192.168.2.5	0x4d5a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.320874929 CEST	1.1.1.1	192.168.2.5	0xd945	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:58.320874929 CEST	1.1.1.1	192.168.2.5	0xd945	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.17	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.320874929 CEST	1.1.1.1	192.168.2.5	0xd945	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.26	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.320874929 CEST	1.1.1.1	192.168.2.5	0xd945	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.8	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.320874929 CEST	1.1.1.1	192.168.2.5	0xd945	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.58	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.435864925 CEST	1.1.1.1	192.168.2.5	0x9233	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:58.454202890 CEST	1.1.1.1	192.168.2.5	0xd613	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:58.476272106 CEST	1.1.1.1	192.168.2.5	0x366a	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:30:58.476272106 CEST	1.1.1.1	192.168.2.5	0x366a	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.108	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.476272106 CEST	1.1.1.1	192.168.2.5	0x366a	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.31	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.476272106 CEST	1.1.1.1	192.168.2.5	0x366a	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.104	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:58.476272106 CEST	1.1.1.1	192.168.2.5	0x366a	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.48	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:30:59.214591980 CEST	1.1.1.1	192.168.2.5	0x9196	No error (0)	tstdmn.cc		34.92.211.102	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.284842968 CEST	1.1.1.1	192.168.2.5	0xb762	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:00.421425104 CEST	1.1.1.1	192.168.2.5	0x394d	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:00.421425104 CEST	1.1.1.1	192.168.2.5	0x394d	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.58	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.421425104 CEST	1.1.1.1	192.168.2.5	0x394d	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.8	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.421425104 CEST	1.1.1.1	192.168.2.5	0x394d	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.17	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.421425104 CEST	1.1.1.1	192.168.2.5	0x394d	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.26	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.888413906 CEST	1.1.1.1	192.168.2.5	0x7f89	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:00.888413906 CEST	1.1.1.1	192.168.2.5	0x7f89	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.104	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.888413906 CEST	1.1.1.1	192.168.2.5	0x7f89	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.108	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.888413906 CEST	1.1.1.1	192.168.2.5	0x7f89	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.31	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.888413906 CEST	1.1.1.1	192.168.2.5	0x7f89	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.48	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:00.964365959 CEST	1.1.1.1	192.168.2.5	0xd4e9	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:01.942616940 