Edit tour

Windows Analysis Report
http://www.38cp66.cc/

Overview

General Information

Sample URL:	http://www.38cp66.cc/
Analysis ID:	1526895
Tags:	openphish
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2468,i,13305547606425600634,3323756394529779268,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.38cp66.cc/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /visitor.ashx?siteId=60003589 HTTP/1.1Host: 336.439dddd3dg.comConnection: keep-aliveContent-Length: 69sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://www.38cp66.cc:8989Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.38cp66.cc:8989/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://www.38cp66.cc:8989/	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.38cp66.cc:8989/sports.html?apiId=21	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.38cp66.cc:8989/chess.html?apiType=5&apiId=111	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.38cp66.cc:8989/	HTTP Parser: Total embedded image size: 5907861
Source: https://www.38cp66.cc:8989/sports.html?apiId=21	HTTP Parser: Total embedded image size: 257566

Source: https://www.38cp66.cc:8989/	HTTP Parser: Title: bet365 -No.1 does not match URL
Source: https://www.38cp66.cc:8989/sports.html?apiId=21	HTTP Parser: Title: bet365 -No.1 does not match URL
Source: https://www.38cp66.cc:8989/chess.html?apiType=5&apiId=111	HTTP Parser: Title: bet365 -No.1 does not match URL

Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="author".. found
Source: https://www.38cp66.cc:8989/sports.html?apiId=21	HTTP Parser: No <meta name="author".. found
Source: https://www.38cp66.cc:8989/chess.html?apiType=5&apiId=111	HTTP Parser: No <meta name="author".. found

Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.38cp66.cc:8989/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.38cp66.cc:8989/sports.html?apiId=21	HTTP Parser: No <meta name="copyright".. found
Source: https://www.38cp66.cc:8989/chess.html?apiType=5&apiId=111	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50319 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	DNS traffic detected: DNS query: www.38cp66.cc
Source: global traffic	DNS traffic detected: DNS query: _8989._https.www.38cp66.cc
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: o1tyg6.innittapp.com
Source: global traffic	DNS traffic detected: DNS query: psowoexvd.n2vu8zpu2f6.com
Source: global traffic	DNS traffic detected: DNS query: 336.439dddd3dg.com
Source: global traffic	DNS traffic detected: DNS query: vue.livehelp100servicestandby.com
Source: global traffic	DNS traffic detected: DNS query: player.opgoalde.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: kngx/1.10.2Date: Sun, 06 Oct 2024 15:39:47 GMTContent-Type: text/htmlContent-Length: 570Connection: closeKs-Deny-Reason: secure-time-arg-time-not-foundX-Cdn-Request-ID: 84bfb54316b13c4b67ae817f07b4fb77x-link-via: xjp21:443;
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 06 Oct 2024 15:40:05 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 06 Oct 2024 15:40:08 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found, conatact supportServer: CloudFrontDate: Sun, 06 Oct 2024 15:40:14 GMTContent-Length: 0Connection: closeX-Cache: FunctionGeneratedResponse from cloudfrontVia: 1.1 e016ea20838aeed1d878a5244c9e2552.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P6X-Amz-Cf-Id: YvWg5ub12do9S7muB8vb7ucW923-yzTa-st-T_miTf62v5HeXm_24g==
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 06 Oct 2024 15:40:42 GMTContent-Type: text/htmlContent-Length: 520Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: kngx/1.10.2Date: Sun, 06 Oct 2024 15:40:45 GMTContent-Type: text/htmlContent-Length: 570Connection: closeKs-Deny-Reason: secure-time-arg-time-not-foundX-Cdn-Request-ID: 6fc0b917e4743c44ed3241eeee9f6de5x-link-via: xjp21:443;

Source: chromecache_383.2.dr, chromecache_212.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_440.2.dr	String found in binary or memory: http://www.idangero.us/swiper/
Source: chromecache_389.2.dr	String found in binary or memory: https://336.439dddd3dg.com
Source: chromecache_479.2.dr	String found in binary or memory: https://3656fkapp.com/xiazai.html
Source: chromecache_512.2.dr, chromecache_479.2.dr	String found in binary or memory: https://365kkf.cc/
Source: chromecache_512.2.dr, chromecache_479.2.dr	String found in binary or memory: https://365pina.cc:8989/
Source: chromecache_398.2.dr, chromecache_389.2.dr	String found in binary or memory: https://678.439dddd3dg.com
Source: chromecache_398.2.dr, chromecache_389.2.dr	String found in binary or memory: https://899.439dddd3dg.com/fileservice/v1
Source: chromecache_512.2.dr, chromecache_479.2.dr	String found in binary or memory: https://b.3656azjul11.cc:8989/verify-page/index.html
Source: chromecache_512.2.dr, chromecache_479.2.dr	String found in binary or memory: https://b.365jul10.com:8989/
Source: chromecache_398.2.dr, chromecache_389.2.dr	String found in binary or memory: https://psowoexvd.n2vu8zpu2f6.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2468,i,13305547606425600634,3323756394529779268,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.38cp66.cc/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2468,i,13305547606425600634,3323756394529779268,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: chromecache_297.2.dr, chromecache_231.2.dr	Binary or memory string: I/MiMTmSrilSngfrheUTlDZTRC9uFHXiRAScJlqV/NyU7RBjeaNyxVheCzP4pf7hD5QEMuAHiCXW
Source: chromecache_554.2.dr	Binary or memory string: VnXcooWjNMlgan1rGi7U7iDnZBUXEqWFmB8oxbjcLsk9NfkgWuTYbXN8keJOaLFN4nfZRVMcidFB
Source: chromecache_439.2.dr	Binary or memory string: Ag+23nSoK7qgJt4eV6kgjYCpANB9lAERkjhxoA9CT8JoD//Xw1jxNAHgfsoB1xwsLW9lAFb1DA4X