CEST	1.1.1.1	192.168.2.5	0xe51f	No error (0)	tstdmn.cc		34.92.211.102	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:01.944976091 CEST	1.1.1.1	192.168.2.5	0x22cb	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:02.035227060 CEST	1.1.1.1	192.168.2.5	0x184f	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:02.035227060 CEST	1.1.1.1	192.168.2.5	0x184f	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		99.83.207.187	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:02.035227060 CEST	1.1.1.1	192.168.2.5	0x184f	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		75.2.42.240	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:04.062279940 CEST	1.1.1.1	192.168.2.5	0x7c08	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:04.098531961 CEST	1.1.1.1	192.168.2.5	0x266f	No error (0)	09i32g.uuie34661.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:04.098531961 CEST	1.1.1.1	192.168.2.5	0x266f	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		75.2.42.240	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:04.098531961 CEST	1.1.1.1	192.168.2.5	0x266f	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		99.83.207.187	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:04.164508104 CEST	1.1.1.1	192.168.2.5	0x2b66	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:31:04.164508104 CEST	1.1.1.1	192.168.2.5	0x2b66	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:14.362675905 CEST	1.1.1.1	192.168.2.5	0x9f9c	Name error (3)	sb-hk.bc.bangbanged.com	none	none	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:14.391861916 CEST	1.1.1.1	192.168.2.5	0xad16	Name error (3)	sb-hk.bc.bangbanged.com	none	none	65	IN (0x0001)	false
Sep 29, 2024 04:31:14.542339087 CEST	1.1.1.1	192.168.2.5	0x6151	Name error (3)	sb-hk.bc.bangbanged.com	none	none	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:27.784882069 CEST	1.1.1.1	192.168.2.5	0x7f2	Name error (3)	sb-hk.bc.bangbanged.com	none	none	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:48.783796072 CEST	1.1.1.1	192.168.2.5	0xd3ef	Name error (3)	sb-hk.bc.bangbanged.com	none	none	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:51.713107109 CEST	1.1.1.1	192.168.2.5	0x1cab	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:31:51.713107109 CEST	1.1.1.1	192.168.2.5	0x1cab	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.770545959 CEST	1.1.1.1	192.168.2.5	0xec8c	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:11.770545959 CEST	1.1.1.1	192.168.2.5	0xec8c	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.48	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.770545959 CEST	1.1.1.1	192.168.2.5	0xec8c	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.31	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.770545959 CEST	1.1.1.1	192.168.2.5	0xec8c	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.108	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.770545959 CEST	1.1.1.1	192.168.2.5	0xec8c	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.104	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.774908066 CEST	1.1.1.1	192.168.2.5	0x3cc5	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:11.774908066 CEST	1.1.1.1	192.168.2.5	0x3cc5	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.26	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.774908066 CEST	1.1.1.1	192.168.2.5	0x3cc5	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.8	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.774908066 CEST	1.1.1.1	192.168.2.5	0x3cc5	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.17	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.774908066 CEST	1.1.1.1	192.168.2.5	0x3cc5	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.58	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:11.851234913 CEST	1.1.1.1	192.168.2.5	0x1c30	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:11.940761089 CEST	1.1.1.1	192.168.2.5	0xffe3	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:12.880465984 CEST	1.1.1.1	192.168.2.5	0x32d7	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:12.880465984 CEST	1.1.1.1	192.168.2.5	0x32d7	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.48	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:12.880465984 CEST	1.1.1.1	192.168.2.5	0x32d7	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.108	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:12.880465984 CEST	1.1.1.1	192.168.2.5	0x32d7	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.104	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:12.880465984 CEST	1.1.1.1	192.168.2.5	0x32d7	No error (0)	d34q2tfh9x1bdu.cloudfront.net		3.160.150.31	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:12.997947931 CEST	1.1.1.1	192.168.2.5	0xb100	No error (0)	a8rmire3rz.mf6gaikb.com	d34q2tfh9x1bdu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:13.062982082 CEST	1.1.1.1	192.168.2.5	0xc90a	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:13.144635916 CEST	1.1.1.1	192.168.2.5	0x6cff	No error (0)	lwesoes.qute89uupg.com	d3u63bha7c9iam.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 04:32:13.144635916 CEST	1.1.1.1	192.168.2.5	0x6cff	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.26	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:13.144635916 CEST	1.1.1.1	192.168.2.5	0x6cff	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.8	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:13.144635916 CEST	1.1.1.1	192.168.2.5	0x6cff	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.58	A (IP address)	IN (0x0001)	false
Sep 29, 2024 04:32:13.144635916 CEST	1.1.1.1	192.168.2.5	0x6cff	No error (0)	d3u63bha7c9iam.cloudfront.net		18.245.86.17	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 04:30:37.006891966 CEST	431	OUT	GET / HTTP/1.1 Host: www.3659vip4.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 29, 2024 04:30:37.895909071 CEST	417	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 02:30:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate Content-Encoding: gzip Data Raw: 36 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 b3 c9 4d 2d 49 54 c8 28 29 29 d0 4d 2d 2c cd 2c b3 55 2a 4a 4d 2b 4a 2d ce 50 52 48 ce cf 2b 49 cd 2b b1 55 32 b0 2e 2d ca b1 05 a9 29 b6 d2 d7 2f 2f 2f d7 33 36 33 b5 2c cb 2c 30 d1 4b ce cf b5 b2 b0 b4 b0 d4 57 b2 b3 d1 07 1b c8 05 00 9e 18 58 90 58 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 67(M-IT())M-,,U*JM+J-PRH+I+U2.-)///363,,0KWXX0
Sep 29, 2024 04:30:38.439342022 CEST	376	OUT	GET /favicon.ico HTTP/1.1 Host: www.3659vip4.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.3659vip4.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 29, 2024 04:30:38.746917009 CEST	729	IN	HTTP/1.1 404 Not Found Date: Sun, 29 Sep 2024 02:30:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 552 Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.3659vip4.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Windows Analysis Report