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
103.155.16.134	l5-global.gslb.ksyuncdn.com	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
75.2.42.240	a48d7a3baeaba2a67.awsglobalaccelerator.com	United States	16509	AMAZON-02US	false
13.225.78.104	d2fbug8oy6zx3g.cloudfront.net	United States	16509	AMAZON-02US	false
108.138.7.52	d30ye5lgbv8wkd.cloudfront.net	United States	16509	AMAZON-02US	false
20.239.97.157	cluster91f2e088.hysjs168.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
d2fbug8oy6zx3g.cloudfront.net	13.225.78.104	true	false	unknown
l5-global.gslb.ksyuncdn.com	103.155.16.134	true	false	unknown
cluster91f2e088.hysjs168.com	20.239.97.157	true	false	unknown
www.google.com	142.250.186.36	true	false	unknown
a48d7a3baeaba2a67.awsglobalaccelerator.com	75.2.42.240	true	false	unknown
d30ye5lgbv8wkd.cloudfront.net	108.138.7.52	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
o1tyg6.innittapp.com	unknown	unknown	false	unknown
vue.livehelp100servicestandby.com	unknown	unknown	false	unknown
player.opgoalde.com	unknown	unknown	false	unknown
_8989._https.www.38cp66.cc	unknown	unknown	false	unknown
www.38cp66.cc	unknown	unknown	false	unknown
336.439dddd3dg.com	unknown	unknown	false	unknown
psowoexvd.n2vu8zpu2f6.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-cr.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/images/api-tabs-sprite-black.png	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-silver.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-gray01.png.base64	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/floatImage/230/1727320957925.gif.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/index-chess.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-sb.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/icon-sprite-desktop.svg?v=2.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/theme/default/layer.css?v=3.1.0	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/gui-skin-default.css	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery-1.11.3.min.js	false	unknown
https://psowoexvd.n2vu8zpu2f6.com/livechat.ashx?siteId=60003589	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-fb.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-white.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/betNow.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/gui-base.js	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/layer.js	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/inco2.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/float.js	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10301/1726506503813.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-03.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery.nicescroll.min.js	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/jquery.raty.css	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10248/1705841616831.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-bti.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl//commonPage/themes/images/hongbao/icon-close-1.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/jquery/jquery.super-marquee.js	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/body-bg.gif.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-brown01.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/bg-products.gif.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-04.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl//commonPage/commonContent/nav/images/navbar-sub-sprite2.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/play.png.base64	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/sportTeam/3/1661264943628.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/style/common.css	false	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/it08.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/hb/css/pc.css	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10369/1718644154338.jpg.base64	false	unknown
https://psowoexvd.n2vu8zpu2f6.com/visitorside/js/common.14cb3f7d.js	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/favicon/favicon_627.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/fish_btn.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/icon_match_prev.png.base64	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10383/1695644169263.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/logo-foot.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl//commonPage/commonContent/nav/images/icon-menu-api.png.base64	false	unknown
https://www.38cp66.cc:8989/	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/idangerous.swiper.css	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/game-casino.css	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/index-game.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl//commonPage/commonContent/nav/images/icon-menu-api-chess.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-06.png.base64	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/carousel/10182/1694949241591.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-gold.png.base64	false	unknown
https://o1tyg6.innittapp.com/fserver/files/gb/627/floatImage/225/1704100920201.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/sports-infos-bg.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-07.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/moment.js	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-ai.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/js/websocket/CometMarathon.js	false	unknown
https://o1tyg6.innittapp.com/061410/rcenter/common/static/js/gb.validation.min.js?v=1727683641781	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-hg.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-black.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-pm.jpg.base64	false	unknown
https://336.439dddd3dg.com/visitor.ashx?siteId=60003589&visitorGuid=6fd493f7-4397-41b4-8eff-3070edb18e6e	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/imagehover.min.css	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/style/bootstrap-dialog.min.css	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-im.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/images/loading.gif	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-purple-02.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-05.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-08.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/images/partner/partner-hongtu-blueGrey.png.base64	false	unknown
https://www.38cp66.cc:8989/chess.html?apiType=5&apiId=111	false	unknown
https://336.439dddd3dg.com/visitor.ashx?siteId=60003589	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/hongbao.css	false	unknown
https://psowoexvd.n2vu8zpu2f6.com/visitorside/js/Button.4a980e7e.js	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/plugin/js/swiper-4.3.3.min.js	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/inco3.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/sport-pic-188bet.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/hot2.gif.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/casino/images/hover-shadow.png	false	unknown
https://www.38cp66.cc:8989/sports.html?apiId=21	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/partner-logo-02.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/images/index-casino.jpg.base64	false	unknown
http://www.38cp66.cc/	true	unknown
https://o1tyg6.innittapp.com/061410/rcenter/common/static/css/gb.validation.min.css	false	unknown
https://o1tyg6.innittapp.com/fserver/files/sportTeam/football/it06.png.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/head1.jpg.base64	false	unknown
https://o1tyg6.innittapp.com/ftl/commonPage/themes/gui-base.css	false	unknown
https://o1tyg6.innittapp.com/ftl/bet365-627/themes/images/body_bg.png.base64	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://3656fkapp.com/xiazai.html	chromecache_479.2.dr	false		unknown
https://b.365jul10.com:8989/	chromecache_512.2.dr, chromecache_479.2.dr	false		unknown
https://365pina.cc:8989/	chromecache_512.2.dr, chromecache_479.2.dr	false		unknown
https://b.3656azjul11.cc:8989/verify-page/index.html	chromecache_512.2.dr, chromecache_479.2.dr	false		unknown
http://www.idangero.us/swiper/	chromecache_440.2.dr	false	URL Reputation: safe	unknown
https://678.439dddd3dg.com	chromecache_398.2.dr, chromecache_389.2.dr	false		unknown
https://psowoexvd.n2vu8zpu2f6.com	chromecache_398.2.dr, chromecache_389.2.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526895
Start date and time:	2024-10-06 17:38:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.38cp66.cc/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@20/532@25/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.38cp66.cc:8989/chess.html?apiType=5&apiId=111 Browse: https://www.38cp66.cc:8989/sports.html?apiId=21