http://www.3659vip4.com/

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:41 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 02:30:41 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=137661 Date: Sun, 29 Sep 2024 02:30:41 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:42 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 02:30:42 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=137690 Date: Sun, 29 Sep 2024 02:30:42 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-29 02:30:42 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:43 UTC	573	OUT	GET /ftl/commonPage/themes/gui-base.css HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.3659vip4.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:43 UTC	679	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 17137 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: W/"66bc0c2d-145e6" Date: Thu, 26 Sep 2024 03:50:50 GMT Last-Modified: Wed, 14 Aug 2024 01:45:17 GMT Expires: Sat, 26 Oct 2024 03:50:50 GMT Age: 254393 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-211 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-04 X-Cdn-Request-ID: 6630da8a365fdd39dc02e0fdc0d89c1f
2024-09-29 02:30:43 UTC	15705	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 79 93 e4 c6 75 e7 ff fa 14 50 33 18 9c 21 ab 8a 00 ea ee 0a 4e 88 94 ad 23 2c d9 5e 51 d6 1e 14 83 81 02 b2 aa c0 41 01 25 00 d5 07 3b ca a1 f0 5a 22 ad b5 0e cb b2 b4 3a bc a2 7c 2d ad 90 e4 db 26 45 4a fe 32 ec 99 e1 5f fe 0a ce 1b 79 bc 44 a1 7b 64 ef 76 93 d3 55 99 bf 7c f9 f2 bd 97 2f ef cc 67 9f fe f0 87 bc a7 bd 8f 47 5b f4 42 71 f1 3b 9f ec bf 10 55 c8 bb 73 fd c3 9f 3f fc d1 17 3f f8 9f 6f 5d bf f1 e5 bb 04 70 86 ca 2a 2d 72 2f 18 f8 83 39 09 78 7e 5f 6f 8a f2 d4 7b b1 46 67 28 27 21 bf 16 d5 c8 db 16 49 ba 4a 51 e2 85 7e 30 ed fb f3 be 1f e2 b8 67 3f f4 ec d3 de c3 9f ff d9 f5 1f 7e e9 c1 9b ff 72 fd de d7 49 d0 47 d2 ed ae 28 6b 6f 5f 66 77 4e 36 45 be 5e 46 c5 20 ae aa 93 bb 0b 02 bf fe d2 5b d7 7f f7 c5 eb Data Ascii: }yuP3!N#,^QA%;Z":\|-&EJ2_yD{dvU\|/gG[Bq;Us??o]p*-r/9x~_o{Fg('!IJQ~0g?~rIG(ko_fwN6E^F [
2024-09-29 02:30:43 UTC	1432	IN	Data Raw: 06 8f b8 fd df a7 7d fc 2f ee d6 28 9a ef 2b ab e2 9e 0a 12 ad 88 d7 b9 74 10 fb 78 08 fe 9f c9 87 6e 15 64 fc ff 1f 9d e3 6d f5 6a 08 e6 3f 4b a9 d8 81 fa d6 e0 05 bb 5d e6 75 57 78 e0 bb 79 f0 f5 6f be ff ee 3f 3f f8 fa 37 3e f8 f2 37 ff ed bd ef 11 b7 cb fa 24 fd 3a dd e9 be d6 f7 e7 2b b4 92 1e 7f 48 6e ac 50 fa 41 0b 55 11 ea d0 93 21 d5 de 05 3f 98 ad dd 89 42 5b 05 45 5e a4 c0 0d 27 83 28 c3 7e 4d ba 2a df d3 a3 95 0b 46 9a ab 45 3c be b5 47 87 7a 3b 68 2c 00 0f 6f f4 84 03 fc 8f b4 96 db 12 89 14 7b 55 07 37 6a a7 85 ca ab 25 6f fa 85 ec fc 82 da 19 ae 91 c9 58 1d 93 8d e8 37 6a 6f 64 12 53 f4 b3 fb 2c 5c cc 4c 10 35 fa 52 8d e4 b3 35 f0 75 b0 24 8e 8f 48 c6 ec 51 b0 9a 92 ed e2 b1 6d 84 1a e7 fb bf f8 e3 47 bf f7 f7 78 40 83 07 20 1f 7c f1 f7 ae Data Ascii: }/(+txndmj?K]uWxyo??7>7$:+HnPAU!?B[E^'(~M*FE<Gz;h,o{U7j%oX7jodS,\L5R5u$HQmGx@ \|

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:43 UTC	581	OUT	GET /ftl/commonPage/themes/gui-skin-default.css HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.3659vip4.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:43 UTC	677	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 6253 Connection: close Server: Default-server-KS-CLOUD-XJP-12-07 ETag: W/"64ad1569-7b6e" Date: Thu, 19 Sep 2024 23:00:41 GMT Last-Modified: Tue, 11 Jul 2023 08:40:09 GMT Expires: Sat, 19 Oct 2024 23:00:41 GMT Age: 790202 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-213 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-07 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-09 X-Cdn-Request-ID: f4de5806b97abd36d7817abaf05573db
2024-09-29 02:30:43 UTC	6253	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 8f 1c c7 71 df f5 2b c6 14 08 de f1 6e 96 b3 cf bb dd 05 0f 3e 92 47 8a 72 68 4b 7c 58 24 65 7d 98 9d e9 dd 1d 71 76 66 31 33 cb bb e3 e2 00 05 49 04 2b 8e f3 70 92 0f 81 23 20 8c 11 c3 5f ec 0f 09 02 24 91 6d fd 97 c0 a4 c4 4f fe 0b e9 e7 4c 3f 6a 1e 7b 52 00 11 d0 1d a5 9b ed ae ae ae aa ae ae ae ae ae e9 fd e3 67 9f 5f b9 fc 9d 37 ac cb d6 2d 77 81 ae c5 27 0f 6e db f7 9e 04 91 7d 03 4d dd 55 98 59 5b af 7e f1 d7 2f ff e5 b7 af fe ec 57 2f 7e fc f1 1f 7f fb c9 ff 7e f4 0f f8 df 17 ff f4 bb 2f 3f f9 f7 2f fe e3 33 56 4b da 3f 45 49 1a c4 91 d5 6e 39 ad 21 29 38 5c 65 f3 38 19 59 f7 32 f4 14 45 a4 e4 86 9b 21 6b 11 fb c1 34 40 be d5 71 da 7b b6 33 b4 3b 6d 5c 77 85 50 71 35 ff b1 fc 24 5e fa f1 71 94 5a 7f f8 af 9f Data Ascii: =kq+n>GrhK\|X$e}qvf13I+p# _$mOL?j{Rg_7-w'n}MUY[~/W/~~/?/3VK?EIn9!)8\e8Y2E!k4@q{3;m\wPq5$^qZ

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:43 UTC	579	OUT	GET /ftl/bet365-141-2/themes/style/common.css HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.3659vip4.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:43 UTC	694	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 12593 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-05 ETag: W/"65138f5d-d024" Date: Thu, 19 Sep 2024 23:00:42 GMT Last-Modified: Wed, 27 Sep 2023 02:11:41 GMT Expires: Sat, 19 Oct 2024 23:00:42 GMT Age: 790201 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-213 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-05 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-10 X-Cdn-Request-ID: 6cda31f5d59c9d65749b40508eb3906b
2024-09-29 02:30:43 UTC	12593	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 6b 93 1c c7 91 d8 67 e1 57 d4 01 81 20 96 de 19 f4 73 1e bb c1 0d 63 01 2c 29 4a 14 49 80 14 45 86 23 10 3d 33 3d 3b 2d cc 4b 33 bd 00 96 13 88 10 2d eb 4e 2f 8a a7 90 e8 b3 2d 9d 2d 39 ac 3b 5a 71 d6 c3 b2 e4 13 75 d2 fd 19 2e 40 7c ba bf e0 ca 7a 66 3d ba 7b 16 60 38 6e 47 14 66 ba ab b2 b2 aa b2 b2 f2 55 59 ff f2 c7 7f be fa fc 5f 5c 20 cf 93 c3 bc 8c 3b 29 7c bb 76 52 4e 16 ab 3d 72 bb cc ef e5 73 78 f2 e6 72 94 95 39 19 9c 92 28 08 bb ad 20 6a 45 01 7d 7e f5 c2 85 ab cf 93 c7 7f f7 de e3 1f 7d 74 f6 c3 f7 cf 3e fe 11 3c 6b 0f 17 f3 32 2b e6 f9 aa 35 9e 9e 14 a3 5d fd 60 73 bf 18 95 93 bd 7e 2f 58 3e 78 78 e1 df ce f2 51 91 91 2b b3 62 de 12 2f fa f4 c5 ce e6 02 a1 7f 4e ad 30 8e d3 e5 83 fd 87 17 7c 35 c3 28 d8 ae Data Ascii: }kgW sc,)JIE#=3=;-K3-N/--9;Zqu.@\|zf={`8nGfUY_\ ;)\|vRN=rsxr9( jE}~}t><k2+5]`s~/X>xxQ+b/N0\|5(

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:43 UTC	589	OUT	GET /ftl/bet365-141-2/themes/style/swiper-4.3.3.min.css HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.3659vip4.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:43 UTC	676	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 19773 Connection: close Server: Default-server-KS-CLOUD-XJP-12-07 ETag: "6153e3b6-4d3d" Date: Thu, 26 Sep 2024 03:50:50 GMT Last-Modified: Wed, 29 Sep 2021 03:55:34 GMT Expires: Sat, 26 Oct 2024 03:50:50 GMT Age: 254393 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-211 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-07 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-03 X-Cdn-Request-ID: b3c398123ecd4425078fff6a7701cf26