Input	Output
URL: https://www.38cp66.cc:8989/ Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.38cp66.cc:8989/ Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.38cp66.cc:8989/sports.html?apiId=21 Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.38cp66.cc:8989/sports.html?apiId=21 Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.38cp66.cc:8989/sports.html?apiId=21 Model: jbxai	{ "phishing_score":0, "reason":"No text found on page."}
	{ "phishing_score":0, "reason":"No text found on page."}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 250 x 215, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	20462
Entropy (8bit):	7.978889454858574
Encrypted:	false
SSDEEP:	384:T6R08Uf/vjBufBysuYYb6OP+lMymKuEynyvqwG83HUIOQJjg9BevLsAWac68Zn1Z:T665jX/lP+S2Gx8kAJj8BcsAWacTZr
MD5:	86F136869BC81DF2A646E873BD23B46D
SHA1:	C40C25BBE820C39731D1C679653B28E119CBBADC
SHA-256:	BFEBB7307F1858837E6B61BE64E46352B1CCD29BF982E9975886C9FEDA9F637F
SHA-512:	F751F09CB06F7C301654647CD4E16755DA78B6BB2ED71EEE54B82E154F76B6A00352D75B12223278FCF0DF58E8E68B5BB67C6B21E90A89F3C2256935988B704C
Malicious:	false
Reputation:	low
URL:	https://www.38cp66.cc:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_14.png
Preview:	.PNG........IHDR.....................PLTE.......`.m.v......U,.V.y..h=,..s.n8....<....0.j.g4..[.o-........L........d...g.u...x...z.....\)...XH5l......,../....d.....y.....\..o3.....E..f5P...............B.a........{E...7..V........K...&..6.S....'....S....t........"_.......D..................FF..&.....@...Nq........S......:.......0.d.?".'9S..'(..T............x_........8Y.}....u.......h...rF>...q.....m.,......,@..3........P........G.7sA6s..V?J...m.....}...d<..C...........Na5/f..-.&..}...7....T...lDQ.......NHP..n...... .....t...{Sa...kLhO-......3......S......j'..Z..k......H.Z]...T........e...x...d...mh.A..&e...@......v..g........(K.N....`.....'.........Q...bK.KO..u..[.....z6......A.}-.Pz....M{.DQj.`0...a............to.P<....\.....g_..A.D......#kX4B.....(tRNS.3.................Z8..N^u............\.Q-..LuIDATx...oH.q.....=..C...#H.2~.b.{4.Cq.\|....GMr.q.&....aT"..r`.(.rQ..H..A..........2.......w.z.O....>w?....U.wtA...>t!.\(.....r

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 17:39:23.105308056 CEST	192.168.2.6	1.1.1.1	0x16	Standard query (0)	www.38cp66.cc	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:23.105484962 CEST	192.168.2.6	1.1.1.1	0x1664	Standard query (0)	www.38cp66.cc	65	IN (0x0001)	false
Oct 6, 2024 17:39:24.836224079 CEST	192.168.2.6	1.1.1.1	0x5083	Standard query (0)	www.38cp66.cc	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:24.837039948 CEST	192.168.2.6	1.1.1.1	0x7b0	Standard query (0)	_8989._https.www.38cp66.cc	65	IN (0x0001)	false
Oct 6, 2024 17:39:25.707145929 CEST	192.168.2.6	1.1.1.1	0x3518	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:25.707274914 CEST	192.168.2.6	1.1.1.1	0x6d44	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 17:39:27.183916092 CEST	192.168.2.6	1.1.1.1	0x8090	Standard query (0)	o1tyg6.innittapp.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:27.184206963 CEST	192.168.2.6	1.1.1.1	0x1d47	Standard query (0)	o1tyg6.innittapp.com	65	IN (0x0001)	false
Oct 6, 2024 17:39:27.665468931 CEST	192.168.2.6	1.1.1.1	0xdeed	Standard query (0)	www.38cp66.cc	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:27.665823936 CEST	192.168.2.6	1.1.1.1	0xd55f	Standard query (0)	_8989._https.www.38cp66.cc	65	IN (0x0001)	false
Oct 6, 2024 17:39:29.621189117 CEST	192.168.2.6	1.1.1.1	0x7b7a	Standard query (0)	o1tyg6.innittapp.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:29.621424913 CEST	192.168.2.6	1.1.1.1	0x376	Standard query (0)	o1tyg6.innittapp.com	65	IN (0x0001)	false
Oct 6, 2024 17:39:52.360838890 CEST	192.168.2.6	1.1.1.1	0x7778	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:52.360994101 CEST	192.168.2.6	1.1.1.1	0x390b	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	65	IN (0x0001)	false
Oct 6, 2024 17:39:54.522692919 CEST	192.168.2.6	1.1.1.1	0x7b5e	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:54.522960901 CEST	192.168.2.6	1.1.1.1	0xa28e	Standard query (0)	psowoexvd.n2vu8zpu2f6.com	65	IN (0x0001)	false
Oct 6, 2024 17:40:00.120439053 CEST	192.168.2.6	1.1.1.1	0x1dcb	Standard query (0)	336.439dddd3dg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:00.120897055 CEST	192.168.2.6	1.1.1.1	0x7169	Standard query (0)	336.439dddd3dg.com	65	IN (0x0001)	false
Oct 6, 2024 17:40:04.467041016 CEST	192.168.2.6	1.1.1.1	0x9d4	Standard query (0)	336.439dddd3dg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:04.468563080 CEST	192.168.2.6	1.1.1.1	0x7586	Standard query (0)	336.439dddd3dg.com	65	IN (0x0001)	false
Oct 6, 2024 17:40:13.153664112 CEST	192.168.2.6	1.1.1.1	0x4a27	Standard query (0)	vue.livehelp100servicestandby.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:13.153887987 CEST	192.168.2.6	1.1.1.1	0x4982	Standard query (0)	vue.livehelp100servicestandby.com	65	IN (0x0001)	false
Oct 6, 2024 17:40:37.451510906 CEST	192.168.2.6	1.1.1.1	0xacd2	Standard query (0)	player.opgoalde.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:37.451924086 CEST	192.168.2.6	1.1.1.1	0x6f42	Standard query (0)	player.opgoalde.com	65	IN (0x0001)	false
Oct 6, 2024 17:40:37.477073908 CEST	192.168.2.6	1.1.1.1	0x78db	Standard query (0)	player.opgoalde.com	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 17:39:23.660634995 CEST	1.1.1.1	192.168.2.6	0x16	No error (0)	www.38cp66.cc	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:23.660634995 CEST	1.1.1.1	192.168.2.6	0x16	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:23.660634995 CEST	1.1.1.1	192.168.2.6	0x16	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:23.660634995 CEST	1.1.1.1	192.168.2.6	0x16	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:23.967752934 CEST	1.1.1.1	192.168.2.6	0x1664	No error (0)	www.38cp66.cc	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:23.967752934 CEST	1.1.1.1	192.168.2.6	0x1664	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:25.277828932 CEST	1.1.1.1	192.168.2.6	0x5083	No error (0)	www.38cp66.cc	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:25.277828932 CEST	1.1.1.1	192.168.2.6	0x5083	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:25.277828932 CEST	1.1.1.1	192.168.2.6	0x5083	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:25.277828932 CEST	1.1.1.1	192.168.2.6	0x5083	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:25.481996059 CEST	1.1.1.1	192.168.2.6	0x7b0	Name error (3)	_8989._https.www.38cp66.cc	none	none	65	IN (0x0001)	false
Oct 6, 2024 17:39:25.713963985 CEST	1.1.1.1	192.168.2.6	0x3518	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:25.714826107 CEST	1.1.1.1	192.168.2.6	0x6d44	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 6, 2024 17:39:27.632828951 CEST	1.1.1.1	192.168.2.6	0x1d47	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:27.632828951 CEST	1.1.1.1	192.168.2.6	0x1d47	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:27.645890951 CEST	1.1.1.1	192.168.2.6	0x8090	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:27.645890951 CEST	1.1.1.1	192.168.2.6	0x8090	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:27.645890951 CEST	1.1.1.1	192.168.2.6	0x8090	No error (0)	l5-global.gslb.ksyuncdn.com		103.155.16.134	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:27.645890951 CEST	1.1.1.1	192.168.2.6	0x8090	No error (0)	l5-global.gslb.ksyuncdn.com		103.198.200.7	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:27.675796986 CEST	1.1.1.1	192.168.2.6	0xdeed	No error (0)	www.38cp66.cc	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:27.675796986 CEST	1.1.1.1	192.168.2.6	0xdeed	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:27.675796986 CEST	1.1.1.1	192.168.2.6	0xdeed	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:27.675796986 CEST	1.1.1.1	192.168.2.6	0xdeed	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:28.551501036 CEST	1.1.1.1	192.168.2.6	0xd55f	Name error (3)	_8989._https.www.38cp66.cc	none	none	65	IN (0x0001)	false
Oct 6, 2024 17:39:30.056013107 CEST	1.1.1.1	192.168.2.6	0x376	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:30.056013107 CEST	1.1.1.1	192.168.2.6	0x376	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:30.404581070 CEST	1.1.1.1	192.168.2.6	0x7b7a	No error (0)	o1tyg6.innittapp.com	o1tyg6.innittapp.com.download.ks-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:30.404581070 CEST	1.1.1.1	192.168.2.6	0x7b7a	No error (0)	o1tyg6.innittapp.com.download.ks-cdn.com	l5-global.gslb.ksyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:30.404581070 CEST	1.1.1.1	192.168.2.6	0x7b7a	No error (0)	l5-global.gslb.ksyuncdn.com		103.155.16.134	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:30.404581070 CEST	1.1.1.1	192.168.2.6	0x7b7a	No error (0)	l5-global.gslb.ksyuncdn.com		103.198.200.7	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:35.342606068 CEST	1.1.1.1	192.168.2.6	0xbd30	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:35.342606068 CEST	1.1.1.1	192.168.2.6	0xbd30	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:52.407723904 CEST	1.1.1.1	192.168.2.6	0x390b	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:52.407723904 CEST	1.1.1.1	192.168.2.6	0x390b	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:52.408535004 CEST	1.1.1.1	192.168.2.6	0x7778	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:52.408535004 CEST	1.1.1.1	192.168.2.6	0x7778	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:52.408535004 CEST	1.1.1.1	192.168.2.6	0x7778	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.104	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:52.408535004 CEST	1.1.1.1	192.168.2.6	0x7778	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.62	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:52.408535004 CEST	1.1.1.1	192.168.2.6	0x7778	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.58	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:52.408535004 CEST	1.1.1.1	192.168.2.6	0x7778	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.122	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:54.591975927 CEST	1.1.1.1	192.168.2.6	0xa28e	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:54.591975927 CEST	1.1.1.1	192.168.2.6	0xa28e	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:54.635235071 CEST	1.1.1.1	192.168.2.6	0x7b5e	No error (0)	psowoexvd.n2vu8zpu2f6.com	vueselfdomain.livehelp100service.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:54.635235071 CEST	1.1.1.1	192.168.2.6	0x7b5e	No error (0)	vueselfdomain.livehelp100service.com	d2fbug8oy6zx3g.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:39:54.635235071 CEST	1.1.1.1	192.168.2.6	0x7b5e	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.104	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:54.635235071 CEST	1.1.1.1	192.168.2.6	0x7b5e	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.122	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:54.635235071 CEST	1.1.1.1	192.168.2.6	0x7b5e	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.58	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:39:54.635235071 CEST	1.1.1.1	192.168.2.6	0x7b5e	No error (0)	d2fbug8oy6zx3g.cloudfront.net		13.225.78.62	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:00.160054922 CEST	1.1.1.1	192.168.2.6	0x7169	No error (0)	336.439dddd3dg.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:40:00.187182903 CEST	1.1.1.1	192.168.2.6	0x1dcb	No error (0)	336.439dddd3dg.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:40:00.187182903 CEST	1.1.1.1	192.168.2.6	0x1dcb	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		75.2.42.240	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:00.187182903 CEST	1.1.1.1	192.168.2.6	0x1dcb	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		99.83.207.187	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:04.520618916 CEST	1.1.1.1	192.168.2.6	0x9d4	No error (0)	336.439dddd3dg.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:40:04.520618916 CEST	1.1.1.1	192.168.2.6	0x9d4	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		75.2.42.240	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:04.520618916 CEST	1.1.1.1	192.168.2.6	0x9d4	No error (0)	a48d7a3baeaba2a67.awsglobalaccelerator.com		99.83.207.187	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:04.529067993 CEST	1.1.1.1	192.168.2.6	0x7586	No error (0)	336.439dddd3dg.com	a48d7a3baeaba2a67.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:40:13.187180042 CEST	1.1.1.1	192.168.2.6	0x4982	No error (0)	vue.livehelp100servicestandby.com	d30ye5lgbv8wkd.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:40:13.199906111 CEST	1.1.1.1	192.168.2.6	0x4a27	No error (0)	vue.livehelp100servicestandby.com	d30ye5lgbv8wkd.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 17:40:13.199906111 CEST	1.1.1.1	192.168.2.6	0x4a27	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.52	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:13.199906111 CEST	1.1.1.1	192.168.2.6	0x4a27	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.54	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:13.199906111 CEST	1.1.1.1	192.168.2.6	0x4a27	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.4	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:13.199906111 CEST	1.1.1.1	192.168.2.6	0x4a27	No error (0)	d30ye5lgbv8wkd.cloudfront.net		108.138.7.65	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:14.314549923 CEST	1.1.1.1	192.168.2.6	0x8d83	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:14.314549923 CEST	1.1.1.1	192.168.2.6	0x8d83	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:36.081629038 CEST	1.1.1.1	192.168.2.6	0xeb03	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:36.081629038 CEST	1.1.1.1	192.168.2.6	0xeb03	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:37.461395025 CEST	1.1.1.1	192.168.2.6	0xacd2	Name error (3)	player.opgoalde.com	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:40:37.483376980 CEST	1.1.1.1	192.168.2.6	0x6f42	Name error (3)	player.opgoalde.com	none	none	65	IN (0x0001)	false
Oct 6, 2024 17:40:37.488195896 CEST	1.1.1.1	192.168.2.6	0x78db	Name error (3)	player.opgoalde.com	none	none	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 6, 2024 17:39:23.730523109 CEST	428	OUT	GET / HTTP/1.1 Host: www.38cp66.cc Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 6, 2024 17:39:24.590518951 CEST	232	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=utf-8 Location: https://www.38cp66.cc:8989/ Date: Sun, 06 Oct 2024 15:39:24 GMT Content-Length: 62 Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 33 38 63 70 36 36 2e 63 63 3a 38 39 38 39 2f 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://www.38cp66.cc:8989/">Moved Permanently</a>.
Oct 6, 2024 17:40:09.638358116 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 48 76 45 4b 66 47 7a 4d 6b 6d 6b 74 67 76 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 37 62 38 61 31 64 64 62 38 30 35 33 33 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: eHvEKfGzMkmktgv1.1Context: c37b8a1ddb805330
2024-10-06 15:39:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-06 15:39:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 48 76 45 4b 66 47 7a 4d 6b 6d 6b 74 67 76 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 37 62 38 61 31 64 64 62 38 30 35 33 33 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 4b 38 62 75 69 73 34 46 69 56 42 76 50 64 4e 59 78 6f 49 58 2b 2f 42 57 6e 67 39 7a 78 38 52 51 33 56 74 37 75 54 62 52 2b 36 31 4a 38 34 54 72 6d 55 57 49 79 59 53 6d 42 37 4b 52 62 45 75 6e 59 77 45 61 6e 55 37 6c 42 67 42 32 75 58 41 32 38 43 78 61 6b 2f 68 46 68 37 68 4e 33 50 32 52 39 36 43 75 6c 52 70 36 4c 32 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: eHvEKfGzMkmktgv1.2Context: c37b8a1ddb805330<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASNK8buis4FiVBvPdNYxoIX+/BWng9zx8RQ3Vt7uTbR+61J84TrmUWIyYSmB7KRbEunYwEanU7lBgB2uXA28Cxak/hFh7hN3P2R96CulRp6L2w
2024-10-06 15:39:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 48 76 45 4b 66 47 7a 4d 6b 6d 6b 74 67 76 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 37 62 38 61 31 64 64 62 38 30 35 33 33 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: eHvEKfGzMkmktgv1.3Context: c37b8a1ddb805330<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-06 15:39:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-06 15:39:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 4d 56 6c 64 51 35 49 51 45 75 67 67 53 77 63 49 79 4d 37 69 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: EMVldQ5IQEuggSwcIyM7iw.0Payload parsing failed.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.38cp66.cc/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 222