2024-09-29 02:30:43 UTC	15708	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 53 77 69 70 65 72 20 34 2e 33 2e 33 0a 20 2a 20 4d 6f 73 74 20 6d 6f 64 65 72 6e 20 6d 6f 62 69 6c 65 20 74 6f 75 63 68 20 73 6c 69 64 65 72 20 61 6e 64 20 66 72 61 6d 65 77 6f 72 6b 20 77 69 74 68 20 68 61 72 64 77 61 72 65 20 61 63 63 65 6c 65 72 61 74 65 64 20 74 72 61 6e 73 69 74 69 6f 6e 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 69 64 61 6e 67 65 72 6f 2e 75 73 2f 73 77 69 70 65 72 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 2d 32 30 31 38 20 56 6c 61 64 69 6d 69 72 20 4b 68 61 72 6c 61 6d 70 69 64 69 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 6f 6e 3a 20 4a 75 6e 65 20 35 2c 20 32 30 31 Data Ascii: /** * Swiper 4.3.3 * Most modern mobile touch slider and framework with hardware accelerated transitions * http://www.idangero.us/swiper/ * * Copyright 2014-2018 Vladimir Kharlampidi * * Released under the MIT License * * Released on: June 5, 201
2024-09-29 02:30:43 UTC	4065	IN	Data Raw: 27 25 32 30 79 31 25 33 44 27 37 27 25 32 30 79 32 25 33 44 27 32 37 27 25 32 30 73 74 72 6f 6b 65 25 33 44 27 25 32 33 66 66 66 27 25 32 30 73 74 72 6f 6b 65 2d 77 69 64 74 68 25 33 44 27 31 31 27 25 32 30 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 25 33 44 27 72 6f 75 6e 64 27 25 32 46 25 33 45 25 33 43 25 32 46 64 65 66 73 25 33 45 25 33 43 67 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 32 37 27 25 32 46 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 32 37 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 6f 74 61 74 65 28 33 30 25 32 30 36 30 25 32 43 36 Data Ascii: '%20y1%3D'7'%20y2%3D'27'%20stroke%3D'%23fff'%20stroke-width%3D'11'%20stroke-linecap%3D'round'%2F%3E%3C%2Fdefs%3E%3Cg%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.27'%2F%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.27'%20transform%3D'rotate(30%2060%2C6

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:43 UTC	593	OUT	GET /ftl/bet365-141-2/themes/style/bootstrap-dialog.min.css HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.3659vip4.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:43 UTC	674	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2780 Connection: close Server: Default-server-KS-CLOUD-XJP-12-07 ETag: "6153e3b6-adc" Date: Sun, 01 Sep 2024 04:28:33 GMT Last-Modified: Wed, 29 Sep 2021 03:55:34 GMT Expires: Tue, 01 Oct 2024 04:28:33 GMT Age: 2412130 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-213 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: HIT from KS-CLOUD-XJP-12-07 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-17 X-Cdn-Request-ID: a8e75b0db622afa36f0344d07e1e9d74
2024-09-29 02:30:43 UTC	2780	IN	Data Raw: 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 6d 6f 64 61 6c 2d 68 65 61 64 65 72 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 20 34 70 78 0a 7d 0a 0a 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 2d 74 69 74 6c 65 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 0a 7d 0a 0a 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 2d 6d 65 73 73 61 67 65 20 Data Ascii: .bootstrap-dialog .modal-header { border-top-left-radius: 4px; border-top-right-radius: 4px}.bootstrap-dialog .bootstrap-dialog-title { color: #fff; text-align: center; font-size: 18px}.bootstrap-dialog .bootstrap-dialog-message