Chrome Cache Entry: 223

Chrome Cache Entry: 224

Chrome Cache Entry: 225

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Windows Analysis Report
http://www.38cp66.cc/

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-06 15:39:26 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=3991 Date: Sun, 06 Oct 2024 15:39:26 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:27 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 15:39:27 UTC	540	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 15:39:27 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 4dad204e-401e-005b-4bf5-169c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T153927Z-1657d5bbd48p2j6x2quer0q02800000002a000000000gwyr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 15:39:27 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-06 15:39:27 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-06 15:39:27 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-06 15:39:27 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-06 15:39:27 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-06 15:39:27 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-06 15:39:27 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-06 15:39:28 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-06 15:39:28 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-06 15:39:28 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-06 15:39:27 UTC	513	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=3947 Date: Sun, 06 Oct 2024 15:39:27 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-06 15:39:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:28 UTC	570	OUT	GET /ftl/commonPage/themes/gui-base.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.38cp66.cc:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 15:39:29 UTC	695	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 17137 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-05 ETag: W/"66bc0c2d-145e6" Date: Thu, 26 Sep 2024 13:01:33 GMT Last-Modified: Wed, 14 Aug 2024 01:45:17 GMT Expires: Sat, 26 Oct 2024 13:01:33 GMT Age: 873476 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-213 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-05 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-16 X-Cdn-Request-ID: 0dcbe8a654054ca93dd6a2080b461851
2024-10-06 15:39:29 UTC	15689	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 79 93 e4 c6 75 e7 ff fa 14 50 33 18 9c 21 ab 8a 00 ea ee 0a 4e 88 94 ad 23 2c d9 5e 51 d6 1e 14 83 81 02 b2 aa c0 41 01 25 00 d5 07 3b ca a1 f0 5a 22 ad b5 0e cb b2 b4 3a bc a2 7c 2d ad 90 e4 db 26 45 4a fe 32 ec 99 e1 5f fe 0a ce 1b 79 bc 44 a1 7b 64 ef 76 93 d3 55 99 bf 7c f9 f2 bd 97 2f ef cc 67 9f fe f0 87 bc a7 bd 8f 47 5b f4 42 71 f1 3b 9f ec bf 10 55 c8 bb 73 fd c3 9f 3f fc d1 17 3f f8 9f 6f 5d bf f1 e5 bb 04 70 86 ca 2a 2d 72 2f 18 f8 83 39 09 78 7e 5f 6f 8a f2 d4 7b b1 46 67 28 27 21 bf 16 d5 c8 db 16 49 ba 4a 51 e2 85 7e 30 ed fb f3 be 1f e2 b8 67 3f f4 ec d3 de c3 9f ff d9 f5 1f 7e e9 c1 9b ff 72 fd de d7 49 d0 47 d2 ed ae 28 6b 6f 5f 66 77 4e 36 45 be 5e 46 c5 20 ae aa 93 bb 0b 02 bf fe d2 5b d7 7f f7 c5 eb Data Ascii: }yuP3!N#,^QA%;Z":\|-&EJ2_yD{dvU\|/gG[Bq;Us??o]p*-r/9x~_o{Fg('!IJQ~0g?~rIG(ko_fwN6E^F [
2024-10-06 15:39:29 UTC	1448	IN	Data Raw: 22 de 9c df 4e 75 f3 26 d2 63 75 13 12 2b af a6 06 8f b8 fd df a7 7d fc 2f ee d6 28 9a ef 2b ab e2 9e 0a 12 ad 88 d7 b9 74 10 fb 78 08 fe 9f c9 87 6e 15 64 fc ff 1f 9d e3 6d f5 6a 08 e6 3f 4b a9 d8 81 fa d6 e0 05 bb 5d e6 75 57 78 e0 bb 79 f0 f5 6f be ff ee 3f 3f f8 fa 37 3e f8 f2 37 ff ed bd ef 11 b7 cb fa 24 fd 3a dd e9 be d6 f7 e7 2b b4 92 1e 7f 48 6e ac 50 fa 41 0b 55 11 ea d0 93 21 d5 de 05 3f 98 ad dd 89 42 5b 05 45 5e a4 c0 0d 27 83 28 c3 7e 4d ba 2a df d3 a3 95 0b 46 9a ab 45 3c be b5 47 87 7a 3b 68 2c 00 0f 6f f4 84 03 fc 8f b4 96 db 12 89 14 7b 55 07 37 6a a7 85 ca ab 25 6f fa 85 ec fc 82 da 19 ae 91 c9 58 1d 93 8d e8 37 6a 6f 64 12 53 f4 b3 fb 2c 5c cc 4c 10 35 fa 52 8d e4 b3 35 f0 75 b0 24 8e 8f 48 c6 ec 51 b0 9a 92 ed e2 b1 6d 84 1a e7 fb bf Data Ascii: "Nu&cu+}/(+txndmj?K]uWxyo??7>7$:+HnPAU!?B[E^'(~M*FE<Gz;h,o{U7j%oX7jodS,\L5R5u$HQm

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:28 UTC	578	OUT	GET /ftl/commonPage/themes/gui-skin-default.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.38cp66.cc:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 15:39:29 UTC	679	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 6253 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-06 ETag: W/"64ad1569-7b6e" Date: Sun, 06 Oct 2024 15:39:29 GMT Last-Modified: Tue, 11 Jul 2023 08:40:09 GMT Expires: Tue, 05 Nov 2024 15:39:29 GMT Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-206 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-06 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-05 X-Cdn-Request-ID: b153659a39d27d65043c2b1e22640573
2024-10-06 15:39:29 UTC	6253	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 8f 1c c7 71 df f5 2b c6 14 08 de f1 6e 96 b3 cf bb dd 05 0f 3e 92 47 8a 72 68 4b 7c 58 24 65 7d 98 9d e9 dd 1d 71 76 66 31 33 cb bb e3 e2 00 05 49 04 2b 8e f3 70 92 0f 81 23 20 8c 11 c3 5f ec 0f 09 02 24 91 6d fd 97 c0 a4 c4 4f fe 0b e9 e7 4c 3f 6a 1e 7b 52 00 11 d0 1d a5 9b ed ae ae ae aa ae ae ae ae ae e9 fd e3 67 9f 5f b9 fc 9d 37 ac cb d6 2d 77 81 ae c5 27 0f 6e db f7 9e 04 91 7d 03 4d dd 55 98 59 5b af 7e f1 d7 2f ff e5 b7 af fe ec 57 2f 7e fc f1 1f 7f fb c9 ff 7e f4 0f f8 df 17 ff f4 bb 2f 3f f9 f7 2f fe e3 33 56 4b da 3f 45 49 1a c4 91 d5 6e 39 ad 21 29 38 5c 65 f3 38 19 59 f7 32 f4 14 45 a4 e4 86 9b 21 6b 11 fb c1 34 40 be d5 71 da 7b b6 33 b4 3b 6d 5c 77 85 50 71 35 ff b1 fc 24 5e fa f1 71 94 5a 7f f8 af 9f Data Ascii: =kq+n>GrhK\|X$e}qvf13I+p# _$mOL?j{Rg_7-w'n}MUY[~/W/~~/?/3VK?EIn9!)8\e8Y2E!k4@q{3;m\wPq5$^qZ

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:28 UTC	574	OUT	GET /ftl/bet365-627/themes/style/common.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.38cp66.cc:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 15:39:29 UTC	677	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 55877 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: "6327fe95-da45" Date: Mon, 16 Sep 2024 14:23:15 GMT Last-Modified: Mon, 19 Sep 2022 05:31:01 GMT Expires: Wed, 16 Oct 2024 14:23:15 GMT Age: 1732574 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-212 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-20 X-Cdn-Request-ID: 4abcb9a0e7613d71422a0787cb02d893
2024-10-06 15:39:29 UTC	15707	IN	Data Raw: ef bb bf 2f 2a 21 0a 20 2a 20 42 65 74 33 36 35 0a 20 2a 20 41 75 74 68 6f 72 3a 20 53 74 65 76 65 6e 0a 20 2a 20 55 70 64 61 74 65 20 62 79 20 32 30 31 37 2d 30 32 2d 32 30 0a 20 2a 2f 0a 0a 2f 2a 20 e7 a6 81 e7 94 a8 e5 93 8d e5 ba 94 20 2a 2f 0a 2e 63 6f 6e 74 61 69 6e 65 72 2d 66 6c 75 69 64 2c 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 31 30 30 70 78 7d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 39 39 30 70 78 29 7b 0a 09 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 33 33 35 70 78 3b 7d 0a 7d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 0a 09 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 33 33 35 70 78 3b 7d 0a 7d 0a 2e 73 63 72 65 65 6e 2d 6c 67 20 2e 63 6f 6e 74 61 69 6e Data Ascii: /! Bet365 * Author: Steven * Update by 2017-02-20 // */.container-fluid,.container{width:1100px}@media (min-width:990px){.container{width:1335px;}}@media (min-width:1200px){.container{width:1335px;}}.screen-lg .contain
2024-10-06 15:39:29 UTC	16384	IN	Data Raw: 7b 63 6f 6c 6f 72 3a 23 46 46 44 46 31 42 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 33 3b 7d 0a 0a 2f 2a 20 69 6e 64 65 78 2d 73 6c 69 64 65 20 2a 2f 0a 2e 69 6e 64 65 78 2d 77 72 61 70 20 2e 6d 61 69 6e 2d 77 72 61 70 7b 77 69 64 74 68 3a 38 36 30 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 33 33 3b 70 61 64 64 69 6e 67 3a 35 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 3b 7d 0a 2e 69 6e 64 65 78 2d 73 6c 69 64 65 7b 77 69 64 74 68 3a 38 34 34 70 78 3b 68 65 69 67 68 74 3a 32 32 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 36 33 36 33 36 33 3b 6d 61 72 67 69 6e 3a 35 Data Ascii: {color:#FFDF1B;background-color:#333;}/* index-slide */.index-wrap .main-wrap{width:860px;float:left;background:#333;padding:5px;overflow:hidden;margin-bottom:0;}.index-slide{width:844px;height:220px;position:relative;border:3px solid #636363;margin:5
2024-10-06 15:39:29 UTC	16384	IN	Data Raw: 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 6e 61 76 69 20 61 2e 69 63 6f 32 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 37 31 70 78 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 6e 61 76 69 20 61 2e 69 63 6f 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 32 32 38 70 78 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 61 64 62 6f 78 20 69 6d 67 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 61 64 62 6f 78 20 69 6d 67 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 31 39 39 65 39 65 3b 7d 0a 2e 63 61 73 69 6e 6f 2d 6c 69 73 74 20 75 6c 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 7d 0a Data Ascii: nt;color:#fff;}.casino-navi a.ico2{background-position:0 -171px;}.casino-navi a.ico3{background-position:0 -228px;}.casino-adbox img{border:1px solid #000;width:100%;}.casino-adbox img:hover{border-color:#199e9e;}.casino-list ul{padding:0;margin:0;}
2024-10-06 15:39:29 UTC	7402	IN	Data Raw: 64 65 72 2d 70 61 6e 65 6c 20 2e 6d 65 6d 62 65 72 73 2d 64 72 6f 70 64 6f 77 6e 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 33 33 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 62 62 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 29 3b 63 6f 6c 6f 72 3a 23 33 33 33 3b 7d 0a 2e 68 65 61 64 65 72 2d 70 61 6e 65 6c 20 2e 6d 65 6d 62 65 72 73 2d 64 72 6f 70 64 6f 77 6e 3e 6c 69 7b 6d 61 72 67 69 6e 3a 33 70 78 20 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 2e 68 65 61 64 65 72 2d 70 61 6e 65 6c 20 2e 6d 65 6d 62 65 72 73 2d 64 72 6f 70 64 6f Data Ascii: der-panel .members-dropdown{margin-top:0;padding:0;border:1px solid #333;border-radius:4px;background-color:#bbb;box-shadow:0 0 10px rgba(0,0,0,.3);color:#333;}.header-panel .members-dropdown>li{margin:3px 0;font-size:12px;}.header-panel .members-dropdo