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:43 UTC	570	OUT	GET /ftl/commonPage/js/jquery/jquery-1.11.3.min.js HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.3659vip4.com:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:43 UTC	723	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 33545 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-05 ETag: W/"5d848f4f-176d4" Date: Thu, 26 Sep 2024 14:19:06 GMT Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT Expires: Sat, 26 Oct 2024 14:19:06 GMT Age: 216697 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-204 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-05 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-08 X-Cdn-Request-ID: 3f20cb6ce9ec747cfcd75da85d6e7a3d
2024-09-29 02:30:43 UTC	15661	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd 79 7b e3 c6 b1 2e fe ff f9 14 22 e2 43 03 c3 16 25 8e ed dc 13 70 20 3e b6 c7 8e ed 78 4b 66 1c 3b a1 68 3f d8 48 42 e2 26 92 1a 8d 2c 32 9f fd d6 5b d5 dd 68 2c 1c 3b e7 dc df f2 5c 27 23 62 69 f4 5a 5d 5b d7 72 f1 ac 73 76 f3 d7 fb 7c fb 78 f6 66 d0 1f 0c fa 1f 9c 1d ce fc 34 38 7b 7e 79 f9 91 a2 bf 83 8f cc fb cf d7 f7 ab 2c de 17 eb 95 3a fb 72 95 f6 a9 e0 cd 1d de f4 d7 db d9 c5 a2 48 f3 d5 2e 3f 7b 76 f1 1f 9d e9 fd 2a 45 39 3f 56 49 f0 e4 ad 93 9b 3c dd 7b 51 b4 7f dc e4 eb e9 d9 72 9d dd 2f f2 6e f7 c4 8b 7e fe 76 b3 de ee 77 a3 ea 6d 14 f7 b3 75 7a bf cc 57 fb 51 42 35 77 2e 83 b0 6c 28 78 2a a6 7e a7 2c 12 ec e7 db f5 c3 d9 2a 7f 38 fb 6c bb 5d 6f 7d 4f 8f 62 9b df dd 17 db 7c 77 16 9f 3d 14 ab 8c ca 3c 14 fb Data Ascii: y{."C%p >xKf;h?HB&,2[h,;\'#biZ][rsv\|xf48{~y,:rH.?{vE9?VI<{Qr/n~vwmuzWQB5w.l(x~,*8l]o}Ob\|w=<
2024-09-29 02:30:43 UTC	16384	IN	Data Raw: 9a 80 38 72 f6 51 e9 90 61 e0 db 8e e8 5d df 79 bd cc ca 8b 3d 68 12 92 9c a8 76 7e bf 92 65 72 b9 96 aa c7 56 19 1f 47 b8 17 e8 0c c1 77 15 ab 78 a1 95 88 7e ed 49 5f 5a e7 43 2a fb 1d cc eb d4 ae 58 de 2f 2a 6e 90 5a 95 27 fb 3d 2f 35 b5 0e 15 82 d1 08 6b 2b 62 55 ec 5e e9 1a 38 a5 43 a5 55 c2 af c7 60 98 8d 6a 62 84 9f 9b ec ca 4d f5 b7 56 7c c0 59 ed 84 b4 94 36 f8 41 e0 4b 57 3f 14 b5 3a db 8c aa 03 04 af dd 52 0a 73 d9 e6 7a c3 46 75 f5 44 dc a5 e7 b7 1c 22 0d 2b be 36 b4 0a 5a 9d 11 4b 26 6a 18 f6 f3 a5 48 61 55 c7 1c 88 fa 01 06 22 43 68 25 2c 00 b8 4a c4 2b 29 3c f2 d9 cf 8f 8f 15 04 28 2b ab 60 62 34 b1 28 aa f9 1c 7e d0 9c df c8 86 82 b4 8f 1c 64 d3 7c 29 b3 55 42 16 58 f6 51 1c 87 89 89 e2 25 6d c2 3d dc 82 11 6f b4 44 87 47 b0 a4 3a 92 21 98 Data Ascii: 8rQa]y=hv~erVGwx~I_ZCX/nZ'=/5k+bU^8CU`jbMV\|Y6AKW?:RszFuD"+6ZK&jHaU"Ch%,J+)<(+`b4(~d\|)UBXQ%m=oDG:!
2024-09-29 02:30:43 UTC	1500	IN	Data Raw: 10 8a f0 1d fc 3a 24 1c 56 49 32 0c d0 40 a1 6c 03 b6 3a bd 60 32 1b f4 58 f8 11 56 f8 41 42 07 2c 92 20 45 5d 66 05 74 19 f1 c7 a2 ad 79 09 69 17 74 9e 93 c6 6c 15 0d 19 9b 99 35 23 00 d3 d9 85 c4 c3 01 f3 94 c2 f4 79 15 ed 11 8f 15 69 21 dd c4 69 05 c3 4a e3 3e 5f 1d cd 17 eb 23 6c 23 e6 9c 4f 68 0a 76 2a 9c 92 54 18 a8 ec 91 be 82 84 bc 0a 6a 9e 38 65 fb 9d 1a b7 f8 79 97 02 4c 12 f3 f0 c2 c9 2d 1b 93 f5 41 fb 54 86 96 d9 44 bc 9a d8 b9 87 7f fc ba 33 61 4e dd 24 ad 5d 80 17 0b a7 fc 18 81 ac 23 c3 0e f2 7c 42 46 69 1d c1 bc 45 4f 3c 0f f4 c4 5b 8d a0 b4 22 2e 60 3b ab a9 7c 12 75 5c 30 f5 21 c6 e6 10 7a 70 dc 3c b4 61 c5 c6 d9 b0 68 80 55 c4 e0 8e 47 09 07 06 28 36 04 2b 5e 2e f3 09 7f a1 e3 c7 e4 ae f8 2d 15 1a 9f 26 81 66 43 03 a6 0e 46 76 53 2d 27 Data Ascii: :$VI2@l:`2XVAB, E]ftyitl5#yi!iJ>_#l#Ohv*Tj8eyL-ATD3aN$]#\|BFiEO<[".`;\|u\0!zp<ahUG(6+^.-&fCFvS-'