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:28 UTC	588	OUT	GET /ftl/bet365-627/themes/style/bootstrap-dialog.min.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.38cp66.cc:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 15:39:29 UTC	675	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2780 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: "6156cab3-adc" Date: Mon, 16 Sep 2024 14:23:17 GMT Last-Modified: Fri, 01 Oct 2021 08:45:39 GMT Expires: Wed, 16 Oct 2024 14:23:17 GMT Age: 1732572 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-212 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-03 X-Cdn-Request-ID: 8ec6b7348ff1d3af3c5e6440b45e2a71
2024-10-06 15:39:29 UTC	2780	IN	Data Raw: 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 6d 6f 64 61 6c 2d 68 65 61 64 65 72 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 20 34 70 78 0a 7d 0a 0a 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 2d 74 69 74 6c 65 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 0a 7d 0a 0a 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 20 2e 62 6f 6f 74 73 74 72 61 70 2d 64 69 61 6c 6f 67 2d 6d 65 73 73 61 67 65 20 Data Ascii: .bootstrap-dialog .modal-header { border-top-left-radius: 4px; border-top-right-radius: 4px}.bootstrap-dialog .bootstrap-dialog-title { color: #fff; text-align: center; font-size: 18px}.bootstrap-dialog .bootstrap-dialog-message

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:28 UTC	584	OUT	GET /ftl/bet365-627/themes/style/swiper-4.3.3.min.css HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.38cp66.cc:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 15:39:29 UTC	693	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 19773 Connection: close Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-05 ETag: "615c2c2b-4d3d" Date: Mon, 16 Sep 2024 14:23:18 GMT Last-Modified: Tue, 05 Oct 2021 10:42:51 GMT Expires: Wed, 16 Oct 2024 14:23:18 GMT Age: 1732571 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: MISS uuid: - out-line: gb-cdn-213 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-FOREIGN-12-05 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-02 X-Cdn-Request-ID: b587b87af3f946c9a59d7294f44e105e
2024-10-06 15:39:29 UTC	15691	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 53 77 69 70 65 72 20 34 2e 33 2e 33 0a 20 2a 20 4d 6f 73 74 20 6d 6f 64 65 72 6e 20 6d 6f 62 69 6c 65 20 74 6f 75 63 68 20 73 6c 69 64 65 72 20 61 6e 64 20 66 72 61 6d 65 77 6f 72 6b 20 77 69 74 68 20 68 61 72 64 77 61 72 65 20 61 63 63 65 6c 65 72 61 74 65 64 20 74 72 61 6e 73 69 74 69 6f 6e 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 69 64 61 6e 67 65 72 6f 2e 75 73 2f 73 77 69 70 65 72 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 2d 32 30 31 38 20 56 6c 61 64 69 6d 69 72 20 4b 68 61 72 6c 61 6d 70 69 64 69 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 6f 6e 3a 20 4a 75 6e 65 20 35 2c 20 32 30 31 Data Ascii: /** * Swiper 4.3.3 * Most modern mobile touch slider and framework with hardware accelerated transitions * http://www.idangero.us/swiper/ * * Copyright 2014-2018 Vladimir Kharlampidi * * Released under the MIT License * * Released on: June 5, 201
2024-10-06 15:39:29 UTC	4082	IN	Data Raw: 33 44 27 36 30 27 25 32 30 78 32 25 33 44 27 36 30 27 25 32 30 79 31 25 33 44 27 37 27 25 32 30 79 32 25 33 44 27 32 37 27 25 32 30 73 74 72 6f 6b 65 25 33 44 27 25 32 33 66 66 66 27 25 32 30 73 74 72 6f 6b 65 2d 77 69 64 74 68 25 33 44 27 31 31 27 25 32 30 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 25 33 44 27 72 6f 75 6e 64 27 25 32 46 25 33 45 25 33 43 25 32 46 64 65 66 73 25 33 45 25 33 43 67 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 32 37 27 25 32 46 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 32 37 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 Data Ascii: 3D'60'%20x2%3D'60'%20y1%3D'7'%20y2%3D'27'%20stroke%3D'%23fff'%20stroke-width%3D'11'%20stroke-linecap%3D'round'%2F%3E%3C%2Fdefs%3E%3Cg%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.27'%2F%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.27'%20transform%3D'r

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:28 UTC	567	OUT	GET /ftl/commonPage/js/jquery/jquery-1.11.3.min.js HTTP/1.1 Host: o1tyg6.innittapp.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.38cp66.cc:8989/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 15:39:29 UTC	709	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 33545 Connection: close Server: Default-server-KS-CLOUD-XJP-12-04 ETag: W/"5d848f4f-176d4" Date: Tue, 24 Sep 2024 18:27:36 GMT Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT Expires: Thu, 24 Oct 2024 18:27:36 GMT Age: 1026713 Cache-Control: max-age=86400 Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN X-Cache: HIT uuid: - out-line: gb-cdn-206 x-link-via: xjp21:443;xjp12:80; X-Cache-Status: MISS from KS-CLOUD-XJP-12-04 X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-21-02 X-Cdn-Request-ID: e0457df44abb7fd2d90f61e86b3a1836
2024-10-06 15:39:29 UTC	15675	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd 79 7b e3 c6 b1 2e fe ff f9 14 22 e2 43 03 c3 16 25 8e ed dc 13 70 20 3e b6 c7 8e ed 78 4b 66 1c 3b a1 68 3f d8 48 42 e2 26 92 1a 8d 2c 32 9f fd d6 5b d5 dd 68 2c 1c 3b e7 dc df f2 5c 27 23 62 69 f4 5a 5d 5b d7 72 f1 ac 73 76 f3 d7 fb 7c fb 78 f6 66 d0 1f 0c fa 1f 9c 1d ce fc 34 38 7b 7e 79 f9 91 a2 bf 83 8f cc fb cf d7 f7 ab 2c de 17 eb 95 3a fb 72 95 f6 a9 e0 cd 1d de f4 d7 db d9 c5 a2 48 f3 d5 2e 3f 7b 76 f1 1f 9d e9 fd 2a 45 39 3f 56 49 f0 e4 ad 93 9b 3c dd 7b 51 b4 7f dc e4 eb e9 d9 72 9d dd 2f f2 6e f7 c4 8b 7e fe 76 b3 de ee 77 a3 ea 6d 14 f7 b3 75 7a bf cc 57 fb 51 42 35 77 2e 83 b0 6c 28 78 2a a6 7e a7 2c 12 ec e7 db f5 c3 d9 2a 7f 38 fb 6c bb 5d 6f 7d 4f 8f 62 9b df dd 17 db 7c 77 16 9f 3d 14 ab 8c ca 3c 14 fb Data Ascii: y{."C%p >xKf;h?HB&,2[h,;\'#biZ][rsv\|xf48{~y,:rH.?{vE9?VI<{Qr/n~vwmuzWQB5w.l(x~,*8l]o}Ob\|w=<
2024-10-06 15:39:29 UTC	16384	IN	Data Raw: df 79 bd cc ca 8b 3d 68 12 92 9c a8 76 7e bf 92 65 72 b9 96 aa c7 56 19 1f 47 b8 17 e8 0c c1 77 15 ab 78 a1 95 88 7e ed 49 5f 5a e7 43 2a fb 1d cc eb d4 ae 58 de 2f 2a 6e 90 5a 95 27 fb 3d 2f 35 b5 0e 15 82 d1 08 6b 2b 62 55 ec 5e e9 1a 38 a5 43 a5 55 c2 af c7 60 98 8d 6a 62 84 9f 9b ec ca 4d f5 b7 56 7c c0 59 ed 84 b4 94 36 f8 41 e0 4b 57 3f 14 b5 3a db 8c aa 03 04 af dd 52 0a 73 d9 e6 7a c3 46 75 f5 44 dc a5 e7 b7 1c 22 0d 2b be 36 b4 0a 5a 9d 11 4b 26 6a 18 f6 f3 a5 48 61 55 c7 1c 88 fa 01 06 22 43 68 25 2c 00 b8 4a c4 2b 29 3c f2 d9 cf 8f 8f 15 04 28 2b ab 60 62 34 b1 28 aa f9 1c 7e d0 9c df c8 86 82 b4 8f 1c 64 d3 7c 29 b3 55 42 16 58 f6 51 1c 87 89 89 e2 25 6d c2 3d dc 82 11 6f b4 44 87 47 b0 a4 3a 92 21 98 5b 68 fc 56 24 c3 8a 78 20 c6 3c 25 0b 07 Data Ascii: y=hv~erVGwx~I_ZCX/nZ'=/5k+bU^8CU`jbMV\|Y6AKW?:RszFuD"+6ZK&jHaU"Ch%,J+)<(+`b4(~d\|)UBXQ%m=oDG:![hV$x <%
2024-10-06 15:39:29 UTC	1486	IN	Data Raw: a1 6c 03 b6 3a bd 60 32 1b f4 58 f8 11 56 f8 41 42 07 2c 92 20 45 5d 66 05 74 19 f1 c7 a2 ad 79 09 69 17 74 9e 93 c6 6c 15 0d 19 9b 99 35 23 00 d3 d9 85 c4 c3 01 f3 94 c2 f4 79 15 ed 11 8f 15 69 21 dd c4 69 05 c3 4a e3 3e 5f 1d cd 17 eb 23 6c 23 e6 9c 4f 68 0a 76 2a 9c 92 54 18 a8 ec 91 be 82 84 bc 0a 6a 9e 38 65 fb 9d 1a b7 f8 79 97 02 4c 12 f3 f0 c2 c9 2d 1b 93 f5 41 fb 54 86 96 d9 44 bc 9a d8 b9 87 7f fc ba 33 61 4e dd 24 ad 5d 80 17 0b a7 fc 18 81 ac 23 c3 0e f2 7c 42 46 69 1d c1 bc 45 4f 3c 0f f4 c4 5b 8d a0 b4 22 2e 60 3b ab a9 7c 12 75 5c 30 f5 21 c6 e6 10 7a 70 dc 3c b4 61 c5 c6 d9 b0 68 80 55 c4 e0 8e 47 09 07 06 28 36 04 2b 5e 2e f3 09 7f a1 e3 c7 e4 ae f8 2d 15 1a 9f 26 81 66 43 03 a6 0e 46 76 53 2d 27 55 67 08 3f 79 1e af 4a f3 6e 0a 71 fe c9 Data Ascii: l:`2XVAB, E]ftyitl5#yi!iJ>_#l#Ohv*Tj8eyL-ATD3aN$]#\|BFiEO<[".`;\|u\0!zp<ahUG(6+^.-&fCFvS-'Ug?yJnq

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:39:29 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 15:39:29 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 15:39:29 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 4545068c-701e-0050-0e05-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T153929Z-1657d5bbd48t66tjar5xuq22r8000000025000000000b9r3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 15:39:29 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""