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:44 UTC	605	OUT	GET /ftl/commonPage/themes/hongbao.css HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dxext9.innittapp.com/ftl/commonPage/themes/gui-base.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:45 UTC	693	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5666 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-01 ETag: W/"64252e4f-d530" Date: Thu, 19 Sep 2024 23:00:43 GMT Last-Modified: Thu, 30 Mar 2023 06:38:07 GMT Expires: Sat, 19 Oct 2024 23:00:43 GMT Age: 790202 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-212 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-01 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-03 X-Cdn-Request-ID: 9177346c0be5e133de9387a5c23fe1d7
2024-09-29 02:30:45 UTC	5666	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5d 7b 8f dc d6 75 ff df 9f 82 85 61 44 16 c4 59 92 b3 b3 4f a4 30 92 d8 a8 5b 20 30 da f4 81 fe b3 e0 ce 70 76 18 71 87 83 19 ae 56 6b 41 40 d2 d8 75 ad 2a 51 9b 36 51 9a c4 68 15 c4 8a 9a c2 8f c2 8e 65 2b 86 fd 65 34 fb f8 16 bd 7c 9f 4b de 7b 79 cf bd 77 bc 56 25 41 da 99 e1 f0 fc ce fb 9c 1f 39 a3 b5 ab af 7d fb e2 e1 cf 2f 1e fc 61 f9 f9 67 67 bf bf bf fc ec cb e5 bf de 39 fd af c7 cb cf ef d9 fb c1 41 38 bd ba f6 5c 6f 18 1f da fe e8 46 30 4f c2 45 70 18 4c 13 fb 78 ee cf 7a 91 7f 72 14 da e4 ef 60 6e dd b2 f6 fd e1 f5 83 79 7c 34 1d d9 c3 38 8a e7 3b d6 f3 e3 f1 d8 fa 93 f0 70 16 cf 13 7f 9a ec 5a b7 a5 4e 05 1f d8 8b 20 39 0e a7 f4 73 c3 28 5e 04 a9 c4 78 3e 4a 1f 16 d2 bc 51 fa 7b d7 6a 3e 66 49 25 ef 1e 85 8b 19 Data Ascii: ]{uaDYO0[ 0pvqVkA@u*Q6Qhe+e4\|K{ywV%A9}/agg9A8\oF0OEpLxzr`ny\|48;pZN 9s(^x>JQ{j>fI%

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:30:44 UTC	607	OUT	GET /ftl/commonPage/themes/gui-layer.css HTTP/1.1 Host: dxext9.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dxext9.innittapp.com/ftl/commonPage/themes/gui-base.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:30:45 UTC	692	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 6923 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-05 ETag: W/"64ddd5e1-c760" Date: Thu, 19 Sep 2024 23:00:43 GMT Last-Modified: Thu, 17 Aug 2023 08:10:09 GMT Expires: Sat, 19 Oct 2024 23:00:43 GMT Age: 790202 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-212 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-05 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-08 X-Cdn-Request-ID: 861f2fc4115dae6eb06ada82abf139b3
2024-09-29 02:30:45 UTC	6923	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5d 7b 8f 23 c7 71 ff 5f 9f 62 b2 82 e0 3b eb 86 37 1c 92 bb cb 25 64 24 b6 7c 96 1c 2b 09 22 29 7e c1 20 86 64 93 1c 2d 39 43 cd 0c 6f 6f 45 08 f0 de 29 88 6c 39 b1 13 e4 22 cb b0 0d 39 39 c5 71 12 01 c2 39 81 57 51 f2 97 85 7c 8e 35 36 96 60 e9 f2 1d d2 8f e9 99 7e ce 8b 33 7b 7b 11 4f 77 f3 ec aa ae ae ae ae fa 75 75 cf ef 8f e7 4e 10 82 c8 d8 79 f1 85 1b e6 fe ce e0 b1 d6 c2 39 5e bb 26 fc 1b 04 c6 c6 18 fb 0b 3f 38 30 1e ef 74 3a 03 63 ea 7b 91 19 ba af 80 03 a3 dd 5d dd 1a 18 23 67 7c 38 0b fc b5 37 31 e3 07 a3 c0 f1 c2 95 13 00 2f 32 7e cf 5d ae fc 20 72 bc 68 60 bc ca 17 cc 9e 98 a3 c8 83 94 56 ce 64 e2 7a b3 03 c3 32 da bd d5 2d c3 b6 78 0a 90 89 e9 74 0a af f8 c1 04 bd e4 47 91 bf 34 17 60 1a 99 81 33 71 d7 e1 81 Data Ascii: ]{#q_b;7%d$\|+")~ d-9CooE)l9"99q9WQ\|56`~3{{OwuuNy9^&?80t:c{]#g\|871/2~] rh`Vdz2-xtG4`3